@sebastienrousseau/dotfiles 0.2.503 → 0.2.505

package/CHANGELOG.md

@@ -2,7 +2,92 @@
 
 This file documents all notable changes to this project.
 
-## v0.2.503 (unreleased)
+## v0.2.505 — 2026-06-04
+
+Claude Code is no longer installed through mise/npm. npm 11 silently drops
+the platform-native `optionalDependency` on global installs, leaving a stub
+binary that errors with "claude native binary not installed". The fix moves
+Claude Code to Anthropic's native installer and audits the other AI tools for
+the same class of bug. This release also repairs Linux install breaks, hardens
+cross-platform shell parity (bash, fish, nushell), and adds SPDX license
+headers across the source tree.
+
+### Fixed
+
+- **Claude Code install** — switched off the mise `npm:@anthropic-ai/claude-code`
+  pin onto Anthropic's native installer (`~/.local/bin/claude`, self-updating),
+  which fetches the platform binary directly and sidesteps the npm 11
+  optional-dependency bug. Bootstrap (`run_onchange_15-ai-cli-tools`), `dot ai`,
+  and `dot apply`'s "install missing providers" flow all install Claude Code
+  natively now instead of reinstalling the broken package.
+- **Linux install breaks (every distro):** Neovim fetched `nvim-linux64.tar.gz`,
+  an asset Neovim renamed after v0.10.3, so the pinned v0.11.6 download 404'd and
+  aborted the whole provision run — now arch-aware (`nvim-linux-{x86_64,arm64}`)
+  with ARM support; AIChat defaulted to a `latest` tag baked into the asset
+  filename (also a guaranteed 404) — now pinned via `AICHAT_TAG`.
+- **Clipboard (`cb`):** crashed under `set -u` on non-Wayland Linux
+  (`$WAYLAND_DISPLAY` was referenced unguarded); added `command -v` guards, an
+  `xsel` fallback, and clear per-backend (Wayland/X11/WSL) error messages.
+- **Bash parity:** `dot_bashrc` shipped ~14 hardcoded aliases and none of the
+  library functions — it never sourced the shared `~/.config/shell/*` hub. It
+  now loads the same layers zsh does (867 aliases + 185 functions), matching its
+  documented Tier-1 "Full" status.
+- **fish/nushell `goto`/`cdls`:** these change directory but were run through a
+  `bash -c` subshell, so the `cd` was discarded — they silently no-op'd.
+  Reimplemented natively (fish functions; nushell `def --env`, the only form
+  whose `cd` propagates to the caller).
+- **Docs:** fixed 18 hardcoded absolute markdown links (`/home/seb/.dotfiles/…`,
+  broken on GitHub and on any other machine) to file-relative paths.
+
+### Changed
+
+- **Removed two redundant mise pins** uncovered while auditing the other AI
+  tools: `npm:codex-cli` (a legacy package — codex.js — that collided on the
+  `codex` bin name; Codex is already provided by the native `codex` pin) and
+  `npm:opencode-ai` (a broken-wrapper duplicate of the native `opencode` pin).
+  Both shims already resolved to the native builds, so runtime behaviour is
+  unchanged. copilot/gemini/qwen/zai were checked and are unaffected.
+- **Extracted** the shared Claude native-installer helper and the AI
+  provider→mise-package map into `lib/dot/ai-install.sh`, removing duplication
+  across `dot ai` and `dot apply`.
+- **Cross-distro robustness:** Debian/Ubuntu now symlink `~/.local/bin/{bat,fd}`
+  to `batcat`/`fdfind`; a missing apt/dnf/pacman warns loudly instead of silently
+  installing nothing; WSL gets a best-effort `wslu` install for `wslview`. fish
+  and nushell now export `EDITOR`/`VISUAL`/`PAGER` to match the zsh/bash profile.
+- **Licensing:** added `SPDX-License-Identifier: MIT` headers (SPDX-first / REUSE
+  form) and normalized the copyright line to `Sebastien Rousseau` across 831
+  repo-only source files; dropped the contradictory `All rights reserved.`.
+- **README** — fixed the OpenSSF Best Practices badge (was linking to the
+  new-project form with a static label; now the live `cii/percentage/12840`
+  endpoint linked to the real project).
