@sebastienrousseau/dotfiles 0.2.501 → 0.2.502

package/scripts/ci/dot-cli-startup-bench.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# scripts/ci/dot-cli-startup-bench.sh
+#
+# Sub-100ms cold-start gate for the `dot` CLI dispatcher.
+#
+# The §3 audit roadmap calls for measuring `dot help` / `dot version`
+# cold-start time and gating PRs on a regression budget. This script
+# runs the dispatcher N times under a clean shell, computes the median
+# elapsed time, and exits non-zero when the median exceeds the budget.
+#
+# Usage:
+#   bash scripts/ci/dot-cli-startup-bench.sh [--budget-ms <n>] [--runs <n>] [--cmd <argv>]
+#
+# Env overrides:
+#   DOT_BENCH_BUDGET_MS   Default budget in ms (default: 250).
+#   DOT_BENCH_RUNS        Number of runs (default: 11; median-of-N).
+#   DOT_BENCH_CMD         Argv passed to `dot` (default: "version").
+#
+# The default budget is 250ms — looser than the §3 aspirational 100ms
+# while we lazy-load mise/asdf/etc. CI ratchets this number down as
+# improvements land. Bench *failure* is a hard build failure; bench
+# *regression* (median > previous baseline + 15%) is a warning.
+
+set -euo pipefail
+
+BUDGET_MS="${DOT_BENCH_BUDGET_MS:-250}"
+RUNS="${DOT_BENCH_RUNS:-11}"
+DOT_ARGV_RAW="${DOT_BENCH_CMD:-version}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --budget-ms)
+      BUDGET_MS="$2"
+      shift 2
+      ;;
+    --runs)
+      RUNS="$2"
+      shift 2
+      ;;
+    --cmd)
+      DOT_ARGV_RAW="$2"
+      shift 2
+      ;;
+    -h | --help)
+      sed -n '5,25p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+# Locate the dot dispatcher binary. Prefer the repo-local copy so a
+# user-installed `dot` on PATH can't sneak in.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+DOT_BIN="$REPO_ROOT/dot_local/bin/executable_dot"
+if [[ ! -x "$DOT_BIN" ]] && command -v dot >/dev/null 2>&1; then
+  DOT_BIN="$(command -v dot)"
+fi
+if [[ ! -f "$DOT_BIN" ]]; then
+  echo "::error::dot binary not found at $DOT_BIN" >&2
+  exit 2
+fi
+
+# Portable wall-clock to ms. macOS bash 3.2 has no $EPOCHREALTIME.
+_now_ms() {
+  if [[ -n "${EPOCHREALTIME:-}" ]]; then
+    # zsh / bash 5+: floating-point seconds.
+    awk -v t="$EPOCHREALTIME" 'BEGIN{printf "%d\n", t*1000}'
+  elif date +%s%N 2>/dev/null | grep -qE '^[0-9]+$'; then
+    # GNU date: nanoseconds.
+    echo $(($(date +%s%N) / 1000000))
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 -c 'import time; print(int(time.time()*1000))'
+  else
+    # Fall back to seconds × 1000 (low resolution; warn).
+    echo "::warning::no high-resolution clock; using whole-second precision" >&2
+    echo $(($(date +%s) * 1000))
+  fi
+}
+
+# Parse argv string (space-separated).
+read -r -a DOT_ARGV <<<"$DOT_ARGV_RAW"
+
+echo "dot CLI cold-start benchmark"
+echo "  binary : $DOT_BIN"
+echo "  argv   : ${DOT_ARGV[*]}"
+echo "  runs   : $RUNS"
+echo "  budget : ${BUDGET_MS}ms"
+echo
+
+samples=()
+for ((i = 1; i <= RUNS; i++)); do
+  start_ms="$(_now_ms)"
+  # `env -i` strips inherited cached state so we measure cold-start, not
+  # warm-cache. Keep PATH so the dispatcher can find git/awk/etc.
+  env -i HOME="$HOME" PATH="$PATH" "$DOT_BIN" "${DOT_ARGV[@]}" >/dev/null 2>&1 || true
+  end_ms="$(_now_ms)"
+  elapsed=$((end_ms - start_ms))
+  samples+=("$elapsed")
+  printf '  run %2d: %dms\n' "$i" "$elapsed"
+done
+
+# Median of samples (odd RUNS → middle value).
+median="$(printf '%s\n' "${samples[@]}" | sort -n | awk -v n="$RUNS" 'NR==int(n/2)+1{print; exit}')"
+echo
+echo "median: ${median}ms  budget: ${BUDGET_MS}ms"
+
+# Optional baseline record for trend tracking.
+baseline_file="${DOT_BENCH_BASELINE:-$REPO_ROOT/.cache/dot-cli-startup-baseline.txt}"
+mkdir -p "$(dirname "$baseline_file")" 2>/dev/null || true
+printf '%s\n' "$median" >"$baseline_file"
+
+if ((median > BUDGET_MS)); then
+  echo "::error::dot CLI cold-start regression: median ${median}ms > budget ${BUDGET_MS}ms" >&2
+  echo "  Possible causes: a slow source-time helper in dot_local/bin/executable_dot," >&2
+  echo "  an unconditional ${BUDGET_MS}ms+ tool init at top of a sourced lib, or" >&2
+  echo "  unnecessary jq/awk calls before the dispatcher case statement." >&2
+  exit 1
+fi
+
+echo "✓ dot CLI cold-start within budget"

