@sebastienrousseau/dotfiles 0.2.502 → 0.2.503

package/scripts/qa/check-version-consistency.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# Verify that every "live" version reference matches the canonical
+# version in .chezmoidata.toml. The intent is to catch drift between
+# the source-of-truth and the human-visible surfaces (CLI banner, man
+# page, badge URL, etc.) BEFORE it ships.
+#
+# Historical references (CHANGELOG entries, audit-doc closed-cycle
+# tables, roadmap docs that mention previous versions) are NOT
+# checked — they are intentionally pinned to the version they
+# describe.
+#
+# Usage:
+#   scripts/qa/check-version-consistency.sh           # verify
+#   scripts/qa/check-version-consistency.sh --fix     # auto-fix
+#   scripts/qa/check-version-consistency.sh --quiet   # rc-only
+#
+# Exit codes:
+#   0  every live reference matches
+#   1  drift detected (with diff printed unless --quiet)
+#   2  bad usage / missing canonical version
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+# ── Parse flags ─────────────────────────────────────────────────────────
+fix=0
+quiet=0
+for arg in "$@"; do
+  case "$arg" in
+    --fix) fix=1 ;;
+    --quiet | -q) quiet=1 ;;
+    -h | --help)
+      sed -n '2,21p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+_log() { ((quiet)) || printf '%s\n' "$*"; }
+_err() { printf 'check-version-consistency: %s\n' "$*" >&2; }
+
+# ── Canonical version ──────────────────────────────────────────────────
+canonical="$(grep -E '^dotfiles_version[[:space:]]*=' defaults/.chezmoidata.toml |
+  head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
+
+if [[ -z "$canonical" ]]; then
+  _err 'failed to read dotfiles_version from defaults/.chezmoidata.toml'
+  exit 2
+fi
+_log "canonical: $canonical (defaults/.chezmoidata.toml)"
+
+# ── Per-file expected-substring map ────────────────────────────────────
+# Each entry: PATH|MATCH_PATTERN|EXPECTED_STRING
+# MATCH_PATTERN is a fixed substring to grep for on the file to
+# locate the version-bearing line; we then verify it contains the
+# expected substring rendered with $canonical. version-sync.sh
+# already handles many files (it reads package.json as source);
+# this list captures the surfaces version-sync.sh historically
+# missed — bento.sh banner, man-page header, dispatcher header.
+specs=(
+  "package.json|\"version\"|\"version\": \"${canonical}\""
+  "bin/dot|^VERSION=|VERSION=\"${canonical}\""
+  "bin/dot|^# Dotfiles CLI Entry Point - v|# Dotfiles CLI Entry Point - v${canonical}"
+  "share/man/man1/dot.1|^.TH DOT 1|dotfiles v${canonical}"
+  "lib/dot/bento.sh|D O T F I L E S|[v${canonical}]"
+  "README.md|img.shields.io/badge/Version|Version-v${canonical}-blue"
+  "CLAUDE.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+  "AGENTS.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+)
+
+drift=0
+for spec in "${specs[@]}"; do
+  IFS='|' read -r path pattern expected <<<"$spec"
+  if [[ ! -f "$path" ]]; then
+    _err "MISSING: $path (declared in spec list)"
+    drift=$((drift + 1))
+    continue
+  fi
+  line="$(grep -E "$pattern" "$path" | head -1 || true)"
+  if [[ -z "$line" ]]; then
+    _err "PATTERN NOT FOUND: '$pattern' in $path"
+    drift=$((drift + 1))
+    continue
+  fi
+  if [[ "$line" != *"$expected"* ]]; then
+    _err "DRIFT in $path"
+    _err "  found:    $line"
+    _err "  expected: contains '$expected'"
+    drift=$((drift + 1))
+    if ((fix)); then
+      # Auto-fix: only safe when the file contains a previous v0.X.YYY
+      # we can sed-replace. Skip otherwise.
+      old="$(printf '%s' "$line" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+      if [[ -n "$old" ]] && [[ "$old" != "v${canonical}" ]]; then
+        sed -i.bak "s|${old}|v${canonical}|g" "$path" && rm -f "$path.bak"
+        _log "  fixed:  $path  ($old → v${canonical})"
+      fi
+    fi
+  fi
+done
+
+if ((drift > 0)); then
+  if ((fix)); then
+    _log ""
+    _log "Auto-fixed where safe. Re-run without --fix to verify."
+  else
+    _log ""
+    _log "Tip: rerun with --fix to auto-correct (only safe substitutions)."
+    _log "     For non-trivial drift, edit the file manually then re-run."
+  fi
+  exit 1
+fi
+
+_log "all $((${#specs[@]})) live version surfaces match $canonical"
+exit 0

