@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/scripts/dot/commands/patterns.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 PATTERN_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/ai/patterns"
 mkdir -p "$PATTERN_DIR"

package/scripts/dot/commands/registry.sh

@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck shell=bash
+#
+# scripts/dot/commands/registry.sh
+#
+# `dot registry` — initial scaffold for the dot module registry.
+#
+# §3 audit roadmap: ship a registry of reusable dotfile modules
+# ("rust-dev-setup", "k8s-operator-laptop") to seed network effects.
+# Hosted as a GitHub-Pages-indexed JSON file to keep ops cost near
+# zero.
+#
+# Current state: SCAFFOLD ONLY. This file ships the CLI surface and
+# the JSON contract (see _registry_default_url). The registry itself
+# is empty; populating it is its own roadmap item.
+#
+# Subcommands:
+#   list           Show modules in the configured registry
+#   search <q>     Filter modules by keyword (name, description, tags)
+#   info <name>    Print full metadata for a module
+#   install <name> Apply a module to the current workstation (stub —
+#                  prints what would be installed; full implementation
+#                  needs a sandboxed apply pipeline)
+#   url            Show the active registry URL
+#   set-url <u>    Override the registry URL (writes to user config)
+#
+# Registry JSON shape:
+#   {
+#     "version": 1,
+#     "updated": "2026-05-15T16:00:00Z",
+#     "modules": [
+#       { "name": "rust-dev-setup",
+#         "description": "Rust toolchain + cargo plugins + IDE config",
+#         "repo": "https://github.com/example/rust-dev-setup",
+#         "tags": ["rust", "dev", "language"],
+#         "maintainer": "alice@example.com",
+#         "version": "1.2.0",
+#         "sha256": "abc123..." }
+#     ]
+#   }
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+# shellcheck source=../../../lib/dot/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+_registry_default_url() {
+  printf '%s\n' "https://sebastienrousseau.github.io/dotfiles/registry.json"
+}
+
+_registry_config_file() {
+  printf '%s/dotfiles/registry.toml\n' "${XDG_CONFIG_HOME:-$HOME/.config}"
+}
+
+_registry_url() {
+  if [[ -n "${DOTFILES_REGISTRY_URL:-}" ]]; then
+    printf '%s\n' "$DOTFILES_REGISTRY_URL"
+    return
+  fi
+  local cfg
+  cfg="$(_registry_config_file)"
+  if [[ -f "$cfg" ]]; then
+    local u
+    u="$(awk -F'[ \t]*=[ \t]*' '/^url[ \t]*=/{gsub(/"/,"",$2); print $2; exit}' "$cfg")"
+    [[ -n "$u" ]] && {
+      printf '%s\n' "$u"
+      return
+    }
+  fi
+  _registry_default_url
+}
+
+_registry_cache_dir() {
+  printf '%s/dotfiles/registry\n' "${XDG_CACHE_HOME:-$HOME/.cache}"
+}
+
+_registry_fetch() {
+  local url cache_dir cache_file
+  url="$(_registry_url)"
+  cache_dir="$(_registry_cache_dir)"
+  cache_file="$cache_dir/index.json"
+  mkdir -p "$cache_dir"
+  # Refresh if older than 6h or missing.
+  local now mtime
+  now="$(date +%s)"
+  if [[ -s "$cache_file" ]]; then
+    if mtime="$(stat -f %m "$cache_file" 2>/dev/null || stat -c %Y "$cache_file" 2>/dev/null)"; then
+      if ((now - mtime < 21600)); then
+        printf '%s\n' "$cache_file"
+        return 0
+      fi
+    fi
+  fi
+  if ! command -v curl >/dev/null 2>&1; then
+    ui_err "registry" "curl not installed"
+    return 127
+  fi
+  local tmp
+  tmp="$(mktemp "${cache_file}.XXXXXX")"
+  if ! curl -fsSL --max-time 15 -o "$tmp" "$url"; then
+    rm -f "$tmp"
+    if [[ -s "$cache_file" ]]; then
+      ui_warn "registry" "fetch failed; using stale cache at $cache_file"
+      printf '%s\n' "$cache_file"
+      return 0
+    fi
+    ui_err "registry" "could not fetch $url"
+    return 1
+  fi
+  mv "$tmp" "$cache_file"
+  printf '%s\n' "$cache_file"
+}
+
+_registry_require_jq() {
+  command -v jq >/dev/null 2>&1 || {
+    ui_err "registry" "jq is required"
+    return 127
+  }
+}
+
+cmd_registry() {
+  local subcommand="${1:-list}"
+  shift || true
+
+  case "$subcommand" in
+    url)
+      printf '%s\n' "$(_registry_url)"
+      ;;
+    set-url)
+      local new_url="${1:-}"
+      [[ -n "$new_url" ]] || {
+        ui_err "set-url" "missing URL"
+        return 1
+      }
+      # Refuse non-HTTPS schemes. The registry index is unsigned today,
+      # so HTTPS is the only transport that gives us cert-pinned
+      # integrity. The `file://` exemption is for local testing only