+
+## v0.2.504 — 2026-06-03
+
+First-class **stock-macOS** support: the installer and the entire `dot` CLI
+now run correctly under the system `/bin/bash` 3.2, and the mise↔chezmoi
+ownership conflict is resolved structurally. Found by performing a clean
+end-to-end install and exercising every command. Full suite: 4821/4821.
+
+### Fixed
+
+- **macOS bash 3.2 compatibility** across the CLI, which had assumed bash 4+:
+  - iTerm2 profile `run_onchange` used `declare -A` and aborted `chezmoi apply`; rewritten with indexed arrays.
+  - `dot ai` used `local -n` namerefs + `declare -A`; now passes arrays by value and reads probe results from the cached TSV via `awk`.
+  - `dot security-score` and the `matrix` effect dropped `declare -A` (parallel arrays / `case`).
+  - `dot fleet apply` replaced the bash-4.3 `wait -n` throttle with a portable PID-FIFO; `dot theme rebuild` now requires bash 4 and re-execs under a newer bash when available.
+  - `dot perf` / `dot bundle` / `dot benchmark` / `dot doctor` / `dot sync` and the pre-commit hook: empty-array `"${arr[@]}"` under `set -u` aborted on bash 3.2; cleanup traps now use the `set +u` idiom.
+  - `.bashrc` guards bash-4-only `shopt` options (`globstar`, `dirspell`, `autocd`).
+- **Installer:** backup loop no longer recurses into live `~/.ssh/agent` sockets; seeds git identity from `git config --global` and prints a hint when none is set. The v0.2.503 migration no longer exits non-zero under `set -e`.
+- **mise:** the chezmoi-managed base config moved to `conf.d/00-dotfiles.toml`; `~/.config/mise/config.toml` is now mise's `.chezmoiignore`'d writable global, so `mise use -g` no longer drifts the source. An absent `gh` token no longer breaks the whole config, and the x86_64-only hyperfine aqua package (unrunnable on Apple Silicon) is no longer managed by mise. `version-sync.sh` no longer hangs on a non-TTY stdin (rg now searches the tree, not stdin) and respects `EXCLUDE_FILES`.
+- **`Brewfile.cli`:** add `zellij` and `sops` (checked by `dot doctor`, previously absent).
+- **`dot version-locks`** is `.chezmoiroot`-aware again (had reported "config not found" since the v0.2.503 reorg).
+- **Tests:** robust large-HEIC wallpaper dimension probe (`-ping`); `test_perf_percentiles` trusts mise in its isolated environment.
+
+### Changed
+
+- Homebrew/Scoop release installers now actually install (sha256 substitution, Scoop `extract_dir` + Windows entrypoint).
+
+## v0.2.503 — 2026-05-30
 
 Polish + cross-platform + Scorecard release **plus** the
 incremental repo reorganisation per

package/README.md

@@ -10,11 +10,11 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.503-blue?style=for-the-badge" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.505-blue?style=for-the-badge" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
-  <a href="https://www.bestpractices.dev/projects/new"><img src="https://img.shields.io/badge/OpenSSF%20Best%20Practices-in%20progress-yellow?style=for-the-badge" alt="OpenSSF Best Practices" /></a>
+  <a href="https://www.bestpractices.dev/projects/12840"><img src="https://img.shields.io/cii/percentage/12840?style=for-the-badge&label=OpenSSF%20Best%20Practices" alt="OpenSSF Best Practices" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License: MIT" /></a>
 </p>
 
@@ -52,8 +52,8 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.503/install.sh
-echo "4c0303a2d88d5aed98428ab0da37618c9795af4dae0e6549646c2fce5235c280  /tmp/dotfiles-install.sh" \
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.505/install.sh
+echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh
 ```
@@ -300,7 +300,7 @@ See the [Migration Guide](docs/operations/MIGRATION.md) for version upgrades.
 - **Pattern library** (`dot patterns`) — architect, hardener, and refactor patterns bundled in `dot_config/ai/patterns/`
 - **MCP policy enforcement** (`dot mcp`) — validate the Model Context Protocol registry against policy
 - **AI commit messages** (`dot commit`) — conventional commits generated from the staged diff
-- **AI tools** (`dot ai`) — Claude Code, Codex, GitHub Copilot, Gemini CLI, and friends managed via Mise
+- **AI tools** (`dot ai`) — Codex, GitHub Copilot, Gemini CLI, and friends managed via Mise; Claude Code via Anthropic's native installer
 - **Attestation logs** — every agent session is logged with a policy hash and an outcome
 
 </details>

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.503) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.505) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/OPENCODE.md

@@ -117,7 +117,7 @@ install.sh                  # Bootstrap installer
 ### Key Data Files
 
 - `.chezmoidata.toml` — All configuration: profiles, feature flags, tool settings
-- `dot_config/mise/config.toml` — mise tool versions (node, python, go, rust, etc.)