package/scripts/ci/install-chezmoi-verified.sh

@@ -26,7 +26,10 @@ case "$ARCH" in
   x86_64 | amd64) ARCH="amd64" ;;
   arm64 | aarch64) ARCH="arm64" ;;
   *)
-    echo "Unsupported architecture: $ARCH" >&2
+    # chezmoi ships amd64 + arm64 builds only. Other architectures
+    # (ppc64le, s390x, riscv64, armv7) would need a source build.
+    echo "Unsupported architecture: $ARCH (only x86_64/amd64 and arm64/aarch64 are supported)" >&2
+    echo "See https://github.com/twpayne/chezmoi/releases for the full asset list." >&2
     exit 1
     ;;
 esac

package/scripts/ci/lint-reusable-pins.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck disable=SC2155
+#
+# lint-reusable-pins.sh — fail if any workflow references a reusable
+# workflow via a mutable ref (relative path, branch name, tag).
+#
+# Closes the lint-rule half of #855. Acceptable form for a reusable
+# workflow reference:
+#
+#     uses: sebastienrousseau/dotfiles/.github/workflows/reusable-X.yml@<40-hex-sha>
+#
+# Rejected forms:
+#
+#     uses: ./.github/workflows/reusable-X.yml                  # relative path → mutable
+#     uses: org/repo/.github/workflows/reusable-X.yml@master    # branch ref → mutable
+#     uses: org/repo/.github/workflows/reusable-X.yml@v1        # tag ref → mutable
+#
+# The full-SHA constraint is what prevents a TOCTOU swap where a
+# malicious push to the reusable's branch redirects the calling
+# workflow at run time.
+
+set -euo pipefail
+
+REPO_ROOT="${REPO_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+cd "$REPO_ROOT"
+
+WORKFLOWS_DIR=".github/workflows"
+fail_count=0
+checked_count=0
+
+if [[ ! -d "$WORKFLOWS_DIR" ]]; then
+  echo "::error::workflows directory not found at $WORKFLOWS_DIR"
+  exit 1
+fi
+
+# Walk every .yml under .github/workflows/ and inspect each `uses:`
+# line whose target ends with `reusable-*.yml`.
+while IFS= read -r workflow; do
+  while IFS=: read -r line_no _; do
+    line=$(sed -n "${line_no}p" "$workflow")
+    # Extract the ref expression after `uses:`.
+    # Acceptable: <owner>/<repo>/.github/workflows/reusable-X.yml@<40-hex>
+    if echo "$line" | grep -qE '^\s*uses:\s*\./'; then
+      echo "::error file=$workflow,line=$line_no::reusable workflow referenced by relative path (mutable). Pin to <owner>/<repo>/.github/workflows/<file>@<40-hex-sha>."
+      echo "    $line"
+      fail_count=$((fail_count + 1))
+      continue
+    fi
+    if echo "$line" | grep -qE 'reusable-[a-z0-9-]+\.yml@[0-9a-f]{40}\b'; then
+      checked_count=$((checked_count + 1))
+      continue
+    fi
+    if echo "$line" | grep -qE 'reusable-[a-z0-9-]+\.yml@'; then
+      ref=$(echo "$line" | sed -E 's|.*reusable-[a-z0-9-]+\.yml@([^ #]+).*|\1|')
+      echo "::error file=$workflow,line=$line_no::reusable workflow pinned to mutable ref '$ref'. Pin to a 40-hex commit SHA instead."
+      echo "    $line"
+      fail_count=$((fail_count + 1))
+      continue
+    fi
+  done < <(grep -nE 'reusable-[a-z0-9-]+\.yml' "$workflow" || true)
+done < <(find "$WORKFLOWS_DIR" -maxdepth 1 -type f -name '*.yml')
+
+echo "reusable-pin lint: checked $checked_count call site(s), $fail_count failure(s)"
+
+if [[ "$fail_count" -gt 0 ]]; then
+  echo ""
+  echo "Refresh pinned SHAs with:"
+  echo "  git fetch origin master"
+  echo "  PIN=\$(git rev-parse origin/master)"
+  echo "  # Apply per call site, then verify:"
+  echo "  bash scripts/ci/lint-reusable-pins.sh"
+  echo ""
+  echo "Policy: docs/security/CI_PINNING.md"
+  exit 1
+fi
+
+exit 0

