@sebastienrousseau/dotfiles 0.2.502 → 0.2.503

package/scripts/ci/check-shell-preamble.sh

@@ -1,106 +1,7 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# check-shell-preamble.sh — Enforce `set -euo pipefail` (bash) / `set -eu` (sh)
-# on every executable shell script in the repo.
-#
-# Skip-rules:
-#   * Sourced libraries that declare themselves as such via a "Sourced by ..."
-#     header comment in the first 15 lines.
-#   * Explicit opt-out via `# preamble:skip` marker in the first 15 lines
-#     (used by completion files, init fragments, and other library code that
-#     is loaded into the caller's shell context).
-#   * Files under tests/ (the test runner sets shell options for its children).
-#
-# Invocation:
-#   * pre-commit local hook (files passed as args)
-#   * standalone: ./scripts/ci/check-shell-preamble.sh           # full repo
-#                 ./scripts/ci/check-shell-preamble.sh file.sh   # explicit
-# =============================================================================
-
+# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# Pinned reusable workflows on master still reference the old path;
+# this delegates so they keep working until the next pin bump.
 set -euo pipefail
-
-check_one() {
-  local f="$1"
-
-  [[ -f "$f" ]] || return 0
-
-  local shebang
-  shebang="$(head -1 "$f" 2>/dev/null || true)"
-
-  # Only check files with a bash or sh shebang.
-  case "$shebang" in
-    *bash*) ;;
-    *sh) ;;
-    *) return 0 ;;
-  esac
-
-  # Skip files declaring themselves as sourced libraries or opting out.
-  if head -15 "$f" | grep -Eq '^# *(Sourced by |preamble:skip|shellcheck source-only)'; then
-    return 0
-  fi
-
-  # Skip the test suite — tests are sourced by tests/framework/test_runner.sh
-  # which manages shell options for its children.
-  case "$f" in
-    tests/*) return 0 ;;
-    # Bulk-sourced fragments. These directories contain hundreds of
-    # alias / function / PATH snippets that are sourced into the
-    # caller's shell context — adding `set -e` locally would corrupt
-    # the caller. Path-skipped en masse rather than annotated per-file
-    # (would be 300+ marker comments).
-    .chezmoitemplates/aliases/*) return 0 ;;
-    .chezmoitemplates/functions/*) return 0 ;;
-    .chezmoitemplates/paths/*) return 0 ;;
-    # dot_config/shell/* and scripts/dot/lib/* are also sourced but
-    # have explicit `# Sourced by` headers as of #854 (defense in
-    # depth — the lint also accepts them on header alone).
-    dot_local/bin/executable_dot_completion) return 0 ;; # zsh completion, sourced into shell
-  esac
-
-  # Required preamble lives within the first 50 lines (after optional docstring).
-  local preamble_re
-  case "$shebang" in
-    *bash*)
-      preamble_re='^[[:space:]]*set[[:space:]]+-([eu]+o[[:space:]]+pipefail|euo[[:space:]]+pipefail|eu[[:space:]]*$)'
-      ;;
-    *sh)
-      preamble_re='^[[:space:]]*set[[:space:]]+-eu[o]?'
-      ;;
-  esac
-
-  if ! head -50 "$f" | grep -Eq "$preamble_re"; then
-    echo "MISSING preamble: $f"
-    return 1
-  fi
-}
-
-fail=0
-if [[ $# -gt 0 ]]; then
-  for f in "$@"; do
-    check_one "$f" || fail=1
-  done
-else
-  # Full-repo scan
-  while IFS= read -r f; do
-    check_one "$f" || fail=1
-  done < <(git ls-files | grep -E '\.sh$|^dot_local/bin/executable_|^scripts/.+\.sh$')
-fi
-
-if [[ $fail -ne 0 ]]; then
-  cat >&2 <<'MSG'
-
-Some shell scripts are missing the safety preamble.
-  * bash → `set -euo pipefail`
-  * sh   → `set -eu`
-
-If the file is a sourced library, add this header to its first 15 lines:
-  # Sourced by <parent>.sh; inherits set -euo pipefail
-
-If the file is a shell init fragment / completion that must NOT enforce its own
-options on the caller, add this marker instead:
-  # preamble:skip
-
-MSG
-  exit 1
-fi
+exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/check-shell-preamble.sh" "$@"

