@sebastienrousseau/dotfiles 0.2.502 → 0.2.504

package/scripts/version-sync.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -16,16 +16,72 @@ VERSION_PATTERN='[0-9]+\.[0-9]+\.[0-9]+'
 SED_VERSION_PATTERN='[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*'
 BACKUP_DIR="$PROJECT_ROOT/.version-sync-backup"
 EXCLUDE_FILES=(
+  # Historical / referential docs — version refs inside are intentional
+  # pointers at prior versions, not "this is the current version" claims.
   "CHANGELOG.md"
   "docs/security/COMPLIANCE.md"
   "docs/reference/FONTS.md"
   "docs/archive/LEGACY_ROADMAP.md"
   "docs/archive/PLAN.md"
+
+  # Roadmap + audit narratives — describe per-version work; refs to
+  # prior versions are intentional and historical.
+  "docs/operations/ROADMAP_V0_2_503.md"
+  "docs/operations/VERSION_SYNC.md"
+  "docs/operations/RFC_v0_2_503_reorganization.md"
+  "docs/operations/HARD_AUDIT_2026.md"
+  "docs/reference/ALIASES_DEPRECATIONS.md"
+
+  # Security docs — INSTALL_VERIFICATION + CI_PINNING + SCORECARD
+  # carry per-release hash tables / closed-cycle logs. The "current"
+  # version inside these is tracked by hand, not by version-sync.
+  "docs/security/CI_PINNING.md"
+  "docs/security/INSTALL_VERIFICATION.md"
+  "docs/security/SCORECARD.md"
+
+  # Release-verification recipes use an example pinned tag
+  # that intentionally stays at a known-published release.
+  "docs/security/VERIFY_RELEASE.md"
+
+  # Example bundles — version refs in README'd examples are illustrative.
+  "examples/mise-plugin-dot/README.md"
+
+  # MANIFEST + MIGRATION docs — describe per-version manifests &
+  # cross-version migration paths; intentional references to other tags.
+  "docs/operations/MANIFEST.md"
+  "docs/operations/MIGRATION.md"
+
+  # ADR + architecture + manual + operations narratives — every
+  # version reference inside is dated context, not a "current version"
+  # claim. The single source-of-truth is .chezmoidata.toml (plus
+  # README, package.json — which version-sync DOES rewrite).
+  "docs/adr/ADR-007-multi-shell-parity.md"
+  "docs/architecture/REPO_LAYOUT.md"
+  "docs/manual/01-concepts/04-fleet.md"
+  "docs/manual/01-concepts/05-self-healing.md"
+  "docs/manual/02-tutorials/05-deploy-fleet.md"
+  "docs/manual/05-appendices/D-bibliography.md"
+  "docs/operations/MAINTENANCE.md"
+
+  # Release-process / structural docs that reference *historical* dotfiles
+  # versions (the repo reorg, past release tags, migration scenarios).
+  # Bumping these each release would corrupt accurate history.
+  "docs/operations/RELEASE_PIPELINE.md"
+  "docs/operations/TESTING.md"
+  "docs/STRUCTURE.md"
+  "install/migrate/README.md"
+  "install/README.md"
+  "tools/README.md"
+  "defaults/README.md"
+
+  # CI_COMPOSITES.md cites third-party action versions (e.g. v5.0.5),
+  # not dotfiles_version. False-positive pattern match.
+  "docs/operations/CI_COMPOSITES.md"
 )
 
-# shellcheck source=dot/lib/ui.sh
+# shellcheck source=../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 ui_init
 
 # Functions — delegate to shared ui.sh (redirect to stderr for script output)
@@ -109,9 +165,14 @@ find_version_files() {
 
   log_info "Scanning for markdown files with version references..."
 