package/scripts/ci/run-coverage.sh

@@ -136,6 +136,89 @@ include_dirs = [Path(p).resolve() for p in include_dirs_spec.split(":") if p]
 trace_dir = Path(trace_dir)
 repo_root = Path(repo_root).resolve()
 
+# -----------------------------------------------------------------------------
+# Skip-list — paths (relative to repo_root) that the xtrace mechanism
+# cannot measure meaningfully in our sandbox. Listed once at the
+# aggregator level so individual scripts don't need to be peppered with
+# LCOV_EXCL_START/STOP markers. Categories:
+#   1. Interactive / animation scripts (matrix, pipes, banner, cmatrix,
+#      stopwatch, rainbow, ql) — require a TTY + user input; the
+#      function body never returns to xtrace within a test budget.
+#   2. Self-reference — run-coverage.sh is the runner itself; the
+#      runner traces other scripts but not itself.
+#   3. CI-only entry points that mutate real environments (pre-push,
+#      release, install, bump, lint, check-deps-dev, validate-ci-config,
+#      reliability-audit, coverage-baseline, lint-reusable-pins).
+#   4. Top-level system-mutation scripts that need real OS state
+#      (rebuild-themes scans wallpapers; apply-gnome-theme drives
+#      gsettings; wallpaper-sync pulls from a remote; build-manual
+#      shells out to pandoc; chaos.sh and record.sh produce side
+#      effects we can't fake under bash xtrace).
+# Files here are entirely removed from the lcov denominator (no SF:
+# entry emitted). The covered code in the *rest* of the repo is the
+# meaningful denominator.
+# -----------------------------------------------------------------------------
+SKIP_PATHS = {
+    # Interactive / animation — require a TTY + user input.
+    ".chezmoitemplates/functions/interactive/matrix.sh",
+    ".chezmoitemplates/functions/interactive/cmatrix.sh",
+    ".chezmoitemplates/functions/interactive/stopwatch.sh",
+    ".chezmoitemplates/functions/interactive/banner.sh",
+    ".chezmoitemplates/functions/interactive/rainbow.sh",
+    ".chezmoitemplates/functions/interactive/pipes.sh",
+    ".chezmoitemplates/functions/misc/pipes.sh",
+    ".chezmoitemplates/functions/misc/view-source.sh",
+    ".chezmoitemplates/functions/misc/caffeine.sh",   # daemon controller, real /tmp/lock
+    ".chezmoitemplates/functions/nav/ql.sh",
+    "scripts/tools/pipes.sh",
+    "scripts/tools/cmatrix.sh",
+    "scripts/demo/record.sh",
+    "dot_local/bin/executable_tmux-sessionizer",
+    "dot_local/bin/executable_myip",
+    "dot_local/bin/executable_tour",                  # requires TTY + gum
+    # Self-reference + CI gates
+    "scripts/ci/run-coverage.sh",
+    "scripts/ci/check-deps-dev.sh",
+    "scripts/ci/lint-reusable-pins.sh",
+    "scripts/ci/validate-chezmoidata.sh",
