@sebastienrousseau/dotfiles 0.2.502 → 0.2.503

package/scripts/dot/commands/ai.sh

@@ -4,13 +4,13 @@
 ##
 ## Provides AI CLI status, setup, RAG query, and bridge commands.
 ## Wraps AI CLI tools with contextual patterns and system metadata.
-## Usage: dot ai|ai-setup|ai-query|cl|copilot|gemini|kiro|sgpt|ollama|opencode|aider|autohand|vibe|qwen|zai
+## Usage: dot ai [delegate|cost|status]|ai-setup|ai-query|cl|copilot|gemini|kiro|sgpt|ollama|opencode|aider|autohand|vibe|qwen|zai
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "AI and Agents" "${1:-}"
 
@@ -82,16 +82,18 @@ _ai_refresh_status_cache() {
     indexed+=("$i|$entry")
     i=$((i + 1))
   done
+  # Probe is non-interactive: </dev/null is a clean EOF for tools that
+  # prompt for an API key on first run; `timeout 3` caps the wait.
   # shellcheck disable=SC2016
+  local _TO=""
+  command -v timeout >/dev/null 2>&1 && _TO="timeout 3 "
   local probe_script='
-    payload="$1"
-    out_dir="$2"
-    i="${payload%%|*}"
-    entry="${payload#*|}"
+    payload="$1"; out_dir="$2"; to="$3"
+    i="${payload%%|*}"; entry="${payload#*|}"
     IFS="|" read -r category role name bin desc <<<"$entry"
     if command -v "$bin" >/dev/null 2>&1; then
-      output=$("$bin" --version 2>/dev/null | head -1) || true
-      version=$(printf "%s" "$output" | sed "s/^[^0-9]*//" | sed "s/[[:space:]]*$//" | sed "s/\.$//")
+      output=$($to "$bin" --version </dev/null 2>/dev/null | head -1) || true
+      version=$(printf "%s" "$output" | sed "s/^[^0-9]*//;s/[[:space:]]*$//;s/\.$//")
       printf "%s\t1\t%s\n" "$bin" "$version" >"$out_dir/$i"
     else
       printf "%s\t0\t\n" "$bin" >"$out_dir/$i"
@@ -107,7 +109,7 @@ _ai_refresh_status_cache() {
   # agent") don't trigger xargs's "unterminated quote" parser.
   printf '%s\0' "${indexed[@]}" |
     xargs -0 -I{} -P"$jobs" \
-      bash -c "$probe_script" _ {} "$probe_dir" \
+      bash -c "$probe_script" _ {} "$probe_dir" "$_TO" \
       2>/dev/null || true
 
   # Re-assemble in original entry order.
@@ -312,6 +314,94 @@ cmd_ai_query() {
   run_script "dot_local/bin/executable_dot-ai" "AI RAG script" "$@"
 }
 