-  # Find all markdown files with version patterns
+  # Find all markdown files with version patterns.
+  # The "." path is required: with no path and a non-TTY stdin (CI, pipes,
+  # background jobs) rg reads from stdin instead of searching the tree, so
+  # the whole script hangs forever. The `sed` strips rg's leading "./" so
+  # the paths match the EXCLUDE_FILES entries (which have no "./"),
+  # otherwise excluded historical docs get rewritten.
   cd "$PROJECT_ROOT"
-  rg -l "v?$VERSION_PATTERN" --type md >"$temp_file" 2>/dev/null || true
+  rg -l "v?$VERSION_PATTERN" --type md . 2>/dev/null | sed 's|^\./||' >"$temp_file" || true
 
   # Add known files that should be checked even if they don't have versions yet
   echo "README.md" >>"$temp_file"
@@ -398,21 +459,24 @@ main() {
     create_backup "${version_files[@]}"
   fi
 
-  # Sync chezmoidata.toml (single source of truth for template files)
-  local chezmoidata="$PROJECT_ROOT/.chezmoidata.toml"
+  # Sync chezmoidata.toml (single source of truth for template files).
+  # Post-Phase-4b lives under defaults/ — kept old root location as a
+  # fallback so this script is forward- and backward-compatible.
+  local chezmoidata="$PROJECT_ROOT/defaults/.chezmoidata.toml"
+  [[ -f "$chezmoidata" ]] || chezmoidata="$PROJECT_ROOT/.chezmoidata.toml"
   if [[ -f "$chezmoidata" ]]; then
     if [[ "$dry_run" == "true" ]]; then
-      log_info "Would update .chezmoidata.toml: dotfiles_version = \"$target_version\""
+      log_info "Would update ${chezmoidata#"$PROJECT_ROOT/"}: dotfiles_version = \"$target_version\""
     else
       sed_in_place "$chezmoidata" \
         "s|^dotfiles_version = \"$SED_VERSION_PATTERN\"|dotfiles_version = \"$target_version\"|"
-      log_success "Updated .chezmoidata.toml"
+      log_success "Updated ${chezmoidata#"$PROJECT_ROOT/"}"
     fi
   fi
 
   # Sync non-template script files that embed the version
   local script_files=(
-    "dot_local/bin/executable_dot"
+    "bin/dot"
     "dot_local/bin/executable_tour"
     "install.sh"
   )

package/dot_config/.module-manifest.json

@@ -1,69 +0,0 @@
-{
-  "$schema": "Module manifest for dot_config/ — logical grouping of flat directories",
-  "groups": {
-    "shell": {
-      "description": "Shell environments and startup",
-      "modules": ["shell", "zsh", "fish", "nushell"]
-    },
-    "terminal": {
-      "description": "Terminal emulators",
-      "modules": ["alacritty", "ghostty", "kitty", "wezterm"]
-    },
-    "editor": {
-      "description": "Text editors and IDEs",
-      "modules": ["nvim", "vscode", "micro", "nano"]
-    },
-    "git": {
-      "description": "Version control",
-      "modules": ["git", "lazygit", "gh"]
-    },
-    "container": {
-      "description": "Containers and orchestration",
-      "modules": ["docker", "containers", "lazydocker", "k9s", "minikube"]
-    },
-    "ai": {
-      "description": "AI tools and assistants",
-      "modules": ["ai", "aider", "claude", "goose"]
-    },
-    "languages": {
-      "description": "Language toolchains",
-      "modules": ["go", "pip", "pypoetry", "gem", "bun", "yarn", "dlv"]
-    },
-    "system": {
-      "description": "System monitoring and management",
-      "modules": ["btop", "htop", "fastfetch", "topgrade", "systemd", "ncdu", "duf"]
-    },
-    "security": {
-      "description": "Security and secrets",
-      "modules": ["gnupg", "sops"]
-    },
-    "network": {
-      "description": "Network and HTTP tools",
-      "modules": ["curl", "wget"]
-    },
-    "data": {
-      "description": "Databases and data tools",
-      "modules": ["redis", "mongosh", "mycli", "ipython"]
-    },
-    "tools": {
-      "description": "CLI utilities",
-      "modules": ["bat", "fzf", "yazi", "just", "mise", "task", "tmux", "pueue", "atuin", "emoji"]
-    },
-    "desktop": {
-      "description": "Desktop environment and appearance",
-      "modules": ["gtk-3.0", "gtk-4.0", "fontconfig", "flatpak", "zellij"]
-    },
-    "macos": {
-      "description": "macOS-specific modules",
-      "modules": ["karabiner", "mas", "duti", "raycast"]
-    },
-    "infra": {
-      "description": "Infrastructure and cloud",
-      "modules": ["ansible", "tflint"]
-    },
-    "dotfiles": {
-      "description": "Dotfiles internal config",
-      "modules": ["dotfiles"]
-    }
-  }
-}

