@sebastienrousseau/dotfiles 0.2.503 → 0.2.505

package/scripts/diagnostics/benchmark.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Shell Performance Benchmark.
 ##
 ## Measures shell startup time with per-component profiling. Uses hyperfine
@@ -41,7 +42,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/dot/ui.sh

package/scripts/diagnostics/conflicts.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Alias/Command Conflicts Report
 # Usage: dot conflicts
 

package/scripts/diagnostics/doctor-unified.sh

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Unified doctor orchestrator — parses flags and dispatches to existing scripts.
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

package/scripts/diagnostics/doctor.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Dotfiles Doctor.
 ##
 ## Diagnoses dotfiles environment health by checking dependencies, paths,

package/scripts/diagnostics/drift-dashboard.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # =============================================================================
 # drift-dashboard.sh — Consolidated drift report.
 #

package/scripts/diagnostics/health.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles Health Check Dashboard
 # Usage: dot health [--verbose|-v] [--json|-j] [--fix|-f] [--force|-F]
 

package/scripts/diagnostics/history-analysis.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/mcp-doctor.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## MCP configuration diagnostics and hardening checks.
 ##
 ## Validates MCP (Model Context Protocol) server configurations for security

package/scripts/diagnostics/perf.sh

@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Shell Performance Profiling
 # Usage: dot perf [--json|-j] [--profile|-p] [--runs|-r N] [--target|-t MS]
 
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/dot/ui.sh

package/scripts/diagnostics/scorecard.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles Scorecard
 # Usage: dot scorecard [--json|-j]
 

package/scripts/diagnostics/secret-governance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/security-score.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Security Score Assessment.
 ##
 ## Evaluates system security posture across encryption, SSH, Git, system
@@ -64,7 +65,25 @@ YELLOW="${YELLOW:-}"
 # Scoring
 TOTAL_POINTS=0
 MAX_POINTS=0
-declare -A CATEGORY_SCORES
+# Parallel indexed arrays instead of `declare -A` (bash 4+; macOS ships
+# bash 3.2). CAT_NAMES[i] holds a category name, CAT_SCORES[i] its running
+# total. Category names can contain spaces, so an emulation via dynamic
+# variable names wouldn't work — a linear scan over the handful of
+# categories is fine.
+CAT_NAMES=()
+CAT_SCORES=()
+
+_cat_add() {
+  local name="$1" pts="$2" i
+  for ((i = 0; i < ${#CAT_NAMES[@]}; i++)); do
+    if [[ "${CAT_NAMES[$i]}" == "$name" ]]; then
+      CAT_SCORES[i]=$((CAT_SCORES[i] + pts))
+      return 0
+    fi
+  done
+  CAT_NAMES+=("$name")
+  CAT_SCORES+=("$pts")
+}
 
 add_points() {
   local category="$1"
@@ -74,7 +93,7 @@ add_points() {
 
   TOTAL_POINTS=$((TOTAL_POINTS + points))
   MAX_POINTS=$((MAX_POINTS + max))
-  CATEGORY_SCORES["$category"]=$((${CATEGORY_SCORES[$category]:-0} + points))
+  _cat_add "$category" "$points"
 
   if ! $JSON_OUTPUT && $VERBOSE; then
     local icon
@@ -339,10 +358,11 @@ print_summary() {
     echo "  \"grade\": \"$(get_grade $score)\","
     echo "  \"categories\": {"
     local first=true
-    for cat in "${!CATEGORY_SCORES[@]}"; do
+    local _ci
+    for ((_ci = 0; _ci < ${#CAT_NAMES[@]}; _ci++)); do
       $first || echo ","
       first=false
-      printf "    \"%s\": %d" "$cat" "${CATEGORY_SCORES[$cat]}"
+      printf "    \"%s\": %d" "${CAT_NAMES[$_ci]}" "${CAT_SCORES[$_ci]}"
     done
     echo ""
     echo "  }"

package/scripts/diagnostics/smoke-test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Smoke tests to quickly verify toolchain health after installation/updates.
 
 set -euo pipefail

package/scripts/diagnostics/snapshot.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Snapshot current system/tooling state
 # Usage: dot snapshot [--baseline|-b] [--force|-f]
 

package/scripts/diagnostics/verify.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles post-merge verification checks
 # Runs doctor + status + diff checks and exits non-zero on issues.
 

package/scripts/diagnostics/verify_state.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # MIT License
-# Copyright (c) 2026
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # See LICENSE file for details.
 
