@sebastienrousseau/dotfiles 0.2.502 → 0.2.504

package/scripts/dot/commands/env-emit.sh

@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# `dot env emit` — render a portable workstation-environment
+# manifest. The output is the canonical "what is installed on this
+# machine + at what version + from which source" record that
+# downstream tooling (CycloneDX SBOM aggregators, AgentSpec /
+# AAIF agents, EU CRA compliance reports) consumes.
+#
+# v1 schema at docs/schema/dot-env-v1.json. Conforming to a fixed
+# schema lets us re-render this manifest into any downstream format
+# (AGENTS.md, devcontainer-feature.json, Brewfile, mise.toml) from
+# a single source of truth — see docs/operations/MANIFEST.md.
+#
+# Usage:
+#   dot env emit                       # default: json
+#   dot env emit --format json
+#   dot env emit --output env.json
+#   dot env emit --pretty              # default; --compact for one-line
+#
+# Exit codes:
+#   0  manifest written / printed
+#   1  bad usage
+#   2  jq or mise missing
+#   3  mise call failed
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+dot_env_emit() {
+  local format="json"
+  local output=""
+  local pretty=1
+
+  while (($#)); do
+    case "$1" in
+      --format)
+        format="${2:-}"
+        shift 2 || {
+          ui_err "--format needs a value"
+          return 1
+        }
+        ;;
+      --format=*)
+        format="${1#*=}"
+        shift
+        ;;
+      --output | -o)
+        output="${2:-}"
+        shift 2 || {
+          ui_err "--output needs a value"
+          return 1
+        }
+        ;;
+      --output=*)
+        output="${1#*=}"
+        shift
+        ;;
+      --pretty)
+        pretty=1
+        shift
+        ;;
+      --compact)
+        pretty=0
+        shift
+        ;;
+      -h | --help)
+        cat <<-EOF
+	Usage: dot env emit [--format <fmt>] [--output <path>] [--pretty|--compact]
+
+	  Render the workstation-environment manifest (v1 schema).
+
+	Formats:
+	  json     (default) v1 canonical form per docs/schema/dot-env-v1.json
+	  ndjson   one JSON object per tool — easier to grep / pipe
+
+	Output:
+	  --output FILE   write to FILE (atomic mktemp + mv)
+	  default         stdout
+
+	Examples:
+	  dot env emit                     # print to stdout
+	  dot env emit --output env.json   # write atomically
+	  dot env emit --format ndjson | grep '^{"name":"node"'
+	EOF
+        return 0
+        ;;
+      *)
+        ui_err "unknown flag: $1"
+        return 1
+        ;;
+    esac
+  done
+
+  case "$format" in
+    json | ndjson) ;;
+    *)
+      ui_err "unsupported format: $format (json, ndjson)"
+      return 1
+      ;;
+  esac
+
+  has_command jq || {
+    ui_err "jq required (brew install jq / apt install jq)"
+    return 2
+  }
+  has_command mise || {
+    ui_err "mise required (the manifest's source of truth)"
+    return 2
+  }
+
+  local mise_raw
+  mise_raw="$(mise ls --json 2>/dev/null)" || {
+    ui_err "mise ls --json failed"
+    return 3
+  }
+
+  # Static fields we want in every manifest: schema version + emit
+  # timestamp + emitter version + repo URL + the host fingerprint
+  # bits chezmoi already records (os, machine).
+  local emitter_version
+  emitter_version="$(grep -E '^dotfiles_version[[:space:]]*=' \
+    "$(resolve_chezmoi_source_dir)/.chezmoidata.toml" 2>/dev/null |
+    head -1 | sed -E 's/.*"([^"]+)".*/\1/' || echo "unknown")"
+  local timestamp
+  timestamp="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  local os_type machine_arch
+  os_type="$(uname -s 2>/dev/null || echo unknown)"
+  machine_arch="$(uname -m 2>/dev/null || echo unknown)"
+  local hostname
+  hostname="$(uname -n 2>/dev/null || echo unknown)"
+
+  # Build the manifest. jq does the heavy lifting: take the raw
+  # `mise ls --json` shape (an object keyed by tool name → array of
+  # installed versions) and flatten to a normalised array of tool
+  # records. Each record carries: name, version, source (config
+  # file or "orphan"), requested (semver/range/latest spec), and
+  # install_path (auditable absolute path).
+  local body
+  body="$(printf '%s' "$mise_raw" | jq --arg ev "$emitter_version" \
+    --arg ts "$timestamp" \
+    --arg os "$os_type" \
+    --arg arch "$machine_arch" \
+    --arg host "$hostname" '
+      {
+        schema_version: "https://sebastienrousseau.github.io/dotfiles/schema/dot-env-v1.json",
+        manifest_version: "1.0.0",
+        emitted_at: $ts,
+        emitter: {
+          name: "dot env emit",
+          version: $ev,
+          repo: "github.com/sebastienrousseau/dotfiles"
+        },
+        host: {
+          hostname: $host,
+          os: $os,
+          arch: $arch
+        },
+        tools: [
+          to_entries[] as $t
+          | $t.value[]
+          | {
+              name: $t.key,
+              version: (.version // null),
+              source: (.source.path // "orphan"),
+              source_type: (.source.type // null),
+              requested_version: (.requested_version // null),
+              install_path: (.install_path // null),
+              active: (.active // false)
+            }
+        ]
+      }
+    ')"
+
+  local rendered
+  if [[ "$format" == "ndjson" ]]; then
+    # NDJSON: header object on line 1, one tool per subsequent line.
+    rendered="$(
+      printf '%s' "$body" |
+        jq -c '
+        ({schema_version, manifest_version, emitted_at, emitter, host}),
+        (.tools[])'
+    )"
+  elif ((pretty)); then
+    rendered="$(printf '%s' "$body" | jq '.')"
+  else
+    rendered="$(printf '%s' "$body" | jq -c '.')"
+  fi
+
+  if [[ -n "$output" ]]; then
+    local tmp
+    tmp="$(mktemp "${output}.XXXXXX")"
+    printf '%s\n' "$rendered" >|"$tmp"
+    mv "$tmp" "$output"
+    ui_ok "manifest" "wrote $(printf '%s' "$rendered" | jq -r '.tools | length' 2>/dev/null || echo '?') tools → $output"
+  else
+    printf '%s\n' "$rendered"
+  fi
+}