+    "scripts/ci/validate-ci-config.sh",
+    "scripts/ci/check-dangerous-chmod.sh",
+    "scripts/git-hooks/pre-push",
+    "scripts/qa/reliability-audit.sh",
+    "scripts/qa/coverage-baseline.sh",
+    "scripts/dot/commands/lint.sh",
+    # System mutation — drives real OS state we can't fake under xtrace.
+    "scripts/theme/rebuild-themes.sh",
+    "scripts/theme/apply-gnome-theme.sh",
+    "scripts/theme/wallpaper-sync.sh",
+    "scripts/theme/install-catppuccin-themes.sh",
+    "scripts/ops/chaos.sh",
+    "scripts/ops/release.sh",
+    "scripts/ops/heal-tools.sh",
+    "scripts/ops/chezmoi-apply.sh",
+    "scripts/docs/build-manual.sh",
+    "scripts/security/manage-secrets.sh",
+    "scripts/security/enforce-policies.sh",
+    "scripts/security/ssh-cert.sh",
+    "scripts/security/firewall.sh",
+    "scripts/lib/secrets_provider.sh",                # keychain/gpg/age bindings
+    "scripts/ops/setup.sh",                           # post-install bootstrap
+    "scripts/theme/wallpaper-rotate.sh",              # cron-driven wallpaper change
+    "scripts/git-hooks/pre-commit-audit.sh",          # full hook flow needs real index
+    "dot_local/bin/executable_dot-theme-sync",        # signals live apps
+    "dot_local/bin/executable_dot-bootstrap",
+    "dot_local/bin/executable_update",
+    "dot_local/bin/executable_ai_core",
+    "dot_local/bin/executable_ai-update",
+}
+
+def is_skipped(abs_path: Path) -> bool:
+    try:
+        rel = abs_path.resolve().relative_to(repo_root).as_posix()
+    except ValueError:
+        return False
+    return rel in SKIP_PATHS
+
 # Pattern: +@COV@:<lineno>:<source>:@
 hit_re = re.compile(r"^\+@COV@:(\d+):([^:]+):@")
 
@@ -181,6 +264,8 @@ for trace_path in sorted(trace_dir.glob("*.trace")):
                     pass
                 if not in_includes(src_path):
                     continue
+                if is_skipped(src_path):
+                    continue
                 files[str(src_path)][lineno] += 1
     except OSError as e:
         print(f"warn: read error {trace_path}: {e}", file=sys.stderr)
@@ -289,6 +374,8 @@ for inc in include_dirs:
     if not inc.exists():
         continue
     for path in inc.rglob("*.sh"):
+        if is_skipped(path):
+            continue
         ap = str(path.resolve())
         existing = files[ap]  # creates the entry on touch
         for ln in executable_lines(path):
@@ -297,6 +384,8 @@ for inc in include_dirs:
     for path in inc.rglob("*"):
         # also include shebanged shell scripts without .sh
         if path.is_file() and not path.suffix and path.stat().st_size > 0:
+            if is_skipped(path):
+                continue
             try:
                 with open(path, "r", errors="replace") as f:
                     first = f.readline()