+- `dot_config/mise/conf.d/00-dotfiles.toml` — mise tool versions (node, python, go, rust, etc.); the writable `~/.config/mise/config.toml` is mise-owned and not chezmoi-managed
 - `dot_config/starship.toml.tmpl` — Prompt configuration
 
 ### Testing

package/docs/index.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL.
 
 [![Build](https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github)](https://github.com/sebastienrousseau/dotfiles/actions)
-[![Version](https://img.shields.io/badge/Version-v0.2.503-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.503)
+[![Version](https://img.shields.io/badge/Version-v0.2.505-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.505)
 [![Downloads](https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases)
 
 This site is published from the `docs/` directory on `master` and tracks the current workstation baseline, operational guidance, and security material for the repository.
@@ -38,6 +38,6 @@ This site is published from the `docs/` directory on `master` and tracks the cur
 
 ## Current Release
 
-- Current tagged release: [`v0.2.503`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.503)
+- Current tagged release: [`v0.2.505`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.505)
 - Latest release feed: [GitHub releases](https://github.com/sebastienrousseau/dotfiles/releases/latest)
 - Source repository: [sebastienrousseau/dotfiles](https://github.com/sebastienrousseau/dotfiles)

package/docs/interop/A2A.md

@@ -8,8 +8,8 @@ The repository now ships an agent card and an A2A-ready discovery document.
 
 Artifacts:
 
-- [agent-card.json](/home/seb/.dotfiles/dot_config/dotfiles/agent-card.json)
-- [agent.json](/home/seb/.dotfiles/.well-known/agent.json)
+- [agent-card.json](../../defaults/dot_config/dotfiles/agent-card.json)
+- [agent.json](../../.well-known/agent.json)
 
 Core properties:
 

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.503 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.505 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/manual/02-tutorials/01-first-install.md

@@ -184,7 +184,7 @@ After `dot doctor` reports a healthy score, you have:
 | **Editor** | Neovim with lazy.nvim + LSP + theme-synced colorscheme |
 | **Terminal** | Ghostty/Alacritty/Kitty/WezTerm configs (pick whichever is installed) |
 | **Git** | Signed commits, delta diff, conventional commit template |
-| **AI tooling** | Claude Code, Codex, Copilot CLI, Gemini CLI via mise |
+| **AI tooling** | Codex, Copilot CLI, Gemini CLI via mise; Claude Code via Anthropic's native installer |
 | **Secret store** | Age key, SOPS config, `dot secrets` command ready |
 | **Security** | Gitleaks, detect-secrets baseline, signed attestation log |
 | **Theme engine** | K-Means wallpaper extractor, system + custom wallpaper discovery |

package/docs/operations/RELEASE_PIPELINE.md

@@ -59,7 +59,7 @@ where dependencies allow.
