@sebastienrousseau/dotfiles 0.2.502 → 0.2.504

package/dot_config/dotfiles/agent-card.json

@@ -1,29 +0,0 @@
-{
-  "specVersion": "0.3",
-  "name": "dotfiles-agent",
-  "version": "0.2.501",
-  "description": "Trusted workstation agent surface for local shell automation.",
-  "defaultProfile": "ask",
-  "protocols": ["mcp", "a2a"],
-  "platforms": ["macOS", "Linux", "WSL", "PowerShell"],
-  "entrypoints": {
-    "cli": "dot",
-    "mode": "dot mode",
-    "attestation": "dot attest --json",
-    "mcp": "dot mcp --strict --json",
-    "conformance": "dot agent conformance --strict --json",
-    "checkpoint": "dot agent checkpoint list",
-    "a2aCard": "dot agent a2a-card --json"
-  },
-  "profiles": ["ask", "plan", "apply", "audit"],
-  "security": {
-    "signedCommits": true,
-    "mcpRegistry": true,
-    "sessionLogging": true,
-    "workstationAttestation": true,
-    "replayableCheckpoints": true,
-    "fleetAttestationExport": true,
-    "policyBundleReleases": true,
-    "cardSigning": "ssh-ed25519"
-  }
-}

package/dot_config/dotfiles/agent-profiles.json

@@ -1,92 +0,0 @@
-{
-  "schemaVersion": "2026.03",
-  "defaultProfile": "ask",
-  "rbac": {
-    "roles": {
-      "viewer": {
-        "description": "Read-only access to configuration and status.",
-        "allowedProfiles": ["ask"],
-        "permissions": ["read", "status", "audit"]
-      },
-      "developer": {
-        "description": "Standard development workflow with bounded writes.",
-        "inherits": "viewer",
-        "allowedProfiles": ["ask", "plan", "apply"],
-        "permissions": ["read", "write", "status", "audit", "execute"]
-      },
-      "admin": {
-        "description": "Full access including fleet management and profile switching.",
-        "inherits": "developer",
-        "allowedProfiles": ["ask", "plan", "apply", "audit"],
-        "permissions": ["read", "write", "status", "audit", "execute", "fleet", "configure"]
-      }
-    },
-    "defaultRole": "developer",
-    "enforcement": "advisory"
-  },
-  "delegation": {
-    "enabled": false,
-    "maxDepth": 2,
-    "allowedDelegates": {
-      "security-reviewer": {
-        "profile": "audit",
-        "permissions": ["read", "audit"],
-        "maxSteps": 4,
-        "timeout": 120
-      },
-      "test-runner": {
-        "profile": "apply",
-        "permissions": ["read", "execute"],
-        "maxSteps": 6,
-        "timeout": 300
-      },
-      "lint-checker": {
-        "profile": "ask",
-        "permissions": ["read"],
-        "maxSteps": 2,
-        "timeout": 60
-      }
-    },
-    "securityPolicy": {
-      "requireParentApproval": true,
-      "logAllDelegations": true,
-      "maxConcurrentDelegates": 3
-    }
-  },
-  "profiles": {
-    "ask": {
-      "description": "Read-only guidance with no unattended changes.",
-      "approval": "manual",
-      "filesystem": "read-only",
-      "network": "off",
-      "mcpProfile": "strict-local",
-      "maxSteps": 1
-    },
-    "plan": {
-      "description": "Structured planning with local inspection and no writes.",
-      "approval": "manual",
-      "filesystem": "read-only",
-      "network": "limited",
-      "mcpProfile": "strict-local",
-      "maxSteps": 3
-    },
-    "apply": {
-      "description": "Bounded implementation with explicit approval and local policy guards.",
-      "approval": "on-request",
-      "filesystem": "workspace-write",
-      "network": "limited",
-      "mcpProfile": "strict-local",
-      "maxSteps": 6,
-      "canDelegate": true
-    },
-    "audit": {
-      "description": "Deep verification, scoring, and compliance analysis.",
-      "approval": "manual",
-      "filesystem": "read-only",
-      "network": "limited",
-      "mcpProfile": "enterprise-remote",
-      "maxSteps": 8,
-      "canDelegate": true
-    }
-  }
-}

