@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/scripts/security/dns-doh.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/encryption-check.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 ui_init
 ui_header "Encryption Check"

package/scripts/security/enforce-policies.sh

@@ -13,9 +13,9 @@ readonly REPO_ROOT
 readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
 readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
 
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+source "${SCRIPT_DIR}/../../lib/dot/ui.sh"
 ui_init
 
 # Logging function (also writes to log file)

package/scripts/security/firewall.sh

@@ -37,12 +37,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/lock-configs.sh

@@ -22,13 +22,22 @@ if [[ "$OSTYPE" == "darwin"* ]]; then
   UNLOCK_CMD="chflags nouchg"
   CHECK_CMD="ls -lO"
 else
-  # Linux (requires root usually, but we'll try)
+  # Linux (chattr +i requires root; fail loudly when sudo is missing
+  # rather than printing a confusing error per file in automation)
   if command -v chattr >/dev/null; then
+    if ! command -v sudo >/dev/null; then
+      echo " 'sudo' not found; chattr requires root. Aborting." >&2
+      exit 1
+    fi
+    if ! sudo -n true 2>/dev/null && [[ ! -t 0 ]]; then
+      echo " sudo requires a password but no TTY is attached. Aborting." >&2
+      exit 1
+    fi
     LOCK_CMD="sudo chattr +i"
     UNLOCK_CMD="sudo chattr -i"
     CHECK_CMD="lsattr"
   else
-    echo " 'chattr' not found. Cannot set immutability on Linux without it."
+    echo " 'chattr' not found. Cannot set immutability on Linux without it." >&2
     exit 1
   fi
 fi

package/scripts/security/lock-screen.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/manage-secrets.sh

@@ -39,9 +39,9 @@ readonly REPO_ROOT
 readonly ENV_TEMPLATE="${REPO_ROOT}/.github/security-policies/environment-template.env"
 readonly ENV_LOCAL="${REPO_ROOT}/.env.local"
 
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+source "${SCRIPT_DIR}/../../lib/dot/ui.sh"
 ui_init
 
 # Help text

package/scripts/security/ssh-cert.sh

@@ -27,9 +27,9 @@ CA_PROVISIONER="${SSH_CERT_CA_PROVISIONER:-}"
 # ---------- helpers -------------------------------------------------------- #
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 info() { ui_info "ssh-cert" "$*"; }

package/scripts/security/telemetry-kill.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/usb-safety.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/theme/extract-heic-frames.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# extract-heic-frames.sh — extract per-frame PNGs from dynamic HEIC wallpapers.
+#
+# Apple's dynamic HEIC format packs two images (frame 0 = light, frame 1 =
+# dark) in one container. DMS's matugen worker reads the wallpaper path from
+# ~/.local/state/DankMaterialShell/session.json and feeds it to matugen,
+# which calls ImageMagick's heif decoder. On many systems (Arch Linux's
+# libheif 1.23 + libde265 1.1 is one) that decoder fails to decompress
+# Apple's dynamic HEIC with:
+#
+#   Decoder plugin generated an error: Unspecified: Decoding the input
+#   data did not give a decompressed image.
+#
+# Symptom: every `dot theme <family>` for a HEIC-only family produces
+# a matugen "Theme worker FATAL" in the dms journal and the dynamic
+# color scheme stops regenerating.
+#
+# Workaround: pre-extract `{family}-0.png` (light) and `{family}-1.png`
+# (dark) PNG frames next to each HEIC. wallpaper-sync.sh's resolver
+# prefers `{family}-{0,1}.png` over `{family}.heic`, so DMS gets the
+# decodable PNG instead of the broken HEIC.
+#
+# We use libheif's `heif-dec -d ffmpeg` because libde265 fails where
+# the bundled ffmpeg decoder succeeds for the same input.
+#
+# Usage:
+#   bash scripts/theme/extract-heic-frames.sh                 # all HEICs in default dir
+#   bash scripts/theme/extract-heic-frames.sh --force         # re-extract even if PNGs exist
+#   bash scripts/theme/extract-heic-frames.sh --dry-run       # show what would extract
+#   DOTFILES_WALLPAPER_DIR=/path bash scripts/.../extract-heic-frames.sh
+
+set -euo pipefail
+
+WALLPAPER_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
+FORCE=0
+DRY_RUN=0
+
+for arg in "$@"; do
+  case "$arg" in
+    --force | -f) FORCE=1 ;;
+    --dry-run | -n) DRY_RUN=1 ;;
+    --help | -h)
+      sed -n '4,30p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $arg" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ ! -d "$WALLPAPER_DIR" ]]; then
+  echo "Wallpaper dir not found: $WALLPAPER_DIR" >&2
+  exit 1
+fi
+
+for cmd in magick heif-dec; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "Required: $cmd (install ImageMagick + libheif-tools)" >&2
+    exit 1
+  fi
+done
+
+cd "$WALLPAPER_DIR"
+
+extracted=0
+skipped=0
+single=0
+failed=()
+tmp_prefix="$(mktemp -d)/heic"
+
+trap 'rm -rf "$(dirname "$tmp_prefix")"' EXIT
+
+for f in *.heic; do
+  [[ -e "$f" ]] || continue
+  name="${f%.heic}"
+
+  if [[ $FORCE -eq 0 && -f "${name}-0.png" && -f "${name}-1.png" ]]; then
+    ((skipped++)) || true
+    continue
+  fi
+
+  frames=$(magick identify "$f" 2>/dev/null | wc -l | tr -d ' ')
+  if [[ "$frames" -lt 2 ]]; then
+    ((single++)) || true
+    continue
+  fi
+
+  if [[ $DRY_RUN -eq 1 ]]; then
+    echo "would extract: $name (frames=$frames)"
+    continue
+  fi
+
+  if heif-dec -d ffmpeg "$f" "${tmp_prefix}-${name}.png" >/dev/null 2>&1 &&
+    [[ -f "${tmp_prefix}-${name}-1.png" && -f "${tmp_prefix}-${name}-2.png" ]]; then
+    # heif-dec writes 1-indexed (-1, -2). Our convention is 0-indexed:
+    # light = frame 0, dark = frame 1.
+    mv "${tmp_prefix}-${name}-1.png" "${name}-0.png"
+    mv "${tmp_prefix}-${name}-2.png" "${name}-1.png"
+    ((extracted++)) || true
+    echo "  + $name"
+  else
+    failed+=("$name")
+  fi
+done
+
+echo "---"
+echo "extracted: $extracted  skipped (already have PNGs): $skipped  single-frame: $single  failed: ${#failed[@]}"
+if [[ ${#failed[@]} -gt 0 ]]; then
+  printf '  ! %s\n' "${failed[@]}"
+  exit 1
+fi