+# Locate the vibe-delegate / delegate-report tools deployed by the
+# /vibe Claude Code skill. Path stays in sync with
+# defaults/dot_claude/skills/vibe/tools/.
+_ai_delegate_tool() {
+  local tool="$1" # vibe-delegate | delegate-report
+  local path="${HOME}/.claude/skills/vibe/tools/${tool}"
+  if [[ ! -x "$path" ]]; then
+    # Errors to stderr so callers capturing stdout via $() get just the path.
+    ui_err "$tool" "not found at $path" >&2
+    ui_info "Hint" "Run 'chezmoi apply' to deploy the /vibe skill" >&2
+    return 1
+  fi
+  printf '%s\n' "$path"
+}
+
+cmd_ai_delegate() {
+  # Front-door to the same delegator the /vibe slash command uses.
+  # Usage: dot ai delegate "<prompt>" [max-turns] [agent] [timeout]
+  if [[ $# -lt 1 ]]; then
+    ui_err "Usage" "dot ai delegate \"<prompt>\" [max-turns] [agent] [timeout-secs]"
+    ui_info "Example" "dot ai delegate \"add a CHANGELOG entry for v0.2.504\""
+    return 1
+  fi
+  local prompt="$1"
+  shift
+  local max_turns="${1:-10}"
+  local agent="${2:-}"
+  local timeout="${3:-180}"
+  local tool
+  tool="$(_ai_delegate_tool vibe-delegate)" || return 1
+  if ! has_command vibe; then
+    ui_warn "vibe" "not installed"
+    ui_info "Install" "mise use -g pipx:mistral-vibe"
+    return 1
+  fi
+  "$tool" "$(pwd)" "$prompt" "$max_turns" "$agent" "$timeout"
+}
+
+cmd_ai_cost() {
+  # Unified AI spend report. Wraps delegate-report (vibe runs) and is
+  # the documented interface for users: path may move later.
+  local tool
+  tool="$(_ai_delegate_tool delegate-report)" || return 1
+  "$tool" "$@"
+}
+
+# Append a best-effort run entry to the unified AI log read by
+# delegate-report. Token/cost fields are left blank when the provider
+# CLI does not surface them — the report tolerates missing fields and
+# groups by `model`. This gives users one place to see invocations
+# across Claude, Gemini, Aider, Vibe, etc., not just Vibe.
+_ai_log_run() {
+  local provider="$1" exit_code="$2" duration_secs="$3" prompt_words="$4"
+  local log_file="${HOME}/.local/share/delegate-runs.jsonl"
+  mkdir -p "$(dirname "$log_file")"
+  local project ts
+  project="$(basename "$PWD")"
+  ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  # python3 keeps the encoding boring; jq would also work but isn't
+  # guaranteed present everywhere this script runs.
+  python3 - "$log_file" "$provider" "$project" "$exit_code" "$duration_secs" "$prompt_words" "$ts" <<'PY'
+import json, sys
+log, provider, project, ec, dur, pw, ts = sys.argv[1:8]
+entry = {
+    "ts": ts,
+    "delegate": provider,
+    "model": provider,
+    "project": project,
+    "exit_code": int(ec),
+    "duration_secs": float(dur),
+    "prompt_words": int(pw),
+    "tool_calls": 0,
+    "files_changed": 0,
+    "wrote_nothing": False,
+    "warn_count": 0,
+    "search_replace_fails": 0,
+    "syntax_errors": 0,
+    "tokens_in": 0,
+    "tokens_out": 0,
+    "tokens_total": 0,
+    "cost_usd": 0,
+    "cost_claude_eq": 0,
+}
+with open(log, "a") as fh:
+    fh.write(json.dumps(entry) + "\n")
+PY
+}
+
 run_ai_with_context() {
   local tool="$1"
   shift
@@ -405,61 +495,90 @@ ${prompt}"
 
   ui_info "Executing $tool with pattern: ${pattern_name:-none}"
 
+  # Wrap the provider invocation so we can log it to the unified AI run
+  # log. Each entry feeds `dot ai cost` so users see spend across every
+  # provider, not just vibe. Token-level fields are zero for providers
+  # that don't surface them — the report tolerates missing data.
+  local _ai_start_ts _ai_exit _ai_end_ts _ai_dur _ai_prompt_words
+  _ai_start_ts=$(date +%s)
+  _ai_prompt_words=$(printf '%s' "$prompt" | wc -w | tr -d ' ')
+  _ai_exit=0
   case "$tool" in
     cl | claude)
-      printf "%s" "$full_prompt" | claude
+      printf "%s" "$full_prompt" | claude || _ai_exit=$?
       ;;
     codex)
-      printf "%s" "$full_prompt" | codex
+      printf "%s" "$full_prompt" | codex || _ai_exit=$?
       ;;
     copilot)
-      copilot -sp "$full_prompt"
+      copilot -sp "$full_prompt" || _ai_exit=$?
       ;;
     gemini)
-      printf "%s" "$full_prompt" | gemini chat
+      printf "%s" "$full_prompt" | gemini chat || _ai_exit=$?
       ;;
     goose)
-      printf "%s" "$full_prompt" | goose session start
+      printf "%s" "$full_prompt" | goose session start || _ai_exit=$?
       ;;
     kiro | kiro-cli)
-      printf "%s" "$full_prompt" | kiro-cli chat
+      printf "%s" "$full_prompt" | kiro-cli chat || _ai_exit=$?
       ;;
     sgpt)
-      printf "%s" "$full_prompt" | sgpt --chat shell-gpt
+      printf "%s" "$full_prompt" | sgpt --chat shell-gpt || _ai_exit=$?
       ;;
     ollama)
-      printf "%s" "$full_prompt" | ollama run llama3.2
+      printf "%s" "$full_prompt" | ollama run llama3.2 || _ai_exit=$?
       ;;
     opencode)
-      printf "%s" "$full_prompt" | opencode query
+      printf "%s" "$full_prompt" | opencode query || _ai_exit=$?
       ;;
     aider)
-      printf "%s" "$full_prompt" | aider --msg "-"
+      printf "%s" "$full_prompt" | aider --msg "-" || _ai_exit=$?
       ;;
     autohand)
-      printf "%s" "$full_prompt" | autohand chat
+      printf "%s" "$full_prompt" | autohand chat || _ai_exit=$?
       ;;
     vibe)
-      printf "%s" "$full_prompt" | vibe chat
+      printf "%s" "$full_prompt" | vibe chat || _ai_exit=$?
       ;;
     qwen)
-      printf "%s" "$full_prompt" | qwen chat
+      printf "%s" "$full_prompt" | qwen chat || _ai_exit=$?
       ;;
     zai)
-      printf "%s" "$full_prompt" | zai chat
+      printf "%s" "$full_prompt" | zai chat || _ai_exit=$?
       ;;
     *)
       ui_err "Unsupported tool" "$tool"
       exit 1
       ;;
   esac
+  _ai_end_ts=$(date +%s)
+  _ai_dur=$((_ai_end_ts - _ai_start_ts))
+  _ai_log_run "$tool_bin" "$_ai_exit" "$_ai_dur" "$_ai_prompt_words" 2>/dev/null || true
+  return "$_ai_exit"
 }
 