package/dot_config/dotfiles/boot/README.md

@@ -1,13 +0,0 @@
-Place your Linux boot logo image here.
-
-Default path used by the script:
-
-- ~/.config/dotfiles/boot/logo.png
-
-Run:
-
-- sudo ~/.dotfiles/scripts/theme/install-boot-logo.sh --apply
-
----
-
-Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/grub/README.md

@@ -1,13 +0,0 @@
-Place your GRUB theme files here.
-
-Default path used by the script:
-
-- ~/.config/dotfiles/grub/theme
-
-Run:
-
-- sudo ~/.dotfiles/scripts/theme/install-grub-theme.sh --apply
-
----
-
-Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/lock/README.md

@@ -1,13 +0,0 @@
-Place your lock screen icon here.
-
-Default path used by the script:
-
-- ~/.config/dotfiles/lock/icon.png
-
-Example:
-
-- swaylock --image ~/.config/dotfiles/lock/icon.png
-
----
-
-Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/mcp-lock.json

@@ -1,33 +0,0 @@
-{
-  "lockVersion": "2026.03",
-  "profile": "strict-local",
-  "packages": {
-    "git": {
-      "command": "npx",
-      "package": "mcp-server-git@2026.3.0",
-      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
-      "verification": {
-        "method": "tracked version pin",
-        "status": "approved"
-      }
-    },
-    "memory": {
-      "command": "npx",
-      "package": "@modelcontextprotocol/server-memory@2026.3.0",
-      "source": "https://www.npmjs.com/package/@modelcontextprotocol/server-memory",
-      "verification": {
-        "method": "tracked version pin",
-        "status": "approved"
-      }
-    },
-    "sqlite": {
-      "command": "npx",
-      "package": "mcp-server-sqlite@2026.3.0",
-      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
-      "verification": {
-        "method": "tracked version pin",
-        "status": "approved"
-      }
-    }
-  }
-}

package/dot_config/dotfiles/mcp-policy.json

@@ -1,52 +0,0 @@
-{
-  "policyVersion": "2026.03",
-  "defaultProfile": "strict-local",
-  "profiles": {
-    "strict-local": {
-      "description": "Local-first MCP policy for regulated and high-trust environments.",
-      "allowedLaunchers": ["npx", "node", "uvx"],
-      "trustedTransports": ["stdio", "http"],
-      "authProfiles": ["none", "env-token"],
-      "blockedFilesystemRoots": ["/", "/home", "/Users"],
-      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
-      "warnOnUnpinnedNpx": true,
-      "requireApprovedPackageLock": true,
-      "requireRegistryEntry": true,
-      "requireHttpsForHttpTransports": true,
-      "requireOauthForHttpTransports": true,
-      "requiredEnvByServer": {
-        "github": ["GITHUB_TOKEN"],
-        "brave-search": ["BRAVE_API_KEY"]
-      },
-      "forbidNetworkServersByDefault": [
-        "github",
-        "brave-search",
-        "fetch",
-        "puppeteer",
-        "filesystem"
-      ]
-    },
-    "enterprise-remote": {
-      "description": "Enterprise-ready MCP policy with registry-backed remote transports.",
-      "allowedLaunchers": ["npx", "node", "uvx"],
-      "trustedTransports": ["stdio", "http", "streamable-http"],
-      "authProfiles": ["none", "env-token", "oauth2", "sso"],
-      "streamableHttpConfig": {
-        "sessionTimeout": 3600,
-        "maxConcurrentSessions": 4
-      },
-      "blockedFilesystemRoots": ["/", "/home", "/Users"],
-      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
-      "warnOnUnpinnedNpx": true,
-      "requireApprovedPackageLock": true,
-      "requireRegistryEntry": true,
-      "requireHttpsForHttpTransports": true,
-      "requireOauthForHttpTransports": true,
-      "requiredEnvByServer": {
-        "github": ["GITHUB_TOKEN"],
-        "brave-search": ["BRAVE_API_KEY"]
-      },
-      "forbidNetworkServersByDefault": []
-    }
-  }
-}