+      # (the bench-script and unit tests use it).
+      if [[ ! "$new_url" =~ ^(https://|file://) ]]; then
+        ui_err "set-url" "registry URL must use https:// (or file:// for local testing) — got: $new_url"
+        return 1
+      fi
+      local cfg
+      cfg="$(_registry_config_file)"
+      mkdir -p "$(dirname "$cfg")"
+      # Atomic write so a concurrent invocation can't read a half-
+      # written file. Explicit if/else (avoid SC2015 A && B || C).
+      local _tmp
+      _tmp="$(mktemp "${cfg}.XXXXXX")"
+      if printf 'url = "%s"\n' "$new_url" >"$_tmp"; then
+        if ! mv "$_tmp" "$cfg"; then
+          rm -f "$_tmp"
+          ui_err "set-url" "failed to commit $cfg"
+          return 1
+        fi
+      else
+        rm -f "$_tmp"
+        ui_err "set-url" "failed to write $cfg"
+        return 1
+      fi
+      ui_ok "registry" "set to $new_url ($cfg)"
+      ;;
+    list)
+      _registry_require_jq || return $?
+      local index
+      index="$(_registry_fetch)" || return $?
+      ui_header "Registry modules"
+      ui_info "Source" "$(_registry_url)"
+      echo ""
+      if ! jq -e '.modules | length > 0' "$index" >/dev/null 2>&1; then
+        ui_warn "registry" "no modules published yet — see docs/operations/REGISTRY.md to contribute one"
+        return 0
+      fi
+      ui_table_begin "Module" "Version" "Description"
+      while IFS=$'\t' read -r name ver desc; do
+        ui_table_add "$name" "v$ver" "$desc"
+      done < <(jq -r '.modules[] | "\(.name)\t\(.version // "-")\t\(.description // "")"' "$index")
+      ui_table_end
+      ;;
+    search)
+      _registry_require_jq || return $?
+      local q="${1:-}"
+      [[ -n "$q" ]] || {
+        ui_err "search" "missing query"
+        return 1
+      }
+      local index
+      index="$(_registry_fetch)" || return $?
+      ui_header "Registry search: $q"
+      echo ""
+      ui_table_begin "Module" "Version" "Description"
+      while IFS=$'\t' read -r name ver desc; do
+        ui_table_add "$name" "v$ver" "$desc"
+      done < <(jq -r --arg q "$q" '
+        .modules[]
+        | select(
+            (.name // "" | ascii_downcase | contains($q | ascii_downcase)) or
+            (.description // "" | ascii_downcase | contains($q | ascii_downcase)) or
+            ((.tags // []) | map(ascii_downcase) | index($q | ascii_downcase))
+          )
+        | "\(.name)\t\(.version // "-")\t\(.description // "")"
+      ' "$index")
+      ui_table_end
+      ;;
+    info)
+      _registry_require_jq || return $?
+      local name="${1:-}"
+      [[ -n "$name" ]] || {
+        ui_err "info" "missing module name"
+        return 1
+      }
+      local index
+      index="$(_registry_fetch)" || return $?
+      local found
+      found="$(jq -r --arg n "$name" '.modules[] | select(.name == $n) | "OK"' "$index" 2>/dev/null)"
+      if [[ "$found" != "OK" ]]; then
+        ui_err "info" "module not found: $name"
+        return 1
+      fi
+      jq -r --arg n "$name" '.modules[] | select(.name == $n) | to_entries[] | "\(.key)\t\(.value | if type == "array" then join(", ") else tostring end)"' "$index" |
+        while IFS=$'\t' read -r key value; do
+          ui_ok "$key" "$value"
+        done
+      ;;
+    install)
+      local name="${1:-}"
+      [[ -n "$name" ]] || {
+        ui_err "install" "missing module name"
+        return 1
+      }
+      ui_warn "install" "scaffold only — full module installer is a roadmap item"
+      ui_info "install" "would fetch module $name from registry and apply it as a chezmoi sub-source"
+      return 0
+      ;;
+    --help | -h | help)
+      cat <<EOF
+Usage: dot registry <subcommand>
+
+Subcommands:
+  list             List modules in the configured registry
+  search <q>       Filter modules by keyword (name, description, tags)
+  info <name>      Print metadata for a single module
+  install <name>   Install a module (scaffold — see docs/operations/REGISTRY.md)
+  url              Show the active registry URL
+  set-url <url>    Override the registry URL (persists to user config)
+
+Env overrides:
+  DOTFILES_REGISTRY_URL   One-shot override of the registry URL.
+
+Default registry: $(_registry_default_url)
+EOF
+      ;;
+    *)
+      ui_err "Unknown subcommand" "$subcommand"
+      echo "Run 'dot registry --help' for usage." >&2
+      return 1
+      ;;
+  esac
+}

