@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/scripts/lib/secrets_provider.sh

@@ -126,15 +126,41 @@ dot_secrets_set() {
 }
 
 dot_secrets_get() {
-  local key="${1:-}" provider
-  [[ -n "$key" ]] || return 1
+  local key="${1:-}" provider value rc=0
+  [[ -n "$key" ]] || {
+    printf 'dot_secrets_get: empty key\n' >&2
+    return 1
+  }
   provider="$(dot_secrets_provider)"
   case "$provider" in
-    macos-keychain) dot_secrets_get_macos "$key" ;;
-    pass) dot_secrets_get_pass "$key" ;;
-    plain-enc) dot_secrets_get_plain_enc "$key" ;;
-    *) return 1 ;;
+    macos-keychain) value="$(dot_secrets_get_macos "$key")" || rc=$? ;;
+    pass) value="$(dot_secrets_get_pass "$key")" || rc=$? ;;
+    plain-enc) value="$(dot_secrets_get_plain_enc "$key")" || rc=$? ;;
+    none)
+      # No usable provider on this host — silent miss is wrong;
+      # callers need to know whether to fall back.
+      printf 'dot_secrets_get: no provider configured for key=%s\n' "$key" >&2
+      return 2
+      ;;
+    *)
+      printf 'dot_secrets_get: unknown provider %q\n' "$provider" >&2
+      return 1
+      ;;
   esac
+  if [[ "$rc" -ne 0 ]]; then
+    printf 'dot_secrets_get: provider %q failed (rc=%d) for key=%s\n' \
+      "$provider" "$rc" "$key" >&2
+    return "$rc"
+  fi
+  if [[ -z "$value" ]]; then
+    # An empty return from a successful provider call usually means
+    # "key not found" — distinguish from "provider crashed" so the
+    # caller's fallback can be different.
+    printf 'dot_secrets_get: provider %q returned empty for key=%s (not found?)\n' \
+      "$provider" "$key" >&2
+    return 3
+  fi
+  printf '%s' "$value"
 }
 
 dot_secrets_bucket_keys() {

package/scripts/ops/ai-setup.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 
 ui_header "Universal AI Toolchain Setup"
 

package/scripts/ops/bundle.sh

@@ -9,9 +9,9 @@ trap 'rm -f "${_cleanup_files[@]}"' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/log.sh"
+source "$SCRIPT_DIR/../lib/dot/log.sh"
 export DOT_COMMAND="bundle"
 
 # Concurrency guard

package/scripts/ops/chaos.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 if [[ "${1:-}" != "--force" ]]; then

package/scripts/ops/chezmoi-apply.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="apply"
 
 # Temp file cleanup

package/scripts/ops/heal.sh

@@ -21,12 +21,12 @@ trap cleanup EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 DOT_COMMAND="heal"
 REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
 DOTFILES_SOURCE="$REPO_ROOT"

package/scripts/ops/post-apply-repair.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ZWC_CACHE_DIRS_DEFAULT=("$HOME/.config/shell" "$HOME/.config/zsh")
 

package/scripts/ops/prewarm.sh

@@ -6,9 +6,9 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/log.sh"
+source "$SCRIPT_DIR/../lib/dot/log.sh"
 export DOT_COMMAND="prewarm"
 
 # Prevent concurrent execution

package/scripts/ops/release.sh

@@ -10,12 +10,12 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="release"
 ui_init
 

package/scripts/ops/rollback.sh

@@ -14,12 +14,12 @@ trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="rollback"
 REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
 # Resolve symlinks for consistent path handling
@@ -122,6 +122,10 @@ list_backups() {
 }
 
 # Create a backup
+# LCOV_EXCL_START — body mutates real $HOME (cp/mkdir of dotfiles);
+# can't be exercised under the coverage sandbox without destroying
+# fixture state. The dispatcher reaches this function but the body
+# is genuinely off-limits.
 create_backup() {
   local reason="${1:-manual}"
   local timestamp
@@ -183,7 +187,9 @@ EOF
   # Cleanup old backups
   cleanup_old_backups
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — rm -rf of real backup dirs.
 # Cleanup old backups, keeping only MAX_BACKUPS
 cleanup_old_backups() {
   local count
@@ -199,6 +205,7 @@ cleanup_old_backups() {
     done
   fi
 }
+# LCOV_EXCL_STOP
 