package/dot_config/dotfiles/mcp-registry.json

@@ -1,47 +0,0 @@
-{
-  "registryVersion": "2026.03",
-  "servers": {
-    "git": {
-      "transport": "stdio",
-      "launcher": "npx",
-      "package": "mcp-server-git@2026.3.0",
-      "auth": "env",
-      "authProfile": "env-token",
-      "scope": "repo-local",
-      "verification": "pinned-package"
-    },
-    "memory": {
-      "transport": "stdio",
-      "launcher": "npx",
-      "package": "@modelcontextprotocol/server-memory@2026.3.0",
-      "auth": "env",
-      "authProfile": "none",
-      "scope": "workspace-local",
-      "verification": "pinned-package"
-    },
-    "sqlite": {
-      "transport": "stdio",
-      "launcher": "npx",
-      "package": "mcp-server-sqlite@2026.3.0",
-      "auth": "env",
-      "authProfile": "none",
-      "scope": "workspace-local",
-      "verification": "pinned-package"
-    },
-    "example-remote": {
-      "transport": "streamable-http",
-      "url": "https://mcp.example.com/v1",
-      "headers": { "X-Org": "dotfiles" },
-      "auth": "oauth2",
-      "authProfile": "oauth2",
-      "authConfig": {
-        "provider": "https://auth.example.com",
-        "clientId": "${MCP_OAUTH_CLIENT_ID}",
-        "scopes": ["mcp:read", "mcp:write"]
-      },
-      "scope": "enterprise",
-      "verification": "registry-approved",
-      "enabled": false
-    }
-  }
-}

package/dot_config/dotfiles/model-registry.json

@@ -1,20 +0,0 @@
-{
-  "schemaVersion": "2026.03",
-  "defaultModel": "local-default",
-  "models": {
-    "local-default": {
-      "provider": "local",
-      "family": "workstation",
-      "intendedUse": "Local-first CLI assistance and bounded automation",
-      "changeControl": "signed-commit",
-      "riskLevel": "moderate"
-    },
-    "enterprise-audit": {
-      "provider": "remote",
-      "family": "audit",
-      "intendedUse": "Deep analysis with governed remote access",
-      "changeControl": "signed-commit-and-policy-review",
-      "riskLevel": "high"
-    }
-  }
-}

package/dot_config/dotfiles/policy-bundles.json

@@ -1,38 +0,0 @@
-{
-  "schemaVersion": "2026.03",
-  "defaultBundle": "developer",
-  "bundles": {
-    "developer": {
-      "description": "Local development with bounded agent execution and strict-local MCP.",
-      "agentProfile": "apply",
-      "mcpProfile": "strict-local",
-      "signingRequired": true,
-      "attestationRequired": true,
-      "networkPolicy": "limited"
-    },
-    "offline": {
-      "description": "Disconnected local work with no remote MCP transport and no networked agents.",
-      "agentProfile": "ask",
-      "mcpProfile": "strict-local",
-      "signingRequired": true,
-      "attestationRequired": true,
-      "networkPolicy": "off"
-    },
-    "regulated": {
-      "description": "High-trust profile for controlled environments with explicit approvals and evidence export.",
-      "agentProfile": "audit",
-      "mcpProfile": "strict-local",
-      "signingRequired": true,
-      "attestationRequired": true,
-      "networkPolicy": "limited"
-    },
-    "enterprise": {
-      "description": "Enterprise remote profile with registry-backed MCP and governed audit posture.",
-      "agentProfile": "audit",
-      "mcpProfile": "enterprise-remote",
-      "signingRequired": true,
-      "attestationRequired": true,
-      "networkPolicy": "limited"
-    }
-  }
-}