package/scripts/ci/windows-smoke-test.ps1

@@ -0,0 +1,136 @@
+<#
+.SYNOPSIS
+  Windows smoke test for the dotfiles framework.
+
+.DESCRIPTION
+  Ships under PowerShell 7.5+; verifies that the `dot` dispatcher
+  starts, that key read-only commands work, and that chezmoi can be
+  invoked from PowerShell. Designed to run inside `windows-latest`
+  GitHub Actions runners (B1 of ROADMAP_2026).
+
+  Closes the audit gap "PowerShell 7.5+ claim unverified."
+
+.NOTES
+  Exit codes:
+    0   all checks passed
+    1   one or more checks failed
+    2   environment misconfigured (chezmoi/dot missing)
+#>
+
+[CmdletBinding()]
+param(
+  [string] $RepoRoot = (Get-Location).Path,
+  [switch] $Strict
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$script:Failures = @()
+
+function Assert-Step {
+  param(
+    [Parameter(Mandatory)] [string] $Name,
+    [Parameter(Mandatory)] [scriptblock] $Test
+  )
+  Write-Host "→ $Name " -NoNewline
+  try {
+    & $Test | Out-Null
+    Write-Host 'ok' -ForegroundColor Green
+  }
+  catch {
+    Write-Host 'FAIL' -ForegroundColor Red
+    Write-Host "  $($_.Exception.Message)" -ForegroundColor DarkRed
+    $script:Failures += $Name
+  }
+}
+
+# ─── PowerShell version contract ─────────────────────────────────────────────
+# 7.4 is current LTS (EOL 2026-11-10); 7.5 is current stable. README claims
+# "PowerShell 7.5+" forward-looking; the 7.4 LTS window keeps this gate
+# at 7.4+ until the bundled runner version rolls forward.
+Assert-Step 'PowerShell >= 7.4 (LTS or current)' {
+  if ($PSVersionTable.PSVersion.Major -lt 7 -or
+      ($PSVersionTable.PSVersion.Major -eq 7 -and $PSVersionTable.PSVersion.Minor -lt 4)) {
+    throw "PowerShell $($PSVersionTable.PSVersion) — need 7.4+ (LTS) or 7.5+ (current)"
+  }
+}
+
+# ─── Repo layout sanity ──────────────────────────────────────────────────────
+Assert-Step 'dot dispatcher present' {
+  $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
+  if (-not (Test-Path $dot)) { throw "missing $dot" }
+}
+
+Assert-Step '.chezmoidata.toml present' {
+  $data = Join-Path $RepoRoot '.chezmoidata.toml'
+  if (-not (Test-Path $data)) { throw "missing $data" }
+}
+
+# ─── chezmoi callable from pwsh ──────────────────────────────────────────────
+Assert-Step 'chezmoi on PATH' {
+  $cmd = Get-Command chezmoi -ErrorAction SilentlyContinue
+  if (-not $cmd) { throw 'chezmoi not on PATH (install via scoop install chezmoi or winget)' }
+}
+
+Assert-Step 'chezmoi --version succeeds' {
+  $out = & chezmoi --version 2>&1
+  if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
+}
+
+# ─── dot CLI cold-start (only when bash is on PATH) ──────────────────────────
+$bash = Get-Command bash -ErrorAction SilentlyContinue
+if ($bash) {
+  Assert-Step 'dot version' {
+    $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
+    $out = & bash $dot 'version' 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
+  }
+  Assert-Step 'dot help' {
+    $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
+    $out = & bash $dot 'help' 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
+  }
+  Assert-Step 'dot agents check (AGENTS.md ↔ CLAUDE.md sync)' {
+    # `Push-Location` so the bash subprocess's $PWD points at the
+    # repo root — the bash dispatcher uses `git rev-parse` against
+    # $PWD when no usable chezmoi source-path is on disk.
+    Push-Location $RepoRoot
+    try {
+      $dot = Join-Path $RepoRoot 'dot_local/bin/executable_dot'
+      $out = & bash $dot 'agents' 'check' 2>&1
+      if ($LASTEXITCODE -ne 0) { throw "rc=$LASTEXITCODE :: $out" }
+    }
+    finally {
+      Pop-Location
+    }
+  }
+}
+else {
+  Write-Host '→ skipping bash-dependent checks (no bash on PATH)' -ForegroundColor DarkYellow
+}
+
+# ─── PSScriptAnalyzer over the smoke-test itself ────────────────────────────
+Assert-Step 'PSScriptAnalyzer over scripts/ci/*.ps1' {
+  if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
+    Install-Module PSScriptAnalyzer -Force -Scope CurrentUser -ErrorAction Stop
+  }
+  # `@(...)` so a single-result return value is still an array, otherwise
+  # `.Count` on a $null / scalar trips the strict-mode property check.
+  $issues = @(Invoke-ScriptAnalyzer -Path (Join-Path $RepoRoot 'scripts/ci') -Severity Error -ErrorAction Stop)
+  if ($issues.Count -gt 0) {
+    $msg = ($issues | ForEach-Object { "$($_.RuleName) at $($_.ScriptPath):$($_.Line)" }) -join '; '
+    throw "PSScriptAnalyzer found $($issues.Count) error(s): $msg"
+  }
+}
+
+# ─── Summary ─────────────────────────────────────────────────────────────────
+if ($script:Failures.Count -gt 0) {
+  Write-Host ''
+  Write-Host "FAILED: $($script:Failures -join ', ')" -ForegroundColor Red
+  exit 1
+}
+
+Write-Host ''
+Write-Host 'All Windows smoke checks passed.' -ForegroundColor Green
+exit 0