package/dot_config/ai/identity.md

@@ -1,23 +0,0 @@
-# AI Identity & Preferences
-
-## Profile
-
-- **User**:
-- **Role**: Senior Software Engineer / Architect
-- **Expertise**: Rust, TypeScript, Go, DevOps (Nix, Kubernetes), Shell Scripting.
-
-## Coding Style
-
-- **Principles**: Clean code, SOLID, DRY, KISS.
-- **Preferences**:
-  - Prefer TypeScript over JavaScript.
-  - Prefer functional programming patterns where appropriate.
-  - Use Vitest or Jest for testing.
-  - Use Prettier and ESLint for formatting/linting.
-- **Documentation**: Use JSDoc/TSDoc for code and GitHub-flavored Markdown for docs.
-
-## Workspace Context
-
-- **Environment**: Linux (CachyOS/Arch), macOS.
-- **Shells**: Zsh (primary), Fish, Nushell, Bash.
-- **Dotfiles**: Managed by Chezmoi, optimized for performance and security.

package/dot_config/ai/patterns/architect.md

@@ -1,16 +0,0 @@
-# Identity: Dotfiles Architect
-
-You are an expert Shell Infrastructure Architect specializing in the 2026 developer stack.
-
-## Core Directives
-
-- **Subtlety**: Propose changes that integrate seamlessly without adding unnecessary complexity.
-- **Performance**: Prioritize shell startup speed and binary efficiency (e.g., _cached_eval).
-- **Architecture**: Adhere to the modular "rc.d" structure and XDG Base Directory standards.
-- **Tools**: Leverage Mise for runtimes, Nix for declarative environments, and Chezmoi for state management.
-
-## Environment Context
-
-- OS: Arch/CachyOS (optimized for x86-64-v4) or macOS.
-- Shells: Zsh (primary), Fish, Nushell, Bash.
-- Security: Age/SOPS for secrets, GPG signing enforced.

package/dot_config/ai/patterns/hardener.md

@@ -1,15 +0,0 @@
-# Identity: Shell Security Hardener
-
-You are a security engineer specializing in high-compliance Fintech environments and Post-Quantum Cryptography (PQC).
-
-## Core Directives
-
-- **Zero Trust**: Assume all external scripts are compromised until verified.
-- **Encryption**: Enforce Age/SOPS for all sensitive data.
-- **Compliance**: Adhere to 2026 security baselines (GPG signing, SSH certificate authorities).
-- **Privacy**: Disable all non-essential telemetry at the OS and application level.
-
-## Verification Logic
-
-- Every proposal must include a "Verification" step (e.g., dot verify --security).
-- Prioritize hardware enclave (TPM/Secure Enclave) integrations.

package/dot_config/ai/patterns/refactor.md

@@ -1,15 +0,0 @@
-# Identity: POSIX & Shell Optimizer
-
-You are an expert in shell script optimization and POSIX compliance.
-
-## Core Directives
-
-- **Portability**: Ensure scripts work across Zsh, Bash, and Dash unless specifically optimized for a feature shell (like Fish/Nushell).
-- **Indempotency**: Scripts must be safe to run multiple times without side effects.
-- **Linting**: Adhere to ShellCheck best practices and strict error handling (set -euo pipefail).
-- **Latency**: Minimize subshell calls and external binary forks.
-
-## Optimization Strategy
-
-- Use built-in shell features over external commands where possible.
-- Implement caching mechanisms for heavy computations.