package/scripts/dot/commands/restore.sh

@@ -6,10 +6,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-# shellcheck source=../lib/log.sh
-source "$SCRIPT_DIR/../lib/log.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/log.sh
+source "$SCRIPT_DIR/../../../lib/dot/log.sh"
 
 DOTFILES_DIR="${DOTFILES_DIR:-$HOME/.dotfiles}"
 BACKUP_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles/backups"

package/scripts/dot/commands/secrets.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 # shellcheck source=../../lib/secrets_provider.sh
 source "$SCRIPT_DIR/../../lib/secrets_provider.sh"
 
@@ -15,7 +15,8 @@ dot_ui_command_banner "Secrets" "${1:-}"
 
 dot_data_file() {
   local src_dir
-  src_dir="$(require_source_dir)"
+  src_dir="$(resolve_chezmoi_source_dir)"
+  [[ -z "$src_dir" ]] && src_dir="$(require_source_dir)"
   printf "%s\n" "$src_dir/.chezmoidata.toml"
 }
 

package/scripts/dot/commands/security.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Security" "${1:-}"
 

package/scripts/dot/commands/tools.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 _TOOLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$_TOOLS_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$_TOOLS_DIR/../../../lib/dot/utils.sh"
 # shellcheck source=aliases.sh
 source "$_TOOLS_DIR/aliases.sh"
 