package/scripts/diagnostics/doctor.sh

@@ -548,9 +548,30 @@ fi
 # 2. Slow-init tools that are present but NOT wrapped in _cached_eval.
 # Each of these runs uncached on every shell start; common offenders eat
 # 100-500ms apiece on a populated dev machine.
+#
+# Only flag tools that actually emit shell init via `<tool> init <shell>`
+# (or equivalent) and would benefit from caching that output. Plain CLIs
+# like gh/cargo/pnpm/yarn don't have init eval; their completions are
+# cached separately under $ZSH_COMPLETIONS_DIR.
 unwrapped=""
-for tool in nvm fnm pyenv rbenv jenv asdf sdkman conda kubectl helm gh cargo pnpm yarn thefuck broot mcfly; do
+for tool in nvm fnm pyenv rbenv jenv asdf sdkman conda kubectl helm thefuck broot mcfly direnv; do
   command -v "$tool" >/dev/null 2>&1 || continue
+  # If the tool is installed but no shell config sources or evals its
+  # init (no `$tool env`, `$tool init`, `$tool.sh`, lazy-load stub), it
+  # isn't adding startup cost — skip the warning.
+  init_referenced=0
+  if grep -rIlqE "\\b${tool}([[:space:]]+(env|init|hook)|\\.sh|_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool})" \
+    "$HOME/.config/zsh" "$HOME/.config/fish" "$HOME/.config/shell" 2>/dev/null; then
+    init_referenced=1
+  fi
+  ((init_referenced == 0)) && continue
+  # Tools we lazy-load via shell stubs don't need init-eval cache files.
+  case "$tool" in
+    fnm | nvm | sdkman)
+      grep -rIlqE "_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool}" \
+        "$HOME/.config/zsh" "$HOME/.config/fish" 2>/dev/null && continue
+      ;;
+  esac
   found=0
   for shell_dir in zsh bash fish; do
     case "$shell_dir" in
@@ -585,27 +606,36 @@ if command -v zsh >/dev/null 2>&1; then
   fi
 fi
 
-# 4. PATH length. Each entry is searched on every command resolution;
-# >40 entries is noticeably slow on cold-cache filesystems.
+# 4. PATH length. Each entry is searched on every command resolution.
+# A mise-managed dev machine routinely adds 50+ entries (one per tool
+# install path), so the warn/fail thresholds are set higher than a
+# lean baseline (40) would suggest.
 path_count=$(printf '%s' "${PATH:-}" | tr ':' '\n' | grep -c . || true)
-if [[ "$path_count" -le 40 ]]; then
+if [[ "$path_count" -le 60 ]]; then
   _ok "PATH length" "$path_count entries"
-elif [[ "$path_count" -le 80 ]]; then
+elif [[ "$path_count" -le 120 ]]; then
   _warn "PATH length" "$path_count entries — consider pruning"
 else
   _fail "PATH length" "$path_count entries — likely slowing every command"
 fi
 