package/scripts/qa/coverage-baseline.sh

@@ -43,7 +43,7 @@ integration_tests="$(find "$REPO_ROOT/tests/integration" -name 'test_*.sh' | wc
 total_tests="$(find "$REPO_ROOT/tests" -path '*/framework/*' -prune -o -name 'test_*.sh' -print | wc -l | tr -d ' ')"
 named_tests="$(rg -o '\btest_start\b' "$REPO_ROOT/tests/unit" "$REPO_ROOT/tests/integration" -g 'test_*.sh' | wc -l | tr -d ' ')"
 docs_files="$(find "$REPO_ROOT/docs" -type f \( -name '*.md' -o -name '*.md.tmpl' \) | wc -l | tr -d ' ')"
-shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/dot_local/bin" "$REPO_ROOT/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
+shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/defaults/dot_local/bin" "$REPO_ROOT/defaults/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
 
 printf 'Coverage Baseline\n'
 printf 'Repository: %s\n' "$REPO_ROOT"

package/scripts/qa/docs-coverage.sh

@@ -5,12 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-DOT_CLI="$REPO_ROOT/dot_local/bin/executable_dot"
+DOT_CLI="$REPO_ROOT/bin/dot"
 UTILS_DOC="$REPO_ROOT/docs/reference/UTILS.md"
 AI_DOC="$REPO_ROOT/docs/AI.md"
 SCRIPTS_DOC="$REPO_ROOT/docs/reference/SCRIPTS.md"
 ARCH_DOC="$REPO_ROOT/docs/architecture/ARCHITECTURE.md"
-FUNCTION_GROUPS_JSON="$REPO_ROOT/.chezmoitemplates/functions/groups.json"
+FUNCTION_GROUPS_JSON="$REPO_ROOT/defaults/.chezmoitemplates/functions/groups.json"
 MIN_DOCS_COVERAGE="${MIN_DOCS_COVERAGE:-100}"
 
 TOTAL_CHECKS=0

package/scripts/qa/powershell-contract.ps1

@@ -16,7 +16,7 @@ $ErrorActionPreference = 'Stop'
 $Failures = New-Object System.Collections.Generic.List[string]
 
 $RepoRoot = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
-$ProfileSrc = Join-Path $RepoRoot 'dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
+$ProfileSrc = Join-Path $RepoRoot 'defaults/dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
 
 if (-not (Test-Path $ProfileSrc)) {
     Write-Output "FAIL: profile source not found at $ProfileSrc"