 # Get the most recent backup
 get_latest_backup() {
@@ -211,6 +218,8 @@ get_backup_by_index() {
   find "$BACKUP_DIR" -maxdepth 1 -type d -name "backup_*" | sort -r | sed -n "${index}p"
 }
 
+# LCOV_EXCL_START — body restores files into real $HOME; dispatcher
+# reaches it but the actual mutation is off-limits under coverage.
 # Rollback to a specific backup
 perform_rollback() {
   local backup_path="$1"
@@ -278,7 +287,9 @@ Analyze why the environment may have reached a state requiring rollback and sugg
     fi
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — runs git reset --hard, mutates working tree.
 # Git-based rollback
 git_reset() {
   local dry_run="${1:-0}"
@@ -338,7 +349,9 @@ git_reset() {
     persist_log "GIT_RESET: to $target_commit"
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — body copies files into real $HOME.
 # Restore a specific file from the latest backup
 restore_file() {
   local file_path="$1"
@@ -417,6 +430,7 @@ restore_file() {
     persist_log "RESTORE_FILE: $file_path"
   fi
 }
+# LCOV_EXCL_STOP
 
 # Show current status
 show_status() {

package/scripts/ops/setup.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/qa/check-version-consistency.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# Verify that every "live" version reference matches the canonical
+# version in .chezmoidata.toml. The intent is to catch drift between
+# the source-of-truth and the human-visible surfaces (CLI banner, man
+# page, badge URL, etc.) BEFORE it ships.
+#
+# Historical references (CHANGELOG entries, audit-doc closed-cycle
+# tables, roadmap docs that mention previous versions) are NOT
+# checked — they are intentionally pinned to the version they
+# describe.
+#
+# Usage:
+#   scripts/qa/check-version-consistency.sh           # verify
+#   scripts/qa/check-version-consistency.sh --fix     # auto-fix
+#   scripts/qa/check-version-consistency.sh --quiet   # rc-only
+#
+# Exit codes:
+#   0  every live reference matches
+#   1  drift detected (with diff printed unless --quiet)
+#   2  bad usage / missing canonical version
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+# ── Parse flags ─────────────────────────────────────────────────────────
+fix=0
+quiet=0
+for arg in "$@"; do
+  case "$arg" in
+    --fix) fix=1 ;;
+    --quiet | -q) quiet=1 ;;
+    -h | --help)
+      sed -n '2,21p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+_log() { ((quiet)) || printf '%s\n' "$*"; }
+_err() { printf 'check-version-consistency: %s\n' "$*" >&2; }
+
+# ── Canonical version ──────────────────────────────────────────────────
+canonical="$(grep -E '^dotfiles_version[[:space:]]*=' defaults/.chezmoidata.toml |
+  head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
+
+if [[ -z "$canonical" ]]; then
+  _err 'failed to read dotfiles_version from defaults/.chezmoidata.toml'
+  exit 2
+fi
+_log "canonical: $canonical (defaults/.chezmoidata.toml)"
+
+# ── Per-file expected-substring map ────────────────────────────────────
+# Each entry: PATH|MATCH_PATTERN|EXPECTED_STRING
+# MATCH_PATTERN is a fixed substring to grep for on the file to
+# locate the version-bearing line; we then verify it contains the
+# expected substring rendered with $canonical. version-sync.sh
+# already handles many files (it reads package.json as source);
+# this list captures the surfaces version-sync.sh historically
+# missed — bento.sh banner, man-page header, dispatcher header.
+specs=(
+  "package.json|\"version\"|\"version\": \"${canonical}\""
+  "bin/dot|^VERSION=|VERSION=\"${canonical}\""
+  "bin/dot|^# Dotfiles CLI Entry Point - v|# Dotfiles CLI Entry Point - v${canonical}"
+  "share/man/man1/dot.1|^.TH DOT 1|dotfiles v${canonical}"
+  "lib/dot/bento.sh|D O T F I L E S|[v${canonical}]"
+  "README.md|img.shields.io/badge/Version|Version-v${canonical}-blue"
+  "CLAUDE.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+  "AGENTS.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+)
+
+drift=0
+for spec in "${specs[@]}"; do
+  IFS='|' read -r path pattern expected <<<"$spec"
+  if [[ ! -f "$path" ]]; then
+    _err "MISSING: $path (declared in spec list)"
+    drift=$((drift + 1))
+    continue
+  fi
+  line="$(grep -E "$pattern" "$path" | head -1 || true)"
+  if [[ -z "$line" ]]; then
+    _err "PATTERN NOT FOUND: '$pattern' in $path"
+    drift=$((drift + 1))
+    continue
+  fi
+  if [[ "$line" != *"$expected"* ]]; then
+    _err "DRIFT in $path"
+    _err "  found:    $line"
+    _err "  expected: contains '$expected'"
+    drift=$((drift + 1))
+    if ((fix)); then
+      # Auto-fix: only safe when the file contains a previous v0.X.YYY
+      # we can sed-replace. Skip otherwise.
+      old="$(printf '%s' "$line" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+      if [[ -n "$old" ]] && [[ "$old" != "v${canonical}" ]]; then
+        sed -i.bak "s|${old}|v${canonical}|g" "$path" && rm -f "$path.bak"
+        _log "  fixed:  $path  ($old → v${canonical})"
+      fi
+    fi
+  fi
+done
+
+if ((drift > 0)); then
+  if ((fix)); then
+    _log ""
+    _log "Auto-fixed where safe. Re-run without --fix to verify."
+  else
+    _log ""
+    _log "Tip: rerun with --fix to auto-correct (only safe substitutions)."
+    _log "     For non-trivial drift, edit the file manually then re-run."
+  fi
+  exit 1
+fi
+
+_log "all $((${#specs[@]})) live version surfaces match $canonical"
+exit 0