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -1,57 +1,7 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Guard against full-history gitleaks scans on manual runs.
-# This ensures workflow checkout remains shallow near gitleaks steps.
-
+# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# Pinned reusable workflows on master still reference the old path;
+# this delegates so they keep working until the next pin bump.
 set -euo pipefail
-
-check_workflow() {
-  local workflow="$1"
-  local failed=0
-  local line_no
-
-  while IFS=: read -r line_no _; do
-    local start end context
-    start=$((line_no - 16))
-    end=$((line_no + 2))
-    if [[ "$start" -lt 1 ]]; then
-      start=1
-    fi
-
-    context="$(sed -n "${start},${end}p" "$workflow")"
-
-    if [[ "$context" != *"actions/checkout"* ]]; then
-      echo "ERROR: $workflow:$line_no missing nearby checkout for gitleaks step."
-      failed=1
-      continue
-    fi
-
-    if [[ "$context" != *"fetch-depth: 1"* ]]; then
-      echo "ERROR: $workflow:$line_no gitleaks step must use checkout fetch-depth: 1."
-      failed=1
-    fi
-
-    if [[ "$context" == *"fetch-depth: 0"* ]]; then
-      echo "ERROR: $workflow:$line_no gitleaks step contains forbidden fetch-depth: 0."
-      failed=1
-    fi
-  done < <(grep -n "gitleaks/gitleaks-action" "$workflow" || true)
-
-  return "$failed"
-}
-
-main() {
-  local failed=0
-
-  check_workflow ".github/workflows/ci.yml" || failed=1
-  check_workflow ".github/workflows/security-enhanced.yml" || failed=1
-
-  if [[ "$failed" -ne 0 ]]; then
-    echo "Gitleaks checkout guard failed."
-    exit 1
-  fi
-
-  echo "Gitleaks checkout guard passed."
-}
-
-main "$@"
+exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/guard-gitleaks-checkout.sh" "$@"

package/scripts/diagnostics/a2a-conformance.sh

@@ -7,8 +7,8 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 
-# shellcheck source=../dot/lib/ui.sh
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../../lib/dot/ui.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 JSON_MODE=0
 STRICT_MODE=0
@@ -35,8 +35,8 @@ command -v jq >/dev/null 2>&1 || {
 
 a2a_card="$REPO_ROOT/.well-known/agent-card.json"
 legacy_doc="$REPO_ROOT/.well-known/agent.json"
-internal_card="$REPO_ROOT/dot_config/dotfiles/agent-card.json"
-agent_profiles="$REPO_ROOT/dot_config/dotfiles/agent-profiles.json"
+internal_card="$REPO_ROOT/defaults/dot_config/dotfiles/agent-card.json"
+agent_profiles="$REPO_ROOT/defaults/dot_config/dotfiles/agent-profiles.json"
 status="healthy"
 issues=()
 

package/scripts/diagnostics/alias-governance.sh

@@ -110,7 +110,7 @@ if [[ -f "$deprecations_file" ]]; then
         alias_found=1
       fi
       function_found=0
-      if rg -q --glob '*.sh' --glob '*.aliases.sh' --glob '*.tmpl' "^[[:space:]]*(function[[:space:]]+)?${alias_name}[[:space:]]*\\(\\)" "$SCRIPT_DIR/../../.chezmoitemplates/aliases" "$SCRIPT_DIR/../../scripts/dot"; then
+      if rg -q --glob '*.sh' --glob '*.aliases.sh' --glob '*.tmpl' "^[[:space:]]*(function[[:space:]]+)?${alias_name}[[:space:]]*\\(\\)" "$SCRIPT_DIR/../../defaults/.chezmoitemplates/aliases" "$SCRIPT_DIR/../../scripts/dot"; then
         function_found=1
       fi
       if [[ $alias_found -eq 1 || $function_found -eq 1 ]]; then

package/scripts/diagnostics/aliases-cheatsheet.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/utils.sh
+# shellcheck source=../../lib/dot/utils.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/utils.sh"
+source "$SCRIPT_DIR/../../lib/dot/utils.sh"
 
 src_dir="$(require_source_dir)"
 manifest="$src_dir/scripts/diagnostics/aliases-manifest.sh"

package/scripts/diagnostics/benchmark.sh

@@ -44,12 +44,12 @@ _cleanup_files=()
 trap 'rm -f "${_cleanup_files[@]}"' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="benchmark"
 
 BENCHMARK_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles/benchmarks"

package/scripts/diagnostics/conflicts.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/diagnostics/doctor-unified.sh

@@ -8,9 +8,9 @@ trap 'rm -f "${_cleanup_files[@]}"' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 passthrough=()

package/scripts/diagnostics/doctor.sh

@@ -19,15 +19,15 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="doctor"
 
 ui_init
@@ -607,11 +607,11 @@ if command -v zsh >/dev/null 2>&1; then
 fi
 
 # 4. PATH length. Each entry is searched on every command resolution.
-# A mise-managed dev machine routinely adds 50+ entries (one per tool
-# install path), so the warn/fail thresholds are set higher than a
-# lean baseline (40) would suggest.
+# A mise-managed 2026 dev machine routinely adds 60-90 entries (one per
+# installed tool version + per-shim path), so the warn/fail thresholds
+# reflect that baseline rather than a lean default (~40).
 path_count=$(printf '%s' "${PATH:-}" | tr ':' '\n' | grep -c . || true)
-if [[ "$path_count" -le 60 ]]; then
+if [[ "$path_count" -le 75 ]]; then
   _ok "PATH length" "$path_count entries"
 elif [[ "$path_count" -le 120 ]]; then
   _warn "PATH length" "$path_count entries — consider pruning"