@@ -348,12 +348,70 @@ cmd_log_rotate() {
 }
 
 cmd_env_mise() {
+  # `dot env emit` is a separate sub-handler — it doesn't need mise
+  # at command-time, only when actually invoked (the script checks).
+  if [[ "${1:-}" == "emit" ]]; then
+    shift
+    # shellcheck source=./env-emit.sh
+    source "$(require_source_dir)/scripts/dot/commands/env-emit.sh"
+    dot_env_emit "$@"
+    return $?
+  fi
+
   if ! has_command mise; then
     ui_err "mise not installed (required for dot env)"
     exit 1
   fi
   case "${1:-list}" in
-    list | ls) mise ls ;;
+    list | ls)
+      if has_command jq; then
+        ui_table_begin "Tool" "Version" "Source" "Requested"
+        while IFS=$'\t' read -r tool ver source req; do
+          ui_table_add "$tool" "$ver" "${source/$HOME/\~}" "$req"
+        done < <(mise ls --json 2>/dev/null | jq -r '
+          to_entries[] as $t
+          | $t.value[]
+          | [
+              $t.key,
+              (.version // "-"),
+              (.source.path // ""),
+              (.requested_version // "")
+            ]
+          | @tsv
+        ')
+        ui_table_end
+      else
+        mise ls
+      fi
+      # Surface orphan installs (tool versions on disk that no active config
+      # claims). `--dry-run-code` exits 1 iff there is something to prune;
+      # the call is fast (no I/O beyond reading the tracked-configs index).
+      if mise prune --dry-run-code --quiet >/dev/null 2>&1; then
+        :
+      else
+        echo ""
+        ui_warn "orphan installs" "tool versions on disk are not requested by any config"
+        ui_info "to clean" "run 'dot env prune' (dry-run) or 'dot env prune --yes' to commit"
+      fi
+      ;;
+    prune)
+      shift
+      local commit=0
+      for arg in "$@"; do
+        case "$arg" in
+          --yes | -y) commit=1 ;;
+        esac
+      done
+      if ((commit)); then
+        mise prune
+      else
+        ui_info "dry-run" "showing what 'mise prune' would remove (pass --yes to commit)"
+        echo ""
+        mise prune --dry-run
+        echo ""
+        ui_info "next" "re-run with 'dot env prune --yes' to actually uninstall"
+      fi
+      ;;
     install)
       shift
       # Validate tool names to prevent injection
@@ -377,7 +435,7 @@ cmd_env_mise() {
 
 cmd_profile() {
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ ! -f "$data_file" ]]; then
     die ".chezmoidata.toml not found"
   fi