package/scripts/qa/scorecard-snapshot.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# Fetch the current OpenSSF Scorecard result and refresh the
+# per-check posture table in docs/security/SCORECARD.md.
+#
+# The narrative sections (open findings, exceptions, closed-this-
+# cycle log) are preserved as-is — only the auto-generated
+# baseline block between the BEGIN/END markers is rewritten.
+#
+# Usage:
+#   scripts/qa/scorecard-snapshot.sh           # refresh
+#   scripts/qa/scorecard-snapshot.sh --check   # exit 1 if stale
+#
+# Exit codes:
+#   0  snapshot up-to-date / written
+#   1  --check mode and content drifted
+#   2  bad usage / Scorecard API unreachable
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+mode="write"
+for arg in "$@"; do
+  case "$arg" in
+    --check) mode="check" ;;
+    -h | --help)
+      sed -n '2,16p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+api='https://api.scorecard.dev/projects/github.com/sebastienrousseau/dotfiles'
+target='docs/security/SCORECARD.md'
+
+[[ -f "$target" ]] || {
+  echo "target not found: $target" >&2
+  exit 2
+}
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "jq required" >&2
+  exit 2
+fi
+
+payload="$(curl -sSfL "$api")" || {
+  echo "Scorecard API unreachable: $api" >&2
+  exit 2
+}
+
+aggregate="$(printf '%s' "$payload" | jq -r '.score')"
+date="$(printf '%s' "$payload" | jq -r '.date')"
+
+# Build the auto-block: per-check status + score, one row each.
+block="$(mktemp)"
+trap 'rm -f "$block"' EXIT
+
+{
+  printf '<!-- BEGIN scorecard-snapshot (auto-generated, do not edit by hand) -->\n'
+  printf 'Aggregate score **%s / 10** at %s.\n\n' "$aggregate" "$date"
+  printf '| Check | Score | Reason |\n'
+  printf '|---|---:|---|\n'
+  printf '%s' "$payload" |
+    jq -r '.checks
+        | sort_by(.name)
+        | .[]
+        | [.name, (.score|tostring), ((.reason // "") | gsub("\\|"; "\\|") | .[0:100])]
+        | "| " + (. | join(" | ")) + " |"'
+  # shellcheck disable=SC2016 # backticks here are markdown code-spans, not subshells
+  printf '\n_Refresh: `scripts/qa/scorecard-snapshot.sh` · CI check: `lint/scorecard-snapshot` (planned)._\n'
+  printf '<!-- END scorecard-snapshot -->\n'
+} >"$block"
+
+# Splice the block into the target. Find the BEGIN/END markers; if
+# they're not yet present, append the block after the "## Live
+# score" section header.
+out="$(mktemp)"
+trap 'rm -f "$block" "$out"' EXIT
+
+if grep -q '<!-- BEGIN scorecard-snapshot' "$target"; then
+  awk -v blockfile="$block" '
+    BEGIN { skip = 0 }
+    /<!-- BEGIN scorecard-snapshot/ {
+      skip = 1
+      while ((getline line < blockfile) > 0) print line
+      close(blockfile)
+      next
+    }
+    /<!-- END scorecard-snapshot -->/ {
+      skip = 0
+      next
+    }
+    skip == 0 { print }
+  ' "$target" >"$out"
+else
+  # First run — inject right after the "## Live score" h2.
+  awk -v blockfile="$block" '
+    { print }
+    /^## Live score$/ && !inserted {
+      print ""
+      while ((getline line < blockfile) > 0) print line
+      close(blockfile)
+      inserted = 1
+    }
+  ' "$target" >"$out"
+fi
+
+if [[ "$mode" == "check" ]]; then
+  if ! diff -q "$target" "$out" >/dev/null 2>&1; then
+    echo "SCORECARD.md snapshot is stale (live score: $aggregate)." >&2
+    diff -u "$target" "$out" | head -50 >&2
+    exit 1
+  fi
+  echo "SCORECARD.md snapshot is in sync (aggregate: $aggregate)"
+  exit 0
+fi
+
+mv "$out" "$target"
+trap - EXIT
+echo "Refreshed $target (aggregate: $aggregate as of $date)"

package/scripts/security/backup.sh

@@ -34,9 +34,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_header "Backup"

package/scripts/security/dns-doh.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/encryption-check.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 ui_init
 ui_header "Encryption Check"

package/scripts/security/enforce-policies.sh

@@ -13,9 +13,9 @@ readonly REPO_ROOT
 readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
 readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
 
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+source "${SCRIPT_DIR}/../../lib/dot/ui.sh"
 ui_init
 
 # Logging function (also writes to log file)

package/scripts/security/firewall.sh

@@ -37,12 +37,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/lock-screen.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/manage-secrets.sh

@@ -39,9 +39,9 @@ readonly REPO_ROOT
 readonly ENV_TEMPLATE="${REPO_ROOT}/.github/security-policies/environment-template.env"
 readonly ENV_LOCAL="${REPO_ROOT}/.env.local"
 