package/dot_config/dotfiles/prompt-registry.json

@@ -1,16 +0,0 @@
-{
-  "schemaVersion": "2026.03",
-  "defaultPromptSet": "core",
-  "promptSets": {
-    "core": {
-      "description": "General workstation guidance and bounded implementation prompts.",
-      "changeControl": "signed-commit",
-      "reviewRequired": true
-    },
-    "regulated-audit": {
-      "description": "Compliance and high-trust audit prompts with stricter review expectations.",
-      "changeControl": "signed-commit-and-policy-review",
-      "reviewRequired": true
-    }
-  }
-}

package/dot_config/dotfiles/versions.env

@@ -1,18 +0,0 @@
-# Version pins for provisioned tools (Linux).
-# Override by editing this file or exporting env vars before running.
-STARSHIP_TAG="v1.24.2"
-ZOXIDE_TAG="0.9.9"
-NEOVIM_TAG="v0.11.6"
-LAZYGIT_TAG="v0.60.0"
-ATUIN_TAG="v18.13.3"
-ZELLIJ_TAG="v0.43.1"
-UV_TAG="0.10.12"
-
-# Update & runtime tooling
-TOPGRADE_TAG="v17.1.0"
-MISE_TAG="v2026.3.8"
-YAZI_TAG="v26.1.22"
-
-# AI CLI Tools
-MODS_TAG="v1.8.1"
-

package/dot_config/duf/duf.conf

@@ -1,6 +0,0 @@
-# duf configuration (dotfiles)
-# Format: key: value
-
-theme: dark
-sort: size
-hide: tmpfs,devtmpfs

package/dot_config/duti/defaults.duti

@@ -1,5 +0,0 @@
-# Default app bindings for macOS (duti).
-# Format: <bundle-id> <UTI> <role>
-# Example:
-# com.google.Chrome public.html all
-# com.microsoft.VSCode public.plain-text all

package/dot_config/emoji/emoji.txt

@@ -1,34 +0,0 @@
-😀 grinning face
-😃 grinning face with big eyes
-😄 grinning face with smiling eyes
-😁 beaming face with smiling eyes
-😆 grinning squinting face
-😉 winking face
-😊 smiling face with smiling eyes
-😎 smiling face with sunglasses
-😍 smiling face with heart-eyes
-😘 face blowing a kiss
-😇 smiling face with halo
-🤔 thinking face
-🙃 upside-down face
-😴 sleeping face
-🤯 exploding head
-🥳 partying face
-😤 face with steam from nose
-😭 loudly crying face
-😱 face screaming in fear
-🤖 robot
-👋 waving hand
-👍 thumbs up
-🙏 folded hands
-💡 light bulb
-🔥 fire
-✨ sparkles
-🎉 party popper
-🚀 rocket
-🧠 brain
-🛠️ hammer and wrench
-📦 package
-✅ check mark
-❌ cross mark
-⚠️ warning

package/dot_config/environment.d/50-ssh-agent.conf

@@ -1,2 +0,0 @@
-# SSH agent — point all sessions at the systemd-managed agent socket
-SSH_AUTH_SOCK=${XDG_RUNTIME_DIR}/ssh-agent.socket

package/dot_config/environment.d/90-wayland.conf

@@ -1,19 +0,0 @@
-# Wayland session environment variables
-ELECTRON_OZONE_PLATFORM_HINT=auto
-TERMINAL=ghostty
-
-# Qt Wayland support
-QT_QPA_PLATFORM=wayland
-QT_QPA_PLATFORMTHEME=gtk3
-
-# Firefox native Wayland
-MOZ_ENABLE_WAYLAND=1
-
-# SDL Wayland support
-SDL_VIDEODRIVER=wayland
-
-# Java AWT fix (JetBrains IDEs, Ghidra)
-_JAVA_AWT_WM_NONREPARENTING=1
-
-# DMS icon theme
-QS_ICON_THEME=Papirus-Dark