package/scripts/theme/rebuild-themes.sh

@@ -15,7 +15,14 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EXTRACT_SCRIPT="$SCRIPT_DIR/extract-theme.py"
 DOTFILES_DIR="${HOME}/.dotfiles"
-THEMES_FILE="$DOTFILES_DIR/.chezmoidata/themes.toml"
+
+# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+CHEZMOI_SRC="$DOTFILES_DIR"
+if [[ -f "$DOTFILES_DIR/.chezmoiroot" ]]; then
+  _sub="$(head -1 "$DOTFILES_DIR/.chezmoiroot" | tr -d '[:space:]')"
+  [[ -n "$_sub" && -d "$DOTFILES_DIR/$_sub" ]] && CHEZMOI_SRC="$DOTFILES_DIR/$_sub"
+fi
+THEMES_FILE="$CHEZMOI_SRC/.chezmoidata/themes.toml"
 CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/dotfiles/themes"
 CUSTOM_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
 

package/scripts/theme/switch.sh

@@ -30,9 +30,9 @@ cleanup() {
 trap cleanup EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 
@@ -58,8 +58,15 @@ if [ -z "$SRC_DIR" ]; then
   exit 1
 fi
 
-DATA_FILE="$SRC_DIR/.chezmoidata.toml"
-THEMES_FILE="$SRC_DIR/.chezmoidata/themes.toml"
+# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+CHEZMOI_SRC="$SRC_DIR"
+if [[ -f "$SRC_DIR/.chezmoiroot" ]]; then
+  _sub="$(head -1 "$SRC_DIR/.chezmoiroot" | tr -d '[:space:]')"
+  [[ -n "$_sub" && -d "$SRC_DIR/$_sub" ]] && CHEZMOI_SRC="$SRC_DIR/$_sub"
+fi
+
+DATA_FILE="$CHEZMOI_SRC/.chezmoidata.toml"
+THEMES_FILE="$CHEZMOI_SRC/.chezmoidata/themes.toml"
 WALLPAPER_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
 if [ ! -f "$DATA_FILE" ]; then
   ui_err "Missing" "$DATA_FILE"
@@ -124,8 +131,8 @@ paired_families() {
 wallpaper_source() {
   local family="${1:-}"
   # Check for custom wallpapers: dynamic (family.heic) or split (family-dark/light.ext)
-  for ext in heic jpg png; do
-    if [[ -f "$WALLPAPER_DIR/${family}.${ext}" || -f "$WALLPAPER_DIR/${family}-dark.${ext}" || -f "$WALLPAPER_DIR/${family}-light.${ext}" ]]; then
+  for ext in heic jpg png webp; do
+    if [[ -f "$WALLPAPER_DIR/${family}.${ext}" || -f "$WALLPAPER_DIR/${family}-dark.${ext}" || -f "$WALLPAPER_DIR/${family}-light.${ext}" || -f "$WALLPAPER_DIR/${family}-0.${ext}" ]]; then
       echo "Custom"
       return
     fi