package/dot_config/aider/aider.conf.yml

@@ -1,32 +0,0 @@
-# Aider configuration
-# https://aider.chat/docs/config/options.html
-
-# Model settings
-model: claude-opus-4-6
-edit-format: diff
-
-# Git settings
-auto-commits: true
-dirty-commits: false
-attribute-author: true
-attribute-commit-message: true
-
-# UI settings
-dark-mode: true
-pretty: true
-stream: true
-
-# Code settings
-auto-lint: true
-lint-cmd: "npm run lint"
-auto-test: false
-
-# File handling
-gitignore: true
-aiderignore: true
-
-# History
-restore-chat-history: true
-
-# Voice (if enabled)
-# voice-language: en

package/dot_config/alacritty/alacritty.toml.tmpl

@@ -1,55 +0,0 @@
-{{- $fontFamily := default "JetBrainsMono Nerd Font" .terminal_font_family -}}
-{{- $fontSize := default 12 .terminal_font_size -}}
-{{- $t := index .themes (default "big-sur-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end }}
-{{- $tt := $t -}}
-{{- $themeName := default "big-sur-dark" .theme -}}
-{{- if hasSuffix "-light" $themeName -}}
-  {{- $darkTheme := index .themes (printf "%s-dark" (trimSuffix "-light" $themeName)) -}}
-  {{- if $darkTheme -}}{{- $tt = $darkTheme -}}{{- end -}}
-{{- end }}
-[window]
-padding = { x = 16, y = 12 }
-opacity = {{ if eq .chezmoi.os "darwin" }}0.92{{ else }}0.96{{ end }}
-option_as_alt = {{ if eq .chezmoi.os "darwin" }}"Both"{{ else }}"None"{{ end }}
-
-[font]
-size = {{ $fontSize }}
-normal = { family = "{{ $fontFamily }}" }
-{{- if eq .chezmoi.os "darwin" }}
-offset = { x = 0, y = 1 }
-{{- else }}
-offset = { x = 0, y = 0 }
-{{- end }}
-
-[colors.primary]
-background = "{{ $tt.term.bg }}"
-foreground = "{{ $tt.term.fg }}"
-
-[colors.cursor]
-cursor = "{{ $tt.term.cursor }}"
-text = "{{ $tt.term.cursor_text }}"
-
-[colors.selection]
-background = "{{ $tt.term.sel_bg }}"
-text = "{{ $tt.term.sel_fg }}"
-
-[colors.normal]
-black = "{{ $tt.term.c0 }}"
-red = "{{ $tt.term.c1 }}"
-green = "{{ $tt.term.c2 }}"
-yellow = "{{ $tt.term.c3 }}"
-blue = "{{ $tt.term.c4 }}"
-magenta = "{{ $tt.term.c5 }}"
-cyan = "{{ $tt.term.c6 }}"
-white = "{{ $tt.term.c7 }}"
-
-[colors.bright]
-black = "{{ $tt.term.c8 }}"
-red = "{{ $tt.term.c9 }}"
-green = "{{ $tt.term.c10 }}"
-yellow = "{{ $tt.term.c11 }}"
-blue = "{{ $tt.term.c12 }}"
-magenta = "{{ $tt.term.c13 }}"
-cyan = "{{ $tt.term.c14 }}"
-white = "{{ $tt.term.c15 }}"

package/dot_config/ansible/ansible.cfg

@@ -1,11 +0,0 @@
-[defaults]
-inventory = ./inventory
-retry_files_enabled = False
-host_key_checking = False
-stdout_callback = yaml
-nocows = 1
-
-[privilege_escalation]
-become = True
-become_method = sudo
-become_ask_pass = False