package/scripts/dot/powershell/Dot.psm1

@@ -0,0 +1,199 @@
+# Dot — native PowerShell module for the dotfiles framework.
+#
+# This module provides native PowerShell cmdlets for the subset of
+# `dot` subcommands that don't require bash. Closes Stub rows in
+# docs/reference/POWERSHELL_PARITY.md.
+#
+# Loaded by bin/dot.ps1 dispatcher; cmdlets are also callable
+# directly:
+#   Import-Module ./scripts/dot/powershell/Dot.psm1
+#   Get-DotVersion
+#   Invoke-DotHelp
+#   Test-DotAgentsSync -Verbose
+#
+# Tested via scripts/ci/windows-smoke-test.ps1.
+
+#requires -Version 7.0
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# Module-level constants -------------------------------------------------------
+
+$script:RepoRoot = if ($env:DOT_REPO_ROOT) {
+    $env:DOT_REPO_ROOT
+}
+else {
+    # When called from bin/dot.ps1 the dispatcher sets DOT_REPO_ROOT.
+    # When imported directly, infer it from this file's path:
+    #   scripts/dot/powershell/Dot.psm1  →  ../../..
+    (Resolve-Path (Join-Path $PSScriptRoot '..\..\..')).Path
+}
+
+# Post-Phase-4b (v0.2.503) .chezmoidata.toml ships under defaults/.
+# Probe defaults/ first; fall back to legacy root location for older
+# deployments that pre-date the .chezmoiroot activation.
+$script:DataFile = Join-Path $script:RepoRoot 'defaults/.chezmoidata.toml'
+if (-not (Test-Path $script:DataFile)) {
+    $script:DataFile = Join-Path $script:RepoRoot '.chezmoidata.toml'
+}
+
+# Helpers ---------------------------------------------------------------------
+
+function script:Get-DotfilesVersionFromData {
+    if (-not (Test-Path $script:DataFile)) {
+        throw "Cannot read $script:DataFile (set DOT_REPO_ROOT to override)"
+    }
+    $line = Get-Content $script:DataFile |
+        Where-Object { $_ -match '^dotfiles_version\s*=\s*"([^"]+)"' } |
+        Select-Object -First 1
+    if (-not $line) {
+        throw "dotfiles_version not found in $script:DataFile"
+    }
+    if ($line -notmatch '"([^"]+)"') {
+        throw "Could not parse dotfiles_version from line: $line"
+    }
+    return $Matches[1]
+}
+
+function script:Write-DotBanner {
+    param([string]$Section)
+    if ($env:NO_COLOR) {
+        Write-Host "Dot · $Section"
+        return
+    }
+    $esc = [char]27
+    Write-Host "$esc[1;38;5;212mDot · $Section$esc[0m"
+}
+
+# Public cmdlets --------------------------------------------------------------
+
+<#
+.SYNOPSIS
+    Print the dotfiles framework version.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot version`. Reads the
+    canonical version from .chezmoidata.toml (the single source of
+    truth) — does NOT shell out to bash.
+
+.EXAMPLE
+    Get-DotVersion
+    0.2.503
+
+.EXAMPLE
+    Get-DotVersion -AsObject | ConvertTo-Json
+    {
+      "Version": "0.2.503",
+      "Source": "...\\.chezmoidata.toml",
+      "Native": true
+    }
+#>
+function Get-DotVersion {
+    [CmdletBinding()]
+    param(
+        [switch]$AsObject
+    )
+    $version = Get-DotfilesVersionFromData
+    if ($AsObject) {
+        return [pscustomobject]@{
+            Version = $version
+            Source  = $script:DataFile
+            Native  = $true
+        }
+    }
+    return $version
+}
+
+<#
+.SYNOPSIS
+    Print the dot CLI help overview.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot help`. Reads command
+    metadata from CLAUDE.md / the dispatcher's help table; does
+    NOT shell out to bash.
+
+    The full Linux-style help (every subcommand grouped by category)
+    requires the bash dispatcher; this cmdlet shows the Windows-
+    native subset.
+#>
+function Invoke-DotHelp {
+    [CmdletBinding()]
+    param()
+    $version = Get-DotfilesVersionFromData
+    Write-DotBanner -Section 'Help'
+    Write-Host ''
+    Write-Host "  Version    v$version"
+    Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
+    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/master/docs/manual/"
+    Write-Host ''
+    Write-Host 'Native PowerShell commands (no bash required):'
+    Write-Host ''
+    Write-Host '  Get-DotVersion              Print framework version'
+    Write-Host '  Invoke-DotHelp              This screen'
+    Write-Host '  Test-DotAgentsSync          Check AGENTS.md ↔ CLAUDE.md sync'
+    Write-Host ''
+    Write-Host 'Bash-bridged subcommands (require bash on PATH):'
+    Write-Host ''
+    Write-Host '  dot doctor                  Deep environment audit'
+    Write-Host '  dot env list                List installed mise tools'
+    Write-Host '  dot env emit                Emit v1 environment manifest'
+    Write-Host '  dot agents render           Re-render every AGENTS.md harness'
+    Write-Host '  dot fleet status            Single-node fleet status (Full on PowerShell)'
+    Write-Host ''
+    Write-Host 'See: dot help all (via bash) — full command index'
+}
+
+<#
+.SYNOPSIS
+    Verify that AGENTS.md is in sync with CLAUDE.md.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot agents check`. Both
+    files share a "Project Overview" paragraph that is the canonical
+    sync surface. If they diverge, AGENTS.md needs re-rendering
+    (run `dot agents render` via bash; native PowerShell render is
+    a separate ticket).
+
+.OUTPUTS
+    [bool] — $true when in sync, $false otherwise.
+
+.EXAMPLE
+    if (-not (Test-DotAgentsSync)) {
+      Write-Warning 'AGENTS.md is stale; run: bash dot_local/bin/executable_dot agents render'
+    }
+#>
+function Test-DotAgentsSync {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param()
+    $claude = Join-Path $script:RepoRoot 'CLAUDE.md'
+    $agents = Join-Path $script:RepoRoot 'AGENTS.md'
+    foreach ($f in @($claude, $agents)) {
+        if (-not (Test-Path $f)) {
+            Write-Error "missing: $f"
+            return $false
+        }
+    }
+    # Both files declare: "Chezmoi-managed dotfiles for macOS, Linux,
+    # WSL, and PowerShell 7.5+. Version `0.2.503`."
+    # That single line is the canonical sync surface — its content
+    # is generated from the same template by `dot agents render`.
+    $claudeLine = (Select-String -Path $claude -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
+        Select-Object -First 1).Line
+    $agentsLine = (Select-String -Path $agents -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
+        Select-Object -First 1).Line
+    if (-not $claudeLine -or -not $agentsLine) {
+        Write-Verbose "sync surface line not found — claude:[$claudeLine] agents:[$agentsLine]"
+        return $false
+    }
+    if ($claudeLine -ne $agentsLine) {
+        Write-Verbose "drift detected:`n  CLAUDE.md: $claudeLine`n  AGENTS.md: $agentsLine"
+        return $false
+    }
+    Write-Verbose 'AGENTS.md sync surface matches CLAUDE.md'
+    return $true
+}
+
+Export-ModuleMember -Function Get-DotVersion, Invoke-DotHelp, Test-DotAgentsSync