 # Dispatch
 case "${1:-}" in
   ai)
     shift
-    cmd_ai_status "$@"
+    # Subcommands first: `dot ai delegate`, `dot ai cost`. Fall through
+    # to status if no subcommand or unknown one.
+    case "${1:-}" in
+      delegate)
+        shift
+        cmd_ai_delegate "$@"
+        ;;
+      cost)
+        shift
+        cmd_ai_cost "$@"
+        ;;
+      "" | status)
+        cmd_ai_status "$@"
+        ;;
+      *)
+        cmd_ai_status "$@"
+        ;;
+    esac
     ;;
   ai-setup)
     shift

package/scripts/dot/commands/appearance.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Appearance" "${1:-}"
 

package/scripts/dot/commands/core.sh

@@ -26,8 +26,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 if [[ "${1:-}" != "cd" ]]; then
   dot_ui_command_banner "Core" "${1:-}"

package/scripts/dot/commands/diagnostics.sh

@@ -7,8 +7,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Diagnostics" "${1:-}" "$@"
 
@@ -29,7 +29,7 @@ cmd_smoke_test() {
 }
 
 cmd_intelligence() {
-  run_script "scripts/dot/lib/bento.sh" "Intelligence Surface" "$@"
+  run_script "lib/dot/bento.sh" "Intelligence Surface" "$@"
 }
 
 cmd_heal() {
@@ -120,9 +120,9 @@ cmd_metrics() {
     echo "Dotfiles source not found." >&2
     exit 1
   fi
-  # shellcheck source=../lib/log.sh
+  # shellcheck source=../../../lib/dot/log.sh
   # shellcheck disable=SC1091
-  source "$src_dir/scripts/dot/lib/log.sh"
+  source "$src_dir/lib/dot/log.sh"
   ui_header "Recent Metrics"
   echo ""
   dot_metrics_summary "${1:-20}"