package/dot_config/atuin/config.toml.tmpl

@@ -1,47 +0,0 @@
-# Atuin Configuration (~/.config/atuin/config.toml)
-# https://atuin.sh/docs/config
-#
-# This file is templated by chezmoi. The `history_filter` block is sourced
-# from `.chezmoidata/secrets-patterns.toml` (see #872) so the same audited
-# defaults ship to every machine, with per-host extension via
-# `~/.config/chezmoi/chezmoi.toml` → `[data.atuin.history_filter] extra = [...]`.
-
-# Core
-update_check = false
-db_path = "~/.local/share/atuin/history.db"
-key_path = "~/.local/share/atuin/key"
-session_path = "~/.local/share/atuin/session"
-
-# Sync
-auto_sync = true
-sync_frequency = "10m"
-sync_address = "https://api.atuin.sh"
-
-# UI
-style = "compact"
-inline_height = 20
-show_preview = true
-enter_accept = true
-
-# Search
-search_mode = "fuzzy"
-filter_mode = "global"
-workspaces = true
-
-# Privacy: skip commands that may contain secrets.
-# Defaults come from .chezmoidata/secrets-patterns.toml; the `extra` slot
-# in chezmoi.toml allows per-host extension without editing this template.
-history_filter = [
-{{- range .atuin.history_filter.defaults }}
-  {{ . | quote }},
-{{- end }}
-{{- with .atuin.history_filter.extra }}
-{{- range . }}
-  {{ . | quote }},
-{{- end }}
-{{- end }}
-]
-
-# Skip ephemeral directories
-secrets_filter = true
-network_timeout = 30

package/dot_config/bat/config

@@ -1,23 +0,0 @@
-# Bat configuration (dotfiles)
-# See: https://github.com/sharkdp/bat
-
-# Theme
---theme="TwoDark"
-
-# Style
---style="numbers,changes,header,grid"
-
-# Paging
---paging=auto
---pager="less -FR"
-
-# Formatting
---tabs=2
---italic-text=always
-
-# Syntax mappings
---map-syntax "*.conf:INI"
---map-syntax ".gitignore:Git Ignore"
---map-syntax "*.tmpl:Go HTML Template"
---map-syntax "*.kdl:KDL"
---map-syntax ".envrc:Bash"

package/dot_config/brave-flags.conf.tmpl

@@ -1,7 +0,0 @@
-{{- if eq .chezmoi.os "linux" -}}
---enable-gpu-rasterization
---enable-zero-copy
---enable-features=VaapiVideoDecodeLinuxGL,VaapiVideoEncoder,CanvasOopRasterization
---disable-features=UseChromeOSDirectVideoDecoder
---max-old-space-size=4096
-{{- end -}}

package/dot_config/btop/btop.conf

@@ -1,16 +0,0 @@
-# btop configuration
-# Theme files live in ~/.config/btop/themes/
-color_theme = "tokyonight"
-
-# Basic UI preferences
-update_ms = 2000
-proc_sorting = "cpu lazy"
-proc_gradient = true
-net_auto = true
-
-# Hide top-level header when on small screens
-show_cpu_freq = true
-show_gpu_info = false
-
-# Enable mouse support
-mouse = true

package/dot_config/btop/themes/tokyonight.theme

@@ -1,34 +0,0 @@
-# Tokyonight (Night) theme for btop
-# Based on Tokyo Night palette
-
-# Main background
-bg = "#1a1b26"
-# Main text
-fg = "#c0caf5"
-
-# Titles and boxes
-title = "#7aa2f7"
-hi_fg = "#bb9af7"
-
-# Graphs
-selected_bg = "#24283b"
-selected_fg = "#c0caf5"
-
-# CPU
-cpu_box = "#7aa2f7"
-mem_box = "#9ece6a"
-net_box = "#7dcfff"
-proc_box = "#e0af68"
-
-# Graph colors
-cpu_graph = "#7aa2f7"
-mem_graph = "#9ece6a"
-net_graph = "#7dcfff"
-proc_graph = "#e0af68"
-
-# Status
-available = "#9ece6a"
-used = "#e0af68"
-free = "#7dcfff"
-warning = "#e0af68"
-critical = "#f7768e"