package/scripts/diagnostics/drift-dashboard.sh

@@ -30,9 +30,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 JSON_MODE=0
 SHOW_DIFF="${DOTFILES_DRIFT_SHOW_DIFF:-0}"

package/scripts/diagnostics/health.sh

@@ -6,12 +6,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 
 # Portable has_command (self-contained; no dependency on utils.sh)
 has_command() { command -v "$1" >/dev/null 2>&1; }

package/scripts/diagnostics/history-analysis.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 histfile="${HISTFILE:-$HOME/.zsh_history}"
 db="${DOTFILES_HISTORY_DB:-$HOME/.local/share/dotfiles/history.sqlite}"

package/scripts/diagnostics/mcp-doctor.sh

@@ -31,9 +31,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 # Parse arguments
 STRICT_MODE=0
@@ -93,14 +93,17 @@ log_warn() {
 }
 
 MCP_CONFIG="${MCP_CONFIG:-$HOME/.config/claude/mcp_servers.json}"
-if [[ ! -f "$MCP_CONFIG" && -f "$HOME/.dotfiles/dot_config/claude/mcp_servers.json" ]]; then
-  MCP_CONFIG="$HOME/.dotfiles/dot_config/claude/mcp_servers.json"
+if [[ ! -f "$MCP_CONFIG" ]]; then
+  for cand in "$HOME/.dotfiles/defaults/dot_config/claude/mcp_servers.json" \
+    "$HOME/.dotfiles/dot_config/claude/mcp_servers.json"; do
+    [[ -f "$cand" ]] && MCP_CONFIG="$cand" && break
+  done
 fi
 
 REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-MCP_POLICY_CONFIG="${MCP_POLICY_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-policy.json}"
-MCP_LOCK_CONFIG="${MCP_LOCK_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-lock.json}"
-MCP_REGISTRY_CONFIG="${MCP_REGISTRY_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-registry.json}"
+MCP_POLICY_CONFIG="${MCP_POLICY_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-policy.json}"
+MCP_LOCK_CONFIG="${MCP_LOCK_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-lock.json}"
+MCP_REGISTRY_CONFIG="${MCP_REGISTRY_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-registry.json}"
 
 if [[ "$JSON_MODE" -ne 1 ]]; then
   ui_init

package/scripts/diagnostics/perf.sh

@@ -9,12 +9,12 @@ _cleanup_files=()
 trap 'rm -f "${_cleanup_files[@]}"' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="perf"
 
 ui_init

package/scripts/diagnostics/scorecard.sh

@@ -6,12 +6,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="scorecard"
 
 ui_init

package/scripts/diagnostics/security-score.sh

@@ -30,9 +30,9 @@ set -euo pipefail
 set +o xtrace 2>/dev/null || true
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 # Parse arguments
 VERBOSE=true

package/scripts/diagnostics/smoke-test.sh

@@ -5,9 +5,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 ui_header "Dotfiles Smoke Tests"

package/scripts/diagnostics/snapshot.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/diagnostics/verify.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_dot_banner "Diagnostics"
@@ -43,8 +43,8 @@ resolve_dot_bin() {
   elif [[ -d "$HOME/.local/share/chezmoi" ]]; then
     src_dir="$HOME/.local/share/chezmoi"
   fi
-  if [[ -n "$src_dir" && -x "$src_dir/dot_local/bin/executable_dot" ]]; then
-    printf "%s\n" "$src_dir/dot_local/bin/executable_dot"
+  if [[ -n "$src_dir" && -x "$src_dir/bin/dot" ]]; then
+    printf "%s\n" "$src_dir/bin/dot"
     return
   fi
   return 1

package/scripts/diagnostics/version-locks.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/diagnostics/workstation-attestation.sh

@@ -13,12 +13,12 @@ REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 # without the env-prefix dance that confuses shellcheck (SC2097/SC2098).
 export REPO_ROOT
 
-# shellcheck source=../dot/lib/ui.sh
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
-# shellcheck source=../dot/lib/utils.sh
-source "$SCRIPT_DIR/../dot/lib/utils.sh"
+# shellcheck source=../../lib/dot/ui.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
+# shellcheck source=../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../lib/dot/utils.sh"
 