package/scripts/dot/commands/env-emit.sh

@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# `dot env emit` — render a portable workstation-environment
+# manifest. The output is the canonical "what is installed on this
+# machine + at what version + from which source" record that
+# downstream tooling (CycloneDX SBOM aggregators, AgentSpec /
+# AAIF agents, EU CRA compliance reports) consumes.
+#
+# v1 schema at docs/schema/dot-env-v1.json. Conforming to a fixed
+# schema lets us re-render this manifest into any downstream format
+# (AGENTS.md, devcontainer-feature.json, Brewfile, mise.toml) from
+# a single source of truth — see docs/operations/MANIFEST.md.
+#
+# Usage:
+#   dot env emit                       # default: json
+#   dot env emit --format json
+#   dot env emit --output env.json
+#   dot env emit --pretty              # default; --compact for one-line
+#
+# Exit codes:
+#   0  manifest written / printed
+#   1  bad usage
+#   2  jq or mise missing
+#   3  mise call failed
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+dot_env_emit() {
+  local format="json"
+  local output=""
+  local pretty=1
+
+  while (($#)); do
+    case "$1" in
+      --format)
+        format="${2:-}"
+        shift 2 || {
+          ui_err "--format needs a value"
+          return 1
+        }
+        ;;
+      --format=*)
+        format="${1#*=}"
+        shift
+        ;;
+      --output | -o)
+        output="${2:-}"
+        shift 2 || {
+          ui_err "--output needs a value"
+          return 1
+        }
+        ;;
+      --output=*)
+        output="${1#*=}"
+        shift
+        ;;
+      --pretty)
+        pretty=1
+        shift
+        ;;
+      --compact)
+        pretty=0
+        shift
+        ;;
+      -h | --help)
+        cat <<-EOF
+	Usage: dot env emit [--format <fmt>] [--output <path>] [--pretty|--compact]
+
+	  Render the workstation-environment manifest (v1 schema).
+
+	Formats:
+	  json     (default) v1 canonical form per docs/schema/dot-env-v1.json
+	  ndjson   one JSON object per tool — easier to grep / pipe
+
+	Output:
+	  --output FILE   write to FILE (atomic mktemp + mv)
+	  default         stdout
+
+	Examples:
+	  dot env emit                     # print to stdout
+	  dot env emit --output env.json   # write atomically
+	  dot env emit --format ndjson | grep '^{"name":"node"'
+	EOF
+        return 0
+        ;;
+      *)
+        ui_err "unknown flag: $1"
+        return 1
+        ;;
+    esac
+  done
+
+  case "$format" in
+    json | ndjson) ;;
+    *)
+      ui_err "unsupported format: $format (json, ndjson)"
+      return 1
+      ;;
+  esac
+
+  has_command jq || {
+    ui_err "jq required (brew install jq / apt install jq)"
+    return 2
+  }
+  has_command mise || {
+    ui_err "mise required (the manifest's source of truth)"
+    return 2
+  }
+
+  local mise_raw
+  mise_raw="$(mise ls --json 2>/dev/null)" || {
+    ui_err "mise ls --json failed"
+    return 3
+  }
+
+  # Static fields we want in every manifest: schema version + emit
+  # timestamp + emitter version + repo URL + the host fingerprint
+  # bits chezmoi already records (os, machine).
+  local emitter_version
+  emitter_version="$(grep -E '^dotfiles_version[[:space:]]*=' \
+    "$(resolve_chezmoi_source_dir)/.chezmoidata.toml" 2>/dev/null |
+    head -1 | sed -E 's/.*"([^"]+)".*/\1/' || echo "unknown")"
+  local timestamp
+  timestamp="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  local os_type machine_arch
+  os_type="$(uname -s 2>/dev/null || echo unknown)"
+  machine_arch="$(uname -m 2>/dev/null || echo unknown)"
+  local hostname
+  hostname="$(uname -n 2>/dev/null || echo unknown)"
+
+  # Build the manifest. jq does the heavy lifting: take the raw
+  # `mise ls --json` shape (an object keyed by tool name → array of
+  # installed versions) and flatten to a normalised array of tool
+  # records. Each record carries: name, version, source (config
+  # file or "orphan"), requested (semver/range/latest spec), and
+  # install_path (auditable absolute path).
+  local body
+  body="$(printf '%s' "$mise_raw" | jq --arg ev "$emitter_version" \
+    --arg ts "$timestamp" \
+    --arg os "$os_type" \
+    --arg arch "$machine_arch" \
+    --arg host "$hostname" '
+      {
+        schema_version: "https://sebastienrousseau.github.io/dotfiles/schema/dot-env-v1.json",
+        manifest_version: "1.0.0",
+        emitted_at: $ts,
+        emitter: {
+          name: "dot env emit",
+          version: $ev,
+          repo: "github.com/sebastienrousseau/dotfiles"
+        },
+        host: {
+          hostname: $host,
+          os: $os,
+          arch: $arch
+        },
+        tools: [
+          to_entries[] as $t
+          | $t.value[]
+          | {
+              name: $t.key,
+              version: (.version // null),
+              source: (.source.path // "orphan"),
+              source_type: (.source.type // null),
+              requested_version: (.requested_version // null),
+              install_path: (.install_path // null),
+              active: (.active // false)
+            }
+        ]
+      }
+    ')"
+
+  local rendered
+  if [[ "$format" == "ndjson" ]]; then
+    # NDJSON: header object on line 1, one tool per subsequent line.
+    rendered="$(
+      printf '%s' "$body" |
+        jq -c '
+        ({schema_version, manifest_version, emitted_at, emitter, host}),
+        (.tools[])'
+    )"
+  elif ((pretty)); then
+    rendered="$(printf '%s' "$body" | jq '.')"
+  else
+    rendered="$(printf '%s' "$body" | jq -c '.')"
+  fi
+
+  if [[ -n "$output" ]]; then
+    local tmp
+    tmp="$(mktemp "${output}.XXXXXX")"
+    printf '%s\n' "$rendered" >|"$tmp"
+    mv "$tmp" "$output"
+    ui_ok "manifest" "wrote $(printf '%s' "$rendered" | jq -r '.tools | length' 2>/dev/null || echo '?') tools → $output"
+  else
+    printf '%s\n' "$rendered"
+  fi
+}

package/scripts/dot/commands/fleet.sh

@@ -6,10 +6,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-# shellcheck source=../lib/log.sh
-source "$SCRIPT_DIR/../lib/log.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/log.sh
+source "$SCRIPT_DIR/../../../lib/dot/log.sh"
 
 dot_ui_command_banner "Fleet" "${1:-}"
 