package/dot_config/bun/bunfig.toml.tmpl

@@ -1,33 +0,0 @@
-# Bun configuration
-# Managed by chezmoi - edit source at ~/.dotfiles/dot_config/bun/bunfig.toml.tmpl
-# Documentation: https://bun.sh/docs/runtime/bunfig
-
-[install]
-# Use a shared global cache
-globalBinDir = "{{ .chezmoi.homeDir }}/.bun/bin"
-
-# Prefer offline mode when possible
-prefer = "offline"
-
-# Auto-install peer dependencies
-peer = true
-
-# Registry (default)
-registry = "https://registry.npmjs.org/"
-
-# Scoped registries (uncomment and configure as needed)
-# [install.scopes]
-# "@mycompany" = { token = "$NPM_TOKEN", url = "https://npm.mycompany.com/" }
-
-[run]
-# Silence the bun install/update messages during bun run
-silent = false
-
-[test]
-# Test configuration
-coverage = false
-coverageDir = "coverage"
-
-[telemetry]
-# Disable telemetry
-enabled = false

package/dot_config/claude/mcp_servers.json

@@ -1,20 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/anthropics/claude-code/main/schemas/mcp-servers.json",
-  "mcpServers": {
-    "git": {
-      "command": "npx",
-      "args": ["-y", "mcp-server-git@2026.3.0"],
-      "env": {}
-    },
-    "memory": {
-      "command": "npx",
-      "args": ["-y", "@modelcontextprotocol/server-memory@2026.3.0"],
-      "env": {}
-    },
-    "sqlite": {
-      "command": "npx",
-      "args": ["-y", "mcp-server-sqlite@2026.3.0"],
-      "env": {}
-    }
-  }
-}

package/dot_config/containers/containers.conf

@@ -1,14 +0,0 @@
-# Podman/containers defaults
-[containers]
-netns = ""
-ipcns = ""
-utsns = ""
-
-[engine]
-# Use systemd cgroup driver when available
-cgroup_manager = "systemd"
-# Reduce noisy output
-events_logger = "journald"
-
-[network]
-# Default subnet and gateway can be overridden per user

package/dot_config/curl/dot_curlrc

@@ -1,18 +0,0 @@
-# cURL Configuration
--w "\n"
---anyauth
---continue-at -
---connect-timeout 60
---compressed
---ipv4
---location
---progress-bar
---remote-time
---referer ";auto"
---show-error
---ssl-reqd
---trace-time
---user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/105.0.1343.53"
--H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
--H "Upgrade-Insecure-Requests: 1"
--H "Accept-Language: en-US,en;q=0.8"

package/dot_config/dlv/config.yml

@@ -1,39 +0,0 @@
-# Delve debugger configuration
-# https://github.com/go-delve/delve/blob/master/Documentation/cli/README.md
-
-# Aliases for common commands
-aliases:
-  # Navigation
-  ll: "list"
-  bt: "stack"
-  # Breakpoints
-  bp: "breakpoints"
-  # Variables
-  lv: "locals"
-  av: "args"
-  # Execution
-  c: "continue"
-  n: "next"
-  s: "step"
-  so: "stepout"
-  # Info
-  gs: "goroutines"
-  gt: "goroutine"
-
-# Source list settings
-source-list-line-color: 34
-source-list-arrow-color: 33
-source-list-keyword-color: 31
-
-# Substitute source paths (useful for remote debugging)
-# substitute-path:
-#   - {from: "/build/path", to: "/local/path"}
-
-# Max string length to display
-max-string-len: 256
-
-# Max array values to display
-max-array-values: 128
-
-# Show goroutine current location
-show-location-expr: true

package/dot_config/docker/config.json

@@ -1,15 +0,0 @@
-{
-  "auths": {},
-  "credsStore": "",
-  "credHelpers": {},
-  "detachKeys": "ctrl-@",
-  "experimental": "disabled",
-  "plugins": {},
-  "proxies": {
-    "default": {
-      "httpProxy": "",
-      "httpsProxy": "",
-      "noProxy": ""
-    }
-  }
-}