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+source "${SCRIPT_DIR}/../../lib/dot/ui.sh"
 ui_init
 
 # Help text

package/scripts/security/ssh-cert.sh

@@ -27,9 +27,9 @@ CA_PROVISIONER="${SSH_CERT_CA_PROVISIONER:-}"
 # ---------- helpers -------------------------------------------------------- #
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 info() { ui_info "ssh-cert" "$*"; }

package/scripts/security/telemetry-kill.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/security/usb-safety.sh

@@ -3,12 +3,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
 
 DRY_RUN=0
 for arg in "$@"; do

package/scripts/theme/extract-heic-frames.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# extract-heic-frames.sh — extract per-frame PNGs from dynamic HEIC wallpapers.
+#
+# Apple's dynamic HEIC format packs two images (frame 0 = light, frame 1 =
+# dark) in one container. DMS's matugen worker reads the wallpaper path from
+# ~/.local/state/DankMaterialShell/session.json and feeds it to matugen,
+# which calls ImageMagick's heif decoder. On many systems (Arch Linux's
+# libheif 1.23 + libde265 1.1 is one) that decoder fails to decompress
+# Apple's dynamic HEIC with:
+#
+#   Decoder plugin generated an error: Unspecified: Decoding the input
+#   data did not give a decompressed image.
+#
+# Symptom: every `dot theme <family>` for a HEIC-only family produces
+# a matugen "Theme worker FATAL" in the dms journal and the dynamic
+# color scheme stops regenerating.
+#
+# Workaround: pre-extract `{family}-0.png` (light) and `{family}-1.png`
+# (dark) PNG frames next to each HEIC. wallpaper-sync.sh's resolver
+# prefers `{family}-{0,1}.png` over `{family}.heic`, so DMS gets the
+# decodable PNG instead of the broken HEIC.
+#
+# We use libheif's `heif-dec -d ffmpeg` because libde265 fails where
+# the bundled ffmpeg decoder succeeds for the same input.
+#
+# Usage:
+#   bash scripts/theme/extract-heic-frames.sh                 # all HEICs in default dir
+#   bash scripts/theme/extract-heic-frames.sh --force         # re-extract even if PNGs exist
+#   bash scripts/theme/extract-heic-frames.sh --dry-run       # show what would extract
+#   DOTFILES_WALLPAPER_DIR=/path bash scripts/.../extract-heic-frames.sh
+
+set -euo pipefail
+
+WALLPAPER_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
+FORCE=0
+DRY_RUN=0
+
+for arg in "$@"; do
+  case "$arg" in
+    --force | -f) FORCE=1 ;;
+    --dry-run | -n) DRY_RUN=1 ;;
+    --help | -h)
+      sed -n '4,30p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $arg" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ ! -d "$WALLPAPER_DIR" ]]; then
+  echo "Wallpaper dir not found: $WALLPAPER_DIR" >&2
+  exit 1
+fi
+
+for cmd in magick heif-dec; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "Required: $cmd (install ImageMagick + libheif-tools)" >&2
+    exit 1
+  fi
+done
+
+cd "$WALLPAPER_DIR"
+
+extracted=0
+skipped=0
+single=0
+failed=()
+tmp_prefix="$(mktemp -d)/heic"
+
+trap 'rm -rf "$(dirname "$tmp_prefix")"' EXIT
+
+for f in *.heic; do
+  [[ -e "$f" ]] || continue
+  name="${f%.heic}"
+
+  if [[ $FORCE -eq 0 && -f "${name}-0.png" && -f "${name}-1.png" ]]; then
+    ((skipped++)) || true
+    continue
+  fi
+
+  frames=$(magick identify "$f" 2>/dev/null | wc -l | tr -d ' ')
+  if [[ "$frames" -lt 2 ]]; then
+    ((single++)) || true
+    continue
+  fi
+
+  if [[ $DRY_RUN -eq 1 ]]; then
+    echo "would extract: $name (frames=$frames)"
+    continue
+  fi
+
+  if heif-dec -d ffmpeg "$f" "${tmp_prefix}-${name}.png" >/dev/null 2>&1 &&
+    [[ -f "${tmp_prefix}-${name}-1.png" && -f "${tmp_prefix}-${name}-2.png" ]]; then
+    # heif-dec writes 1-indexed (-1, -2). Our convention is 0-indexed:
+    # light = frame 0, dark = frame 1.
+    mv "${tmp_prefix}-${name}-1.png" "${name}-0.png"
+    mv "${tmp_prefix}-${name}-2.png" "${name}-1.png"
+    ((extracted++)) || true
+    echo "  + $name"
+  else
+    failed+=("$name")
+  fi
+done
+
+echo "---"
+echo "extracted: $extracted  skipped (already have PNGs): $skipped  single-frame: $single  failed: ${#failed[@]}"
+if [[ ${#failed[@]} -gt 0 ]]; then
+  printf '  ! %s\n' "${failed[@]}"
+  exit 1
+fi