package/scripts/fonts/install-nerd-fonts.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_header "Nerd Fonts"

package/scripts/git-hooks/pre-commit-audit.sh

@@ -33,7 +33,7 @@ echo -n "   🔍 Scanning for secrets... "
 # Exclude assignments to values containing common placeholder strings or within template expressions
 SENSITIVE_PATTERNS="(GITHUB_TOKEN|API_KEY|SECRET|password|private_key|AKIA[0-9A-Z]{16})[[:space:]]*[:=]"
 # Exclusions list for legitimate variable checks or documentation
-SECRET_EXCLUDES="test_|assertions.sh|.pre-commit|README|CHANGELOG|FEATURES.md|CONFIG_STRATEGY.md|docs/|install/lib/|.chezmoitemplates/|mcp-doctor.sh|\.github/workflows/"
+SECRET_EXCLUDES="test_|assertions.sh|.pre-commit|README|CHANGELOG|FEATURES.md|docs/|install/lib/|.chezmoitemplates/|mcp-doctor.sh|\.github/workflows/"
 # Also exclude .tmpl files from secret scanning as they contain many false positive markers
 if echo "$STAGED_FILES" | grep -v "\.tmpl" | xargs grep -EiE "$SENSITIVE_PATTERNS" /dev/null | grep -vE "$SECRET_EXCLUDES" | grep -viE "dummy|placeholder|example|test|sk-placeholder|\\{\\{" >/dev/null 2>&1; then
   printf '%b\\n' "${RED}FAILED${NC}"
@@ -140,6 +140,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.501 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.503 standards maintained."
   exit 0
 fi

package/scripts/git-hooks/pre-push

@@ -90,3 +90,16 @@ if [ "${DOTFILES_ALLOW_UNSKIPPED_PUSH:-}" = "1" ]; then
 fi
 
 bash "$repo_root/scripts/qa/reliability-audit.sh" --quick
+
+# Step 4 — version-string consistency. Catches the case where the
+# canonical version in .chezmoidata.toml advanced but a human-visible
+# surface (CLI banner, man page, README badge) wasn't bumped. The
+# script is cheap (~8 grep calls); failure tells the user exactly
+# which file drifted and offers --fix.
+bash "$repo_root/scripts/qa/check-version-consistency.sh" --quiet || {
+  echo "" >&2
+  echo "Pre-push blocked: version-string drift detected." >&2
+  echo "Run: scripts/qa/check-version-consistency.sh" >&2
+  echo "Then: scripts/qa/check-version-consistency.sh --fix    (optional auto-fix)" >&2
+  exit 1
+}