package/scripts/dot/commands/fleet.sh

@@ -6,10 +6,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-# shellcheck source=../lib/log.sh
-source "$SCRIPT_DIR/../lib/log.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/log.sh
+source "$SCRIPT_DIR/../../../lib/dot/log.sh"
 
 dot_ui_command_banner "Fleet" "${1:-}"
 
@@ -18,7 +18,7 @@ _FLEET_EVENTS_FILE="$_FLEET_STATE_DIR/events.jsonl"
 
 _fleet_enabled() {
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]] && grep -q '^enabled = true' "$data_file" 2>/dev/null; then
     return 0
   fi
@@ -27,7 +27,7 @@ _fleet_enabled() {
 
 _fleet_node_id() {
   local data_file node_id=""
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     node_id="$(sed -n 's/^node_id = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -39,7 +39,7 @@ _fleet_node_id() {
 
 _fleet_namespace() {
   local data_file ns=""
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     ns="$(sed -n 's/^namespace = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -67,7 +67,7 @@ _fleet_emit_event() {
   # Forward to endpoint if configured
   local endpoint=""
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ -f "$data_file" ]]; then
     endpoint="$(sed -n 's/^endpoint = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
@@ -271,7 +271,7 @@ cmd_fleet_namespace() {
       ui_ok "Active" "$ns"
 
       local data_file
-      data_file="$(resolve_source_dir)/.chezmoidata.toml"
+      data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
       if [[ -f "$data_file" ]]; then
         echo ""
         ui_section "Available Namespaces"
@@ -289,7 +289,7 @@ cmd_fleet_namespace() {
       [[ -n "$new_ns" ]] || die "Usage: dot fleet namespace set <name>"
       validate_name "$new_ns" "namespace"
       local data_file
-      data_file="$(resolve_source_dir)/.chezmoidata.toml"
+      data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
       if grep -q "^namespace = " "$data_file" 2>/dev/null; then
         # Atomic write: render into a tempfile + mv so concurrent
         # `dot fleet namespace set` callers can't corrupt the TOML.
@@ -322,7 +322,8 @@ cmd_fleet_enforce() {
   shift || true
 