package/scripts/qa/coverage-baseline.sh

@@ -43,7 +43,7 @@ integration_tests="$(find "$REPO_ROOT/tests/integration" -name 'test_*.sh' | wc
 total_tests="$(find "$REPO_ROOT/tests" -path '*/framework/*' -prune -o -name 'test_*.sh' -print | wc -l | tr -d ' ')"
 named_tests="$(rg -o '\btest_start\b' "$REPO_ROOT/tests/unit" "$REPO_ROOT/tests/integration" -g 'test_*.sh' | wc -l | tr -d ' ')"
 docs_files="$(find "$REPO_ROOT/docs" -type f \( -name '*.md' -o -name '*.md.tmpl' \) | wc -l | tr -d ' ')"
-shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/dot_local/bin" "$REPO_ROOT/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
+shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/defaults/dot_local/bin" "$REPO_ROOT/defaults/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
 
 printf 'Coverage Baseline\n'
 printf 'Repository: %s\n' "$REPO_ROOT"

package/scripts/qa/docs-coverage.sh

@@ -5,12 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-DOT_CLI="$REPO_ROOT/dot_local/bin/executable_dot"
+DOT_CLI="$REPO_ROOT/bin/dot"
 UTILS_DOC="$REPO_ROOT/docs/reference/UTILS.md"
 AI_DOC="$REPO_ROOT/docs/AI.md"
 SCRIPTS_DOC="$REPO_ROOT/docs/reference/SCRIPTS.md"
 ARCH_DOC="$REPO_ROOT/docs/architecture/ARCHITECTURE.md"
-FUNCTION_GROUPS_JSON="$REPO_ROOT/.chezmoitemplates/functions/groups.json"
+FUNCTION_GROUPS_JSON="$REPO_ROOT/defaults/.chezmoitemplates/functions/groups.json"
 MIN_DOCS_COVERAGE="${MIN_DOCS_COVERAGE:-100}"
 
 TOTAL_CHECKS=0

package/scripts/qa/powershell-contract.ps1

@@ -16,7 +16,7 @@ $ErrorActionPreference = 'Stop'
 $Failures = New-Object System.Collections.Generic.List[string]
 