 | `security-release.yml` (manifest job) | `release.published`, dispatch | Build `ALL_SHA256SUMS` over every release asset, Cosign-sign it. | `ALL_SHA256SUMS` + `.sig` + `.pem`. |
 | `release-distribute-homebrew.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, regenerate `install/homebrew/dot.rb`, push branch + PR to `sebastienrousseau/homebrew-tap`. | One PR on the tap repo. |
 | `release-distribute-scoop.yml` | `release.published`, dispatch | Hash `dot-VERSION.zip`, rewrite `install/scoop/dot.json` via jq (both 64bit + arm64 point at same zip), PR to `sebastienrousseau/scoop-bucket`. | One PR on the bucket repo. |
-| `release-distribute-aur.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, rewrite `pkgver` + `sha256sums` in `install/aur/PKGBUILD`, regenerate `.SRCINFO` via dockerised `makepkg`, push to `ssh://aur@aur.archlinux.org/dotfiles-git.git`. | One commit on AUR. |
+| `release-distribute-aur.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, rewrite `pkgver` + `sha256sums` in `install/aur/PKGBUILD`, regenerate `.SRCINFO` via dockerised `makepkg`, push to `ssh://aur@aur.archlinux.org/dot-cli-git.git`. | One commit on AUR. |
 | `release-attestation-check.yml` | weekly cron + dispatch | Verify the latest release carries the full attestation bundle (SBOM + sig + cert + intoto + manifest + sig + cert). | Opens or comments on a tracking issue. |
 
 ## Why `created` vs `published`
@@ -93,7 +93,7 @@ manifest job after late asset uploads picks up the new state and the
 |---|---|---|
 | Homebrew | `sebastienrousseau/homebrew-tap` | Tap repo exists (currently bare README + LICENSE). Workflow creates the `Formula/dot.rb` path on first publish. |
 | Scoop | `sebastienrousseau/scoop-bucket` | Bucket repo exists (currently bare). Workflow creates `bucket/dot.json` on first publish. |
-| AUR | `ssh://aur@aur.archlinux.org/dotfiles-git.git` | **Manual one-time step**: the maintainer must create the package entry via the AUR web UI before the workflow's `git clone` can succeed. The workflow exits with a clear error message on the first run if the repo doesn't exist. |
+| AUR | `ssh://aur@aur.archlinux.org/dot-cli-git.git` | **Manual one-time step**: the maintainer must create the package entry via the AUR web UI before the workflow's `git clone` can succeed. The workflow exits with a clear error message on the first run if the repo doesn't exist. |
 
 ## Verifying a release
 
@@ -105,7 +105,7 @@ independently.
 
 ## Known caveats
 
-- **AUR `pkgname=dotfiles-git`**: AUR's `-git` convention means
+- **AUR `pkgname=dot-cli-git`**: AUR's `-git` convention means
   "tracks git HEAD", but the workflow publishes tagged stable
   releases. Either rename to plain `dotfiles` in
   `install/aur/PKGBUILD` and register that package, or accept the

package/docs/operations/TRUSTED_AGENT_WORKSTATION.md

@@ -20,12 +20,12 @@ It defines a signed, local-first workstation baseline for agentic development on
 
 The source of truth lives in tracked JSON artifacts:
 
-- [policy-bundles.json](/home/seb/.dotfiles/dot_config/dotfiles/policy-bundles.json)
-- [agent-profiles.json](/home/seb/.dotfiles/dot_config/dotfiles/agent-profiles.json)
-- [mcp-policy.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-policy.json)
-- [mcp-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-registry.json)
-- [model-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/model-registry.json)
-- [prompt-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/prompt-registry.json)
+- [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json)
+- [agent-profiles.json](../../defaults/dot_config/dotfiles/agent-profiles.json)
+- [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json)
+- [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json)
+- [model-registry.json](../../defaults/dot_config/dotfiles/model-registry.json)
+- [prompt-registry.json](../../defaults/dot_config/dotfiles/prompt-registry.json)
 
 ## Enterprise path
 

package/docs/security/AUTOMATION_SECRETS.md

@@ -21,6 +21,6 @@ render_with_liquid: false
 ## Provisioning notes
 
 1. Store the SSH signing private key in GitHub Actions as `ACTIONS_BOT_SIGNING_KEY`.
-2. Store the matching public key in [allowed_signers](/home/seb/.dotfiles/dot_config/git/allowed_signers).
+2. Store the matching public key in [allowed_signers](../../defaults/dot_config/git/allowed_signers.tmpl).
 3. Rotate the key on personnel or workstation change.
 4. Fail closed when secrets are absent.

package/docs/security/MCP_POLICY.md

@@ -21,9 +21,9 @@ Properties:
 
 ## Policy artifact
 
-The source of truth lives in [mcp-policy.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-policy.json).
-Approved package pins live in [mcp-lock.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-lock.json).
-Tracked server registry entries live in [mcp-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-registry.json).
+The source of truth lives in [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json).
+Approved package pins live in [mcp-lock.json](../../defaults/dot_config/dotfiles/mcp-lock.json).
+Tracked server registry entries live in [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json).
 
 Current defaults:
 
@@ -75,4 +75,4 @@ Current approved refs:
 - active servers match the tracked registry entries
 - remote HTTP transports are HTTPS and OAuth-backed
 
-Policy bundle baselines live in [policy-bundles.json](/home/seb/.dotfiles/dot_config/dotfiles/policy-bundles.json).