 JSON_MODE=0
 WRITE_PATH=""
@@ -72,14 +72,14 @@ platform_id="$(dot_platform_id)"
 host_os="$(dot_host_os)"
 arch="$(uname -m)"
 hostname_value="$(hostname 2>/dev/null || true)"
-agent_profile_file="$REPO_ROOT/dot_config/dotfiles/agent-profiles.json"
-agent_card_file="$REPO_ROOT/dot_config/dotfiles/agent-card.json"
+agent_profile_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-profiles.json"
+agent_card_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-card.json"
 agent_state_file="${AGENT_STATE_FILE:-$HOME/.config/dotfiles/agent-mode.env}"
-policy_bundles_file="$REPO_ROOT/dot_config/dotfiles/policy-bundles.json"
-model_registry_file="$REPO_ROOT/dot_config/dotfiles/model-registry.json"
-prompt_registry_file="$REPO_ROOT/dot_config/dotfiles/prompt-registry.json"
-mcp_policy_file="$REPO_ROOT/dot_config/dotfiles/mcp-policy.json"
-mcp_registry_file="$REPO_ROOT/dot_config/dotfiles/mcp-registry.json"
+policy_bundles_file="$REPO_ROOT/defaults/dot_config/dotfiles/policy-bundles.json"
+model_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/model-registry.json"
+prompt_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/prompt-registry.json"
+mcp_policy_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-policy.json"
+mcp_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-registry.json"
 signing_format="$(git config --global gpg.format 2>/dev/null || echo ssh)"
 signing_key="$(git config --global user.signingkey 2>/dev/null || true)"
 allowed_signers="$(git config --global gpg.ssh.allowedSignersFile 2>/dev/null || echo "$HOME/.config/git/allowed_signers")"
@@ -94,7 +94,7 @@ if [[ -z "$current_profile" ]] && [[ -f "$agent_profile_file" ]]; then
   current_profile="$(jq -r '.defaultProfile // "ask"' "$agent_profile_file")"
 fi
 
-MCP_CONFIG="$REPO_ROOT/dot_config/claude/mcp_servers.json"
+MCP_CONFIG="$REPO_ROOT/defaults/dot_config/claude/mcp_servers.json"
 export MCP_CONFIG
 mcp_summary="$(bash "$REPO_ROOT/scripts/diagnostics/mcp-doctor.sh" --strict --json)"
 

package/scripts/dot/commands/agent.sh

@@ -9,6 +9,14 @@ set -euo pipefail
 # These functions are sourced by meta.sh for dispatch.
 
 _agent_repo_root() {
+  # Post-Phase-4b: agent profile/card JSON ships under defaults/dot_config/.
+  # Prefer the chezmoi source dir so callers can append dot_config/... directly.
+  local dir
+  dir="$(resolve_chezmoi_source_dir)"
+  [[ -n "$dir" ]] && {
+    printf '%s\n' "$dir"
+    return
+  }
   require_source_dir
 }
 

package/scripts/dot/commands/agents.sh

@@ -25,8 +25,8 @@ set -euo pipefail
 
 # shellcheck disable=SC1091
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/../lib/ui.sh"
-source "$SCRIPT_DIR/../lib/utils.sh"
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 _agents_repo_root() {
   # Resolve the chezmoi source dir (where CLAUDE.md/AGENTS.md live).
@@ -40,16 +40,26 @@ _agents_repo_root() {
   # we treat that as "not a match" and fall through to git, rather
   # than accepting the wrong candidate.
   local candidate=""
+  # Sanity probe: post-Phase-4b the data file lives at
+  # defaults/.chezmoidata.toml; older deployments kept it at the root.
+  _has_chezmoidata() {
+    [[ -f "$1/.chezmoidata.toml" || -f "$1/defaults/.chezmoidata.toml" ]]
+  }
   if command -v chezmoi >/dev/null 2>&1; then
     candidate="$(chezmoi source-path 2>/dev/null || true)"
-    if [[ -n "$candidate" && ! -f "$candidate/.chezmoidata.toml" ]]; then
+    # chezmoi source-path returns defaults/ when .chezmoiroot is set;
+    # peel back one level so callers receive the actual repo root.
+    if [[ -n "$candidate" && -f "$candidate/.chezmoidata.toml" && "$(basename "$candidate")" == "defaults" ]]; then
+      candidate="$(dirname "$candidate")"
+    fi
+    if [[ -n "$candidate" ]] && ! _has_chezmoidata "$candidate"; then
       candidate=""
     fi
   fi
   if [[ -z "$candidate" ]]; then
     candidate="$(git -C "$PWD" rev-parse --show-toplevel 2>/dev/null || true)"
   fi
-  if [[ -z "$candidate" ]] || [[ ! -f "$candidate/.chezmoidata.toml" ]]; then
+  if [[ -z "$candidate" ]] || ! _has_chezmoidata "$candidate"; then
     return 1
   fi
   printf '%s\n' "$candidate"