 # 5. Shell coverage. Surface installed shells that the project's caching
-# infrastructure (zsh/bash/fish) doesn't currently maintain caches for.
+# infrastructure doesn't currently maintain caches for. zsh/bash/fish/nu
+# all have a `_cached_eval` analogue; pwsh does not.
 shells_unmanaged=""
 for sh in nu pwsh; do
-  command -v "$sh" >/dev/null 2>&1 && shells_unmanaged="${shells_unmanaged:+$shells_unmanaged, }$sh"
+  command -v "$sh" >/dev/null 2>&1 || continue
+  case "$sh" in
+    nu)
+      [[ -f "$HOME/.config/nushell/cached_eval.nu" ]] && continue
+      ;;
+  esac
+  shells_unmanaged="${shells_unmanaged:+$shells_unmanaged, }$sh"
 done
 if [[ -z "$shells_unmanaged" ]]; then
-  _ok "shell coverage" "all installed shells (zsh/bash/fish) are managed"
+  _ok "shell coverage" "all installed shells have _cached_eval support"
 else
-  _warn "shell coverage" "$shells_unmanaged installed — startup not measured by dot perf"
+  _warn "shell coverage" "$shells_unmanaged installed — no _cached_eval helper"
 fi
 
 # 6. Zsh hook count. Heavy precmd/preexec functions compound per-prompt.

package/scripts/dot/commands/agent.sh

@@ -218,14 +218,15 @@ EOF
       checkpoint_id="$(basename "$checkpoint_file" .json)"
       ui_info "Agent mode" "$name"
       dot_agent_session_log "run_start" "$name" "running" "argv=$*" "checkpoint_id=$checkpoint_id"
-      set +e
-      "$@"
-      local exit_code=$?
-      set -e
-      if [[ "$exit_code" -eq 0 ]]; then
-        dot_agent_session_log "run_finish" "$name" "ok" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
-      else
+      # `if !` instead of `set +e / "$@" / set -e` — bash's errexit
+      # is automatically suspended inside a conditional, so we capture
+      # the exit code cleanly without toggling shell options.
+      local exit_code=0
+      if ! "$@"; then
+        exit_code=$?
         dot_agent_session_log "run_finish" "$name" "failed" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
+      else
+        dot_agent_session_log "run_finish" "$name" "ok" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
       fi
       return "$exit_code"
       ;;
@@ -335,14 +336,12 @@ EOF
           [[ "${#replay_argv[@]}" -gt 0 ]] || die "Checkpoint has no replayable command: $checkpoint_id"
           _agent_apply_profile_env "$replay_profile"
           dot_agent_session_log "checkpoint_replay" "$replay_profile" "running" "checkpoint_id=$checkpoint_id"
-          set +e
-          "${replay_argv[@]}"
-          local exit_code=$?
-          set -e
-          if [[ "$exit_code" -eq 0 ]]; then
-            dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "ok" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
-          else
+          local exit_code=0
+          if ! "${replay_argv[@]}"; then
+            exit_code=$?
             dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "failed" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
+          else
+            dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "ok" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
           fi
           return "$exit_code"
           ;;
@@ -382,16 +381,14 @@ EOF
       export DOT_AGENT_PARENT_PROFILE="$current_profile"
       dot_agent_session_log "delegate_start" "$delegate_profile" "running" "delegate=$delegate_name" "parent=$current_profile" "timeout=$delegate_timeout"
       ui_info "Delegating" "$delegate_name (profile: $delegate_profile, timeout: ${delegate_timeout}s)"
-      set +e
-      timeout "$delegate_timeout" "$@"
-      local exit_code=$?
-      set -e
-      if [[ "$exit_code" -eq 0 ]]; then
-        dot_agent_session_log "delegate_finish" "$delegate_profile" "ok" "delegate=$delegate_name" "exit_code=$exit_code"
-        ui_ok "Delegate" "$delegate_name completed"
-      else
+      local exit_code=0
+      if ! timeout "$delegate_timeout" "$@"; then
+        exit_code=$?
         dot_agent_session_log "delegate_finish" "$delegate_profile" "failed" "delegate=$delegate_name" "exit_code=$exit_code"
         ui_err "Delegate" "$delegate_name failed (exit $exit_code)"
+      else
+        dot_agent_session_log "delegate_finish" "$delegate_profile" "ok" "delegate=$delegate_name" "exit_code=$exit_code"
+        ui_ok "Delegate" "$delegate_name completed"
       fi
       return "$exit_code"
       ;;