+Policy bundle baselines live in [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json).

package/docs/security/SECURITY_CHECKLIST.md

@@ -11,7 +11,7 @@ Use this checklist before cutting any new release (e.g., `v0.x.x`) to ensure sup
 - [ ] **Pinned Version**: Update `install.sh` `VERSION` variable to match the release tag.
 - [ ] **Docs Sync**: Ensure `README.md` and `.github/PULL_REQUEST_TEMPLATE.md` installer URLs point to the new tag (not `main`).
 - [ ] **Clean Build**: Verify `install.sh` does not curl random scripts from third parties without pinning.
-- [ ] **SOUP Register**: Review [SOUP_REGISTER.md](/home/seb/.dotfiles/docs/security/SOUP_REGISTER.md) and confirm all active external components have an owner and validation path.
+- [ ] **SOUP Register**: Review [SOUP_REGISTER.md](SOUP_REGISTER.md) and confirm all active external components have an owner and validation path.
 
 ## 2. Secrets & Leak Prevention
 

package/docs/security/SOUP_REGISTER.md

@@ -12,13 +12,13 @@ Controlled inventory for software of unknown pedigree used by the dotfiles platf
 
 | Component | Source | Version control | Verification path | Owner | Status |
 | :--- | :--- | :--- | :--- | :--- | :--- |
-| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](/home/seb/.dotfiles/install/lib/package_managers.sh) | Repo maintainer | Conditional |
+| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](../../install/lib/package_managers.sh) | Repo maintainer | Conditional |
 | Chezmoi installer | `get.chezmoi.io` | Pinned by `CHEZMOI_INSTALLER_SHA256` when used | SHA-256 in `install/lib/chezmoi.sh` | Repo maintainer | Controlled |
 | GitHub Actions marketplace actions | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pins | Repo maintainer | Controlled |
-| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](/home/seb/.dotfiles/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
-| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](/home/seb/.dotfiles/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
 | Checkov action | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pin | Repo maintainer | Controlled |
-| Nix inputs | GitHub flakes | Locked in [flake.lock](/home/seb/.dotfiles/flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
+| Nix inputs | GitHub flakes | Locked in [flake.lock](../../flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
 | GitHub release metadata queries | GitHub API | Discovery only, not release validation | `update-deps.yml` query path | Repo maintainer | Monitored |
 
 ## Validation record

package/install.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
 # Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"
 # (or ./install.sh locally)
@@ -59,21 +60,26 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.503)
+  version       The version (tag or branch) to install (default: v0.2.505)
 
 Options:
   --help        Show this help message
   --force       Non-interactive mode (sets DOTFILES_NONINTERACTIVE=1)
   --silent      Quiet mode (sets DOTFILES_SILENT=1)
   --minimal     Minimal profile (disable nvim, tmux, zellij)
+  --provision   After applying configs, install the toolchain (packages,
+                fonts, language tools) via the install/provision scripts.
+                Also enabled by DOTFILES_PROVISION=1. Opt-in because it
+                installs packages and may change OS defaults.
 
 EOF
 }
 
 main() {
-  local version="v0.2.503"
+  local version="v0.2.505"
   local version_set=0
   local minimal=0
+  local provision="${DOTFILES_PROVISION:-0}"
   local _cleanup_files=()
   trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
@@ -86,6 +92,7 @@ main() {
       --silent) export DOTFILES_SILENT=1 ;;
       --force) export DOTFILES_NONINTERACTIVE=1 ;;
       --minimal) minimal=1 ;;
+      --provision) provision=1 ;;
       -*)
         # Catch single-dash and double-dash unknowns the same way.
         error "Unknown option: $arg"
@@ -99,7 +106,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.503)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.505)."
         fi
         version="$arg"
         version_set=1
@@ -257,6 +264,35 @@ main() {
     sed_in_place 's/^zellij = true/zellij = false/' "$data_file"
   }
 
+  # Carry the user's existing global git identity into chezmoi's data.
+  #
+  # This installer sets up chezmoi via sourceDir rather than `chezmoi init`,
+  # so the config template's prompts for git_name / git_email never run. The
+  # gitconfig template coalesces git_name->name->"" (likewise email,
+  # signingkey) and only emits a [user] block when non-empty — so without
+  # this, a fresh install produces a ~/.gitconfig with no identity at all,
+  # and commits fail with "Author identity unknown". Seed name/email/
+  # signingkey from `git config --global` when present. Idempotent: skips if
+  # the config already carries a [data] block.