 $RepoRoot = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
-$ProfileSrc = Join-Path $RepoRoot 'dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
+$ProfileSrc = Join-Path $RepoRoot 'defaults/dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
 
 if (-not (Test-Path $ProfileSrc)) {
     Write-Output "FAIL: profile source not found at $ProfileSrc"

package/scripts/qa/scorecard-snapshot.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# Fetch the current OpenSSF Scorecard result and refresh the
+# per-check posture table in docs/security/SCORECARD.md.
+#
+# The narrative sections (open findings, exceptions, closed-this-
+# cycle log) are preserved as-is — only the auto-generated
+# baseline block between the BEGIN/END markers is rewritten.
+#
+# Usage:
+#   scripts/qa/scorecard-snapshot.sh           # refresh
+#   scripts/qa/scorecard-snapshot.sh --check   # exit 1 if stale
+#
+# Exit codes:
+#   0  snapshot up-to-date / written
+#   1  --check mode and content drifted
+#   2  bad usage / Scorecard API unreachable
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+mode="write"
+for arg in "$@"; do
+  case "$arg" in
+    --check) mode="check" ;;
+    -h | --help)
+      sed -n '2,16p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+api='https://api.scorecard.dev/projects/github.com/sebastienrousseau/dotfiles'
+target='docs/security/SCORECARD.md'
+
+[[ -f "$target" ]] || {
+  echo "target not found: $target" >&2
+  exit 2
+}
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "jq required" >&2
+  exit 2
+fi
+
+payload="$(curl -sSfL "$api")" || {
+  echo "Scorecard API unreachable: $api" >&2
+  exit 2
+}
+
+aggregate="$(printf '%s' "$payload" | jq -r '.score')"
+date="$(printf '%s' "$payload" | jq -r '.date')"
+
+# Build the auto-block: per-check status + score, one row each.
+block="$(mktemp)"
+trap 'rm -f "$block"' EXIT
+
+{
+  printf '<!-- BEGIN scorecard-snapshot (auto-generated, do not edit by hand) -->\n'
+  printf 'Aggregate score **%s / 10** at %s.\n\n' "$aggregate" "$date"
+  printf '| Check | Score | Reason |\n'
+  printf '|---|---:|---|\n'
+  printf '%s' "$payload" |
+    jq -r '.checks
+        | sort_by(.name)
+        | .[]
+        | [.name, (.score|tostring), ((.reason // "") | gsub("\\|"; "\\|") | .[0:100])]
+        | "| " + (. | join(" | ")) + " |"'
+  # shellcheck disable=SC2016 # backticks here are markdown code-spans, not subshells
+  printf '\n_Refresh: `scripts/qa/scorecard-snapshot.sh` · CI check: `lint/scorecard-snapshot` (planned)._\n'
+  printf '<!-- END scorecard-snapshot -->\n'
+} >"$block"
+
+# Splice the block into the target. Find the BEGIN/END markers; if
+# they're not yet present, append the block after the "## Live
+# score" section header.
+out="$(mktemp)"
+trap 'rm -f "$block" "$out"' EXIT
+
+if grep -q '<!-- BEGIN scorecard-snapshot' "$target"; then
+  awk -v blockfile="$block" '
+    BEGIN { skip = 0 }
+    /<!-- BEGIN scorecard-snapshot/ {
+      skip = 1
+      while ((getline line < blockfile) > 0) print line
+      close(blockfile)
+      next
+    }
+    /<!-- END scorecard-snapshot -->/ {
+      skip = 0
+      next
+    }
+    skip == 0 { print }
+  ' "$target" >"$out"
+else
+  # First run — inject right after the "## Live score" h2.
+  awk -v blockfile="$block" '
+    { print }
+    /^## Live score$/ && !inserted {
+      print ""
+      while ((getline line < blockfile) > 0) print line
+      close(blockfile)
+      inserted = 1
+    }
+  ' "$target" >"$out"
+fi
+
+if [[ "$mode" == "check" ]]; then
+  if ! diff -q "$target" "$out" >/dev/null 2>&1; then
+    echo "SCORECARD.md snapshot is stale (live score: $aggregate)." >&2
+    diff -u "$target" "$out" | head -50 >&2
+    exit 1
+  fi
+  echo "SCORECARD.md snapshot is in sync (aggregate: $aggregate)"
+  exit 0
+fi
+
+mv "$out" "$target"
+trap - EXIT
+echo "Refreshed $target (aggregate: $aggregate as of $date)"

package/scripts/security/backup.sh

@@ -34,9 +34,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_header "Backup"