package/scripts/theme/rebuild-themes.sh

@@ -15,7 +15,14 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EXTRACT_SCRIPT="$SCRIPT_DIR/extract-theme.py"
 DOTFILES_DIR="${HOME}/.dotfiles"
-THEMES_FILE="$DOTFILES_DIR/.chezmoidata/themes.toml"
+
+# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+CHEZMOI_SRC="$DOTFILES_DIR"
+if [[ -f "$DOTFILES_DIR/.chezmoiroot" ]]; then
+  _sub="$(head -1 "$DOTFILES_DIR/.chezmoiroot" | tr -d '[:space:]')"
+  [[ -n "$_sub" && -d "$DOTFILES_DIR/$_sub" ]] && CHEZMOI_SRC="$DOTFILES_DIR/$_sub"
+fi
+THEMES_FILE="$CHEZMOI_SRC/.chezmoidata/themes.toml"
 CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/dotfiles/themes"
 CUSTOM_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
 

package/scripts/theme/switch.sh

@@ -30,9 +30,9 @@ cleanup() {
 trap cleanup EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 
@@ -58,8 +58,15 @@ if [ -z "$SRC_DIR" ]; then
   exit 1
 fi
 
-DATA_FILE="$SRC_DIR/.chezmoidata.toml"
-THEMES_FILE="$SRC_DIR/.chezmoidata/themes.toml"
+# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+CHEZMOI_SRC="$SRC_DIR"
+if [[ -f "$SRC_DIR/.chezmoiroot" ]]; then
+  _sub="$(head -1 "$SRC_DIR/.chezmoiroot" | tr -d '[:space:]')"
+  [[ -n "$_sub" && -d "$SRC_DIR/$_sub" ]] && CHEZMOI_SRC="$SRC_DIR/$_sub"
+fi
+
+DATA_FILE="$CHEZMOI_SRC/.chezmoidata.toml"
+THEMES_FILE="$CHEZMOI_SRC/.chezmoidata/themes.toml"
 WALLPAPER_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
 if [ ! -f "$DATA_FILE" ]; then
   ui_err "Missing" "$DATA_FILE"
@@ -124,8 +131,8 @@ paired_families() {
 wallpaper_source() {
   local family="${1:-}"
   # Check for custom wallpapers: dynamic (family.heic) or split (family-dark/light.ext)
-  for ext in heic jpg png; do
-    if [[ -f "$WALLPAPER_DIR/${family}.${ext}" || -f "$WALLPAPER_DIR/${family}-dark.${ext}" || -f "$WALLPAPER_DIR/${family}-light.${ext}" ]]; then
+  for ext in heic jpg png webp; do
+    if [[ -f "$WALLPAPER_DIR/${family}.${ext}" || -f "$WALLPAPER_DIR/${family}-dark.${ext}" || -f "$WALLPAPER_DIR/${family}-light.${ext}" || -f "$WALLPAPER_DIR/${family}-0.${ext}" ]]; then
       echo "Custom"
       return
     fi