package/dot_config/fastfetch/config.jsonc

@@ -1,28 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/fastfetch-cli/fastfetch/dev/doc/json_schema.json",
-  "logo": {
-    "type": "auto",
-    "padding": { "top": 1, "left": 1 }
-  },
-  "display": {
-    "separator": "  "
-  },
-  "modules": [
-    "title",
-    "os",
-    "host",
-    "kernel",
-    "uptime",
-    "packages",
-    "shell",
-    "display",
-    "wm",
-    "terminal",
-    "cpu",
-    "gpu",
-    "memory",
-    "disk",
-    "localip",
-    "publicip"
-  ]
-}

package/dot_config/firefox/user.js.tmpl

@@ -1,58 +0,0 @@
-// Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-// Firefox privacy and performance hardening
-// Apply by symlinking to ~/.mozilla/firefox/<profile>/user.js
-
-/* global user_pref */
-
-{{- $t := index .themes .theme -}}
-
-// Disable telemetry
-user_pref("toolkit.telemetry.enabled", false);
-user_pref("toolkit.telemetry.unified", false);
-user_pref("toolkit.telemetry.archive.enabled", false);
-user_pref("datareporting.healthreport.uploadEnabled", false);
-user_pref("datareporting.policy.dataSubmissionEnabled", false);
-user_pref("browser.ping-centre.telemetry", false);
-user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
-user_pref("browser.newtabpage.activity-stream.telemetry", false);
-
-// Disable Pocket
-user_pref("extensions.pocket.enabled", false);
-
-// Disable prefetching
-user_pref("network.prefetch-next", false);
-user_pref("network.dns.disablePrefetch", true);
-user_pref("network.predictor.enabled", false);
-
-// Enable HTTPS-Only
-user_pref("dom.security.https_only_mode", true);
-user_pref("dom.security.https_only_mode_ever_enabled", true);
-
-// Disable form autofill
-user_pref("extensions.formautofill.addresses.enabled", false);
-user_pref("extensions.formautofill.creditCards.enabled", false);
-
-// Enhanced tracking protection
-user_pref("browser.contentblocking.category", "strict");
-user_pref("privacy.trackingprotection.enabled", true);
-user_pref("privacy.trackingprotection.socialtracking.enabled", true);
-
-// DNS over HTTPS
-user_pref("network.trr.mode", 2);
-user_pref("network.trr.uri", "https://mozilla.cloudflare-dns.com/dns-query");
-
-// Disable WebRTC IP leak
-user_pref("media.peerconnection.ice.default_address_only", true);
-
-// Performance
-user_pref("gfx.webrender.all", true);
-user_pref("layers.acceleration.force-enabled", true);
-user_pref("layout.css.backdrop-filter.enabled", true);
-
-// Theme coordination
-// 0 = dark, 1 = light
-user_pref("layout.css.prefers-color-scheme.content-override", {{ if eq $t.mode "light" }}1{{ else }}0{{ end }});
-
-// UI
-user_pref("browser.uidensity", 1);
-user_pref("browser.compactmode.show", true);

package/dot_config/fish/completions/dot-theme-sync.fish.tmpl

@@ -1,9 +0,0 @@
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Completions for dot-theme-sync
-
-# Complete with theme names from themes.toml
-complete -c dot-theme-sync -f -a "{{- range $name, $_ := .themes }}{{ $name }} {{ end }}"
-
-# Complete with flags
-complete -c dot-theme-sync -l help -s h -d "Show help"
-complete -c dot-theme-sync -l full -d "Full chezmoi apply + reload"