+  toml_escape() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'; }
+  seed_git_identity() {
+    local cfg="$CHEZMOI_CONFIG_FILE"
+    [[ -f "$cfg" ]] || return 0
+    grep -q '^\[data\]' "$cfg" 2>/dev/null && return 0
+    local gname gemail gkey
+    gname="$(git config --global user.name 2>/dev/null || true)"
+    gemail="$(git config --global user.email 2>/dev/null || true)"
+    gkey="$(git config --global user.signingkey 2>/dev/null || true)"
+    [[ -z "$gname" && -z "$gemail" ]] && return 0
+    {
+      printf '\n[data]\n'
+      [[ -n "$gname" ]] && printf 'name = "%s"\n' "$(toml_escape "$gname")"
+      [[ -n "$gemail" ]] && printf 'email = "%s"\n' "$(toml_escape "$gemail")"
+      [[ -n "$gkey" ]] && printf 'signingkey = "%s"\n' "$(toml_escape "$gkey")"
+    } >>"$cfg"
+    echo "   Seeded git identity ($gname <$gemail>) into chezmoi data."
+  }
+
   # 5. Backup existing dotfiles that chezmoi will overwrite
   step "Backing up existing dotfiles..."
   BACKUP_DIR="$HOME/.dotfiles.bak.$(date +"%Y%m%d_%H%M%S")"
@@ -273,6 +309,17 @@ main() {
   if command -v chezmoi >/dev/null && [[ -f "$CHEZMOI_CONFIG_FILE" ]]; then
     while IFS= read -r file; do
       [[ -z "$file" ]] && continue
+      # Skip managed *directories*: chezmoi apply never clobbers a
+      # directory's existing contents, so they don't need backing up, and
+      # `cp -a` on one recurses into things it can't copy — e.g. the live
+      # ssh-agent sockets under ~/.ssh/agent, which spew
+      # "is a socket (not copied)" warnings. The managed files chezmoi
+      # would actually overwrite are listed (and backed up) individually.
+      # `-d` without `-L` excludes only real dirs; symlinks are copied as
+      # links by `cp -a`, so they never recurse.
+      if [[ -d "$file" && ! -L "$file" ]]; then
+        continue
+      fi
       if [[ -e "$file" ]]; then
         rel="${file#"$HOME"/}"
         mkdir -p "$BACKUP_DIR/$(dirname "$rel")"
@@ -304,7 +351,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.503 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.505 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -313,7 +360,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.503 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.505 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi
@@ -323,6 +370,7 @@ main() {
   if [[ -d "$SOURCE_DIR/.git" ]]; then
     echo "   Applying from local source: $SOURCE_DIR"
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -332,6 +380,7 @@ main() {
     echo "   Migrating from legacy source: $LEGACY_SOURCE_DIR"
     mv "$LEGACY_SOURCE_DIR" "$SOURCE_DIR"
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -362,6 +411,7 @@ main() {
     fi
 
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -369,7 +419,49 @@ main() {
     chezmoi apply "${APPLY_FLAGS[@]}"
   fi
 
+  # Toolchain provisioning (opt-in). The install/provision/ scripts (package
+  # managers, fonts, language + AI tools) are chezmoi run_ scripts, but they
+  # live OUTSIDE the .chezmoiroot source dir (defaults/), so `chezmoi apply`
+  # never runs them — a fresh install otherwise ships configs but zero tools.
+  # Run them here only when explicitly requested: they install packages and
+  # can change OS defaults, so we never do it implicitly (CI / Docker /
+  # unattended automation must opt in via --provision or DOTFILES_PROVISION=1).
+  if [[ "$provision" = "1" && $minimal -eq 0 ]]; then
+    step "Provisioning toolchain (packages, fonts, tools)..."
+    local prov_dir="$SOURCE_DIR/install/provision"
+    if [[ -d "$prov_dir" ]]; then
+      local script
+      # run_once_install_* (shells) first, then numbered run_onchange_* in order.