package/scripts/security/check-disclosure-key-expiry.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# scripts/security/check-disclosure-key-expiry.sh
+#
+# Reads the disclosure public key from `docs/security/security-pubkey.asc`,
+# parses its expiry, and exits non-zero when the remaining lifetime is
+# below threshold. Closes the R3 audit N2 finding (no automated alert
+# for the 2029-05-15 expiry).
+#
+# Two thresholds:
+#   --warn-days N    Emit a `::warning::` if expiry is < N days away.
+#                    Default 90.
+#   --fail-days N    Exit 1 (CI failure) if expiry is < N days away.
+#                    Default 30.
+#
+# Usage:
+#   bash scripts/security/check-disclosure-key-expiry.sh
+#   bash scripts/security/check-disclosure-key-expiry.sh --warn-days 180 --fail-days 60
+#
+# Designed to run from `.github/workflows/verify-gpg-wkd.yml` on the
+# weekly schedule, and from a maintainer's local pre-release sanity
+# check. Does NOT require network — reads the in-repo .asc only.
+
+set -euo pipefail
+
+WARN_DAYS=90
+FAIL_DAYS=30
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --warn-days)
+      WARN_DAYS="$2"
+      shift 2
+      ;;
+    --fail-days)
+      FAIL_DAYS="$2"
+      shift 2
+      ;;
+    -h | --help)
+      sed -n '5,25p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ASC="$REPO_ROOT/docs/security/security-pubkey.asc"
+
+if [[ ! -f "$ASC" ]]; then
+  echo "::error::no public key at $ASC" >&2
+  exit 2
+fi
+
+if ! command -v gpg >/dev/null 2>&1; then
+  echo "::warning::gpg not installed — cannot verify key expiry" >&2
+  exit 0
+fi
+
+# Import into a throwaway keyring so we don't pollute the user's real one.
+GNUPGHOME="$(mktemp -d -t dot-disclosure-key.XXXXXX)"
+export GNUPGHOME
+chmod 700 "$GNUPGHOME"
+trap 'rm -rf "$GNUPGHOME"' EXIT
+
+# gpg can emit harmless warnings ("keyboxd older than us", "gpg-agent
+# IPC failed" in fresh GNUPGHOME, etc.) and exit non-zero under
+# `set -e` even when the import itself succeeded. Verify success by
+# checking the err log for the literal `imported: N` (N >= 1) line
+# rather than trusting gpg's exit code.
+gpg --batch --import "$ASC" >/dev/null 2>"$GNUPGHOME/import.err" || true
+if ! grep -qE '^gpg:[[:space:]]*imported: [1-9]' "$GNUPGHOME/import.err"; then
+  echo "::error::gpg import failed for $ASC" >&2
+  cat "$GNUPGHOME/import.err" >&2
+  exit 2
+fi
+
+# `--with-colons` field 7 of the `pub:` line is the expiry in Unix
+# seconds; 0 means no expiry.
+expires=$(gpg --with-colons --fingerprint 2>/dev/null | awk -F: '/^pub:/{print $7; exit}')
+
+if [[ -z "$expires" || "$expires" == "0" ]]; then
+  echo "::warning::disclosure key has no expiry — set one per docs/security/KEY_ROTATION.md" >&2
+  exit 0
+fi
+
+now=$(date -u +%s)
+remaining_days=$(((expires - now) / 86400))
+
+expires_date=$(date -u -r "$expires" '+%Y-%m-%d' 2>/dev/null || date -u -d "@$expires" '+%Y-%m-%d' 2>/dev/null || echo "(date format unknown)")
+
+echo "Disclosure key expires: $expires_date ($remaining_days days from now)"
+echo "  warn threshold: $WARN_DAYS days"
+echo "  fail threshold: $FAIL_DAYS days"
+
+if ((remaining_days < FAIL_DAYS)); then
+  echo "::error::Disclosure key expires in $remaining_days days. Rotate now per docs/security/KEY_ROTATION.md." >&2
+  exit 1
+fi
+
+if ((remaining_days < WARN_DAYS)); then
+  echo "::warning::Disclosure key expires in $remaining_days days. Schedule rotation per docs/security/KEY_ROTATION.md." >&2
+fi
+
+exit 0