   local repo_root
-  repo_root="$(resolve_source_dir)"
+  repo_root="$(resolve_chezmoi_source_dir)"
+  [[ -z "$repo_root" ]] && repo_root="$(resolve_source_dir)"
   local profiles_file="$repo_root/dot_config/dotfiles/agent-profiles.json"
 
   case "$subcommand" in
@@ -582,16 +583,21 @@ EOF
     fi
   }
 
-  local running=0
+  # Throttle to `jobs` concurrent workers. `wait -n` (wait for the next
+  # job to finish) is bash 4.3+, but macOS ships bash 3.2 — there it
+  # silently fails and the throttle collapses to unbounded parallelism.
+  # Track PIDs and block on the oldest when at capacity instead; works on
+  # bash 3.2 and 4+ alike.
+  local _pids=()
   while IFS=$'\t' read -r name ssh profile; do
     [[ -n "$name" && -n "$ssh" ]] || continue
     total=$((total + 1))
-    while ((running >= jobs)); do
-      wait -n 2>/dev/null || break
-      running=$((running - 1))
+    while ((${#_pids[@]} >= jobs)); do
+      wait "${_pids[0]}" 2>/dev/null || true
+      _pids=("${_pids[@]:1}")
     done
     _fleet_apply_one "$name" "$ssh" "$effective_cmd" "$tmpdir" &
-    running=$((running + 1))
+    _pids+=("$!")
   done <<<"$entries"
   wait
 

package/scripts/dot/commands/init.sh

@@ -25,10 +25,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/ui.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/ui.sh"
-# shellcheck source=../lib/utils.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+# shellcheck source=../../../lib/dot/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 _init_resolve_url() {
   local arg="$1"

package/scripts/dot/commands/lint.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Lint" "${1:-}"
 
@@ -34,6 +34,11 @@ cmd_lint() {
     files+=("$src_dir/install.sh")
   fi
 
+  # Post-Phase-4b chezmoi-tracked content lives under defaults/.
+  local chezmoi_src
+  chezmoi_src="$(resolve_chezmoi_source_dir)"
+  [[ -z "$chezmoi_src" ]] && chezmoi_src="$src_dir"
+
   # dot_local/bin/executable_* scripts (shell scripts only)
   while IFS= read -r -d '' f; do
     if file "$f" 2>/dev/null | grep -qiE 'shell|bash|sh'; then
@@ -41,12 +46,12 @@ cmd_lint() {
     elif head -1 "$f" 2>/dev/null | grep -qE '^#!.*(bash|sh)'; then
       files+=("$f")
     fi
-  done < <(find "$src_dir/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
+  done < <(find "$chezmoi_src/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
 
   # .chezmoitemplates/*.sh (non-.tmpl shell scripts)
   while IFS= read -r -d '' f; do
     files+=("$f")
-  done < <(find "$src_dir/.chezmoitemplates" -name '*.sh' -type f -print0 2>/dev/null)
+  done < <(find "$chezmoi_src/.chezmoitemplates" -name '*.sh' -type f -print0 2>/dev/null)
 
   local total=${#files[@]}
   if [[ "$total" -eq 0 ]]; then

package/scripts/dot/commands/manual.sh

@@ -16,8 +16,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 MANUAL_URL="${DOTFILES_MANUAL_URL:-https://sebastienrousseau.github.io/dotfiles/manual}"
 CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/dotfiles/manual"
@@ -66,7 +66,7 @@ resolve_source() {
       echo "$src_dir/$fname"
       return 0
     fi
-    ui_err "manual" "local build not found at $src_dir/$fname — run bash scripts/docs/build-manual.sh"
+    ui_err "manual" "local build not found at $src_dir/$fname — run bash tools/docs/build-manual.sh"
     return 1
   fi
 

package/scripts/dot/commands/meta.sh

@@ -6,10 +6,10 @@
 set -euo pipefail
 
 _META_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$_META_DIR/../lib/utils.sh"
-# shellcheck source=../lib/log.sh
-source "$_META_DIR/../lib/log.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$_META_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/log.sh
+source "$_META_DIR/../../../lib/dot/log.sh"
 # shellcheck source=agent.sh
 source "$_META_DIR/agent.sh"
 