+      while IFS= read -r script; do
+        [[ -f "$script" ]] || continue
+        echo "   → $(basename "$script")"
+        if [[ "$script" == *.tmpl ]]; then
+          chezmoi execute-template <"$script" | bash ||
+            echo "     (step exited non-zero — continuing)"
+        else
+          bash "$script" || echo "     (step exited non-zero — continuing)"
+        fi
+      done < <(ls "$prov_dir"/run_once_install_* "$prov_dir"/run_onchange_* 2>/dev/null | sort)
+    fi
+  elif [[ $minimal -eq 0 ]]; then
+    step "Configs deployed. To also install the toolchain (packages, fonts, tools):"
+    echo "   bash \"$SOURCE_DIR/install.sh\" --provision    # or DOTFILES_PROVISION=1"
+    echo "   (or: brew bundle --file ~/.config/shell/Brewfile.cli)"
+  fi
+
   success "Configuration loaded. Please restart your shell."
+
+  # If no git identity ended up configured, commits will fail with
+  # "Author identity unknown". Point the user at the one-line fix rather
+  # than letting them discover it on their first commit.
+  if [[ -z "$(git config --global user.email 2>/dev/null || true)" ]] &&
+    ! grep -q '^email' "$CHEZMOI_CONFIG_FILE" 2>/dev/null; then
+    step "No git identity detected. Set yours so commits are attributed:"
+    echo "   git config --global user.name  \"Your Name\""
+    echo "   git config --global user.email \"you@example.com\""
+    echo "   then re-run: chezmoi apply"
+  fi
+
   step "Run 'dot learn' for an interactive tour of your new dotfiles."
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.503",
+  "version": "0.2.505",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/README.md

@@ -7,7 +7,7 @@ workflows, by `chezmoi apply` hooks, or by hand.
 
 ## Subtree map
 
-Per the v0.2.503 reorg (RFC `docs/operations/RFC_v0_2_503_reorganization.md`),
+Per the repository reorg (RFC `docs/operations/RFC_v0_2_503_reorganization.md`),
 **repo-only ops** (CI, release, maintenance, docs-generation) have
 moved to the top-level `tools/` tree. `scripts/` retains the
 **runtime-invoked** scripts that the `dot` CLI dispatches to plus a
@@ -17,7 +17,7 @@ few specialised subtrees.
 
 | Path | Purpose | Touched by |
 |---|---|---|
-| `scripts/dot/commands/` | Per-subcommand handlers for the `dot` CLI. Sources `lib/dot/*.sh` (moved out of this tree in v0.2.503 Phase 1). | Dispatched by `bin/dot` |
+| `scripts/dot/commands/` | Per-subcommand handlers for the `dot` CLI. Sources `lib/dot/*.sh` (moved out of this tree in the Phase 1 reorg). | Dispatched by `bin/dot` |
 | `scripts/dot/powershell/` | Native PowerShell module (`Dot.psm1`) exporting `Get-DotVersion` / `Invoke-DotHelp` / `Test-DotAgentsSync`. | `bin/dot.ps1` |
 | `scripts/dot/data/` | Per-command static data (registry seeds, palette tables). | `scripts/dot/commands/*` |
 | `scripts/lib/` | Cross-cutting library helpers reused across multiple scripts. Example: `secrets_provider.sh` (keychain / pass / age dispatch). | `scripts/dot/commands/*`, ops scripts |
@@ -49,7 +49,7 @@ few specialised subtrees.
 The `dot` CLI is implemented as `bin/dot`
 (dispatcher) + `scripts/dot/commands/<cmd>.sh` (per-command
 handlers) + `lib/dot/*.sh` (shared helpers — moved out of
-`scripts/dot/lib/` in v0.2.503 Phase 1 per the
+`scripts/dot/lib/` in the Phase 1 reorg per the
 [reorganisation RFC](../docs/operations/RFC_v0_2_503_reorganization.md)).
 
 | Path | Purpose |

package/scripts/ci/check-copyright-headers.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/ci/check-shell-preamble.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/demo/record.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 OUT="${1:-$HOME/.dotfiles/docs/demo/demo.gif}"

package/scripts/diagnostics/a2a-conformance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## A2A v0.3 and agent card conformance validation.
 
 set -euo pipefail

package/scripts/diagnostics/alias-governance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Alias governance checks:
 # - duplicate alias names
 # - risky overrides must be gated

package/scripts/diagnostics/aliases-cheatsheet.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/aliases-manifest.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Emit alias manifest as TSV:
 # name<TAB>value<TAB>file<TAB>line