@@ -18,7 +18,7 @@ _FLEET_EVENTS_FILE="$_FLEET_STATE_DIR/events.jsonl"
 
 _fleet_enabled() {
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]] && grep -q '^enabled = true' "$data_file" 2>/dev/null; then
     return 0
   fi
@@ -27,7 +27,7 @@ _fleet_enabled() {
 
 _fleet_node_id() {
   local data_file node_id=""
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     node_id="$(sed -n 's/^node_id = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -39,7 +39,7 @@ _fleet_node_id() {
 
 _fleet_namespace() {
   local data_file ns=""
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     ns="$(sed -n 's/^namespace = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -67,7 +67,7 @@ _fleet_emit_event() {
   # Forward to endpoint if configured
   local endpoint=""
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     endpoint="$(sed -n 's/^endpoint = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -271,7 +271,7 @@ cmd_fleet_namespace() {
       ui_ok "Active" "$ns"
 
       local data_file
-      data_file="$(resolve_source_dir)/.chezmoidata.toml"
+      data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
       if [[ -f "$data_file" ]]; then
         echo ""
         ui_section "Available Namespaces"
@@ -289,7 +289,7 @@ cmd_fleet_namespace() {
       [[ -n "$new_ns" ]] || die "Usage: dot fleet namespace set <name>"
       validate_name "$new_ns" "namespace"
       local data_file
-      data_file="$(resolve_source_dir)/.chezmoidata.toml"
+      data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
       if grep -q "^namespace = " "$data_file" 2>/dev/null; then
         # Atomic write: render into a tempfile + mv so concurrent
         # `dot fleet namespace set` callers can't corrupt the TOML.
@@ -322,7 +322,8 @@ cmd_fleet_enforce() {
   shift || true
 
   local repo_root
-  repo_root="$(resolve_source_dir)"
+  repo_root="$(resolve_chezmoi_source_dir)"
+  [[ -z "$repo_root" ]] && repo_root="$(resolve_source_dir)"
   local profiles_file="$repo_root/dot_config/dotfiles/agent-profiles.json"
 
   case "$subcommand" in

package/scripts/dot/commands/init.sh

@@ -25,10 +25,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/ui.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/ui.sh"
-# shellcheck source=../lib/utils.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+# shellcheck source=../../../lib/dot/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 _init_resolve_url() {
   local arg="$1"

package/scripts/dot/commands/lint.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Lint" "${1:-}"
 
@@ -34,6 +34,11 @@ cmd_lint() {
     files+=("$src_dir/install.sh")
   fi
 
+  # Post-Phase-4b chezmoi-tracked content lives under defaults/.
+  local chezmoi_src
+  chezmoi_src="$(resolve_chezmoi_source_dir)"
+  [[ -z "$chezmoi_src" ]] && chezmoi_src="$src_dir"
+
   # dot_local/bin/executable_* scripts (shell scripts only)
   while IFS= read -r -d '' f; do
     if file "$f" 2>/dev/null | grep -qiE 'shell|bash|sh'; then
@@ -41,12 +46,12 @@ cmd_lint() {
     elif head -1 "$f" 2>/dev/null | grep -qE '^#!.*(bash|sh)'; then
       files+=("$f")
     fi
-  done < <(find "$src_dir/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
+  done < <(find "$chezmoi_src/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
 
   # .chezmoitemplates/*.sh (non-.tmpl shell scripts)
   while IFS= read -r -d '' f; do
     files+=("$f")
-  done < <(find "$src_dir/.chezmoitemplates" -name '*.sh' -type f -print0 2>/dev/null)
+  done < <(find "$chezmoi_src/.chezmoitemplates" -name '*.sh' -type f -print0 2>/dev/null)
 
   local total=${#files[@]}
   if [[ "$total" -eq 0 ]]; then

package/scripts/dot/commands/manual.sh

@@ -16,8 +16,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 MANUAL_URL="${DOTFILES_MANUAL_URL:-https://sebastienrousseau.github.io/dotfiles/manual}"
 CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/dotfiles/manual"
@@ -66,7 +66,7 @@ resolve_source() {
       echo "$src_dir/$fname"
       return 0
     fi
-    ui_err "manual" "local build not found at $src_dir/$fname — run bash scripts/docs/build-manual.sh"
+    ui_err "manual" "local build not found at $src_dir/$fname — run bash tools/docs/build-manual.sh"
     return 1
   fi