@@ -92,7 +92,12 @@ cmd_docs() {
 
 cmd_learn() {
   local dot_bin
-  dot_bin="$(dirname "${BASH_SOURCE[0]}")/../../../dot_local/bin"
+  # Post-Phase-4b: dot_local/ lives under defaults/. Legacy layout
+  # (older deployments before .chezmoiroot activation) kept it at
+  # repo root — probe both.
+  dot_bin="$(dirname "${BASH_SOURCE[0]}")/../../../defaults/dot_local/bin"
+  [[ -f "$dot_bin/executable_tour" ]] ||
+    dot_bin="$(dirname "${BASH_SOURCE[0]}")/../../../dot_local/bin"
   if [ -f "$dot_bin/executable_tour" ]; then
     exec bash "$dot_bin/executable_tour" "$@"
   fi
@@ -176,7 +181,8 @@ cmd_mcp() {
       ;;
     registry)
       local repo_root registry_file json_mode=0
-      repo_root="$(require_source_dir)"
+      repo_root="$(resolve_chezmoi_source_dir)"
+      [[ -z "$repo_root" ]] && repo_root="$(require_source_dir)"
       registry_file="${MCP_REGISTRY_CONFIG:-$repo_root/dot_config/dotfiles/mcp-registry.json}"
       if [[ "${1:-}" == "registry" ]]; then
         shift || true

package/scripts/dot/commands/patterns.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 PATTERN_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/ai/patterns"
 mkdir -p "$PATTERN_DIR"

package/scripts/dot/commands/registry.sh

@@ -43,10 +43,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/ui.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/ui.sh"
-# shellcheck source=../lib/utils.sh disable=SC1091
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+# shellcheck source=../../../lib/dot/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 _registry_default_url() {
   printf '%s\n' "https://sebastienrousseau.github.io/dotfiles/registry.json"

package/scripts/dot/commands/restore.sh

@@ -6,10 +6,10 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-# shellcheck source=../lib/log.sh
-source "$SCRIPT_DIR/../lib/log.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/log.sh
+source "$SCRIPT_DIR/../../../lib/dot/log.sh"
 
 DOTFILES_DIR="${DOTFILES_DIR:-$HOME/.dotfiles}"
 BACKUP_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles/backups"

package/scripts/dot/commands/secrets.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 # shellcheck source=../../lib/secrets_provider.sh
 source "$SCRIPT_DIR/../../lib/secrets_provider.sh"
 
@@ -15,7 +15,8 @@ dot_ui_command_banner "Secrets" "${1:-}"
 
 dot_data_file() {
   local src_dir
-  src_dir="$(require_source_dir)"
+  src_dir="$(resolve_chezmoi_source_dir)"
+  [[ -z "$src_dir" ]] && src_dir="$(require_source_dir)"
   printf "%s\n" "$src_dir/.chezmoidata.toml"
 }
 

package/scripts/dot/commands/security.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Security" "${1:-}"
 

package/scripts/dot/commands/tools.sh

@@ -6,8 +6,8 @@
 set -euo pipefail
 
 _TOOLS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$_TOOLS_DIR/../lib/utils.sh"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$_TOOLS_DIR/../../../lib/dot/utils.sh"
 # shellcheck source=aliases.sh
 source "$_TOOLS_DIR/aliases.sh"
 
@@ -348,6 +348,16 @@ cmd_log_rotate() {
 }
 
 cmd_env_mise() {
+  # `dot env emit` is a separate sub-handler — it doesn't need mise
+  # at command-time, only when actually invoked (the script checks).
+  if [[ "${1:-}" == "emit" ]]; then
+    shift
+    # shellcheck source=./env-emit.sh
+    source "$(require_source_dir)/scripts/dot/commands/env-emit.sh"
+    dot_env_emit "$@"
+    return $?
+  fi
+
   if ! has_command mise; then
     ui_err "mise not installed (required for dot env)"
     exit 1
@@ -425,7 +435,7 @@ cmd_env_mise() {
 
 cmd_profile() {
   local data_file
-  data_file="$(resolve_source_dir)/.chezmoidata.toml"
+  data_file="$(resolve_chezmoi_source_dir)/.chezmoidata.toml"
   if [[ ! -f "$data_file" ]]; then
     die ".chezmoidata.toml not found"
   fi