 # Script: verify_state.sh

package/scripts/diagnostics/version-locks.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Version Locks Summary
 # Usage: dot locks
 
@@ -30,10 +31,20 @@ resolve_source_dir() {
 
 src_dir=$(resolve_source_dir)
 
+# resolve_source_dir returns the repo root, but since the defaults/ reorg the
+# deployable tree lives under the .chezmoiroot subdir (defaults/). Descend
+# into it so paths like dot_config/... resolve. (Without this the mise lookup
+# below silently reported "config not found" on every run.)
+cm_src="$src_dir"
+if [[ -f "$src_dir/.chezmoiroot" ]]; then
+  _cm_root="$(tr -d '[:space:]' <"$src_dir/.chezmoiroot")"
+  [[ -n "$_cm_root" && -d "$src_dir/$_cm_root" ]] && cm_src="$src_dir/$_cm_root"
+fi
+
 ui_header "Version Locks"
 
 ui_section "mise toolchain"
-mise_config="$src_dir/dot_config/mise/config.toml"
+mise_config="$cm_src/dot_config/mise/conf.d/00-dotfiles.toml"
 if [[ -f "$mise_config" ]]; then
   awk -F= '
     /^\[tools\]/ {in_tools=1; next}

package/scripts/diagnostics/workstation-attestation.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Workstation attestation export.
 ##
 ## Produces a machine-readable evidence record for the current dotfiles

package/scripts/dot/commands/agent.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Agent Mode Commands (extracted from meta.sh)
 # mode list|current|show|set|run|doctor|card|log|checkpoint|conformance
 

package/scripts/dot/commands/agents.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck shell=bash
 #
 # scripts/dot/commands/agents.sh

package/scripts/dot/commands/ai.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Dotfiles AI Commands.
 ##
 ## Provides AI CLI status, setup, RAG query, and bridge commands.
@@ -53,7 +54,8 @@ _ai_extract_version() {
 }
 
 _ai_refresh_status_cache() {
-  local -n ai_entries=$1
+  # Entries passed by value (not a `local -n` nameref — bash 4.3+; macOS bash is 3.2).
+  local ai_entries=("$@")
   local tmp_file
   tmp_file="$(mktemp)"
   mkdir -p "$AI_CACHE_DIR"
@@ -134,27 +136,14 @@ _ai_get_cached_status() {
   cat "$AI_STATUS_CACHE_FILE"
 }
 
-# binary -> mise package mapping
-_ai_mise_pkg() {
-  case "$1" in
-    claude) echo "npm:@anthropic-ai/claude-code" ;;
-    codex) echo "npm:@openai/codex" ;;
-    copilot) echo "npm:@github/copilot" ;;
-    goose) echo "pipx:goose-ai" ;;
-    aider) echo "pipx:aider-chat" ;;
-    opencode) echo "npm:opencode-ai" ;;
-    sgpt) echo "pipx:shell-gpt" ;;
-    gemini) echo "npm:@google/gemini-cli" ;;
-    ollama) echo "aqua:ollama/ollama" ;;
-    kiro-cli) echo "kiro-cli" ;;
-    autohand) echo "npm:autohand-cli" ;;
-    vibe) echo "pipx:mistral-vibe" ;;
-    qwen) echo "npm:@qwen-code/qwen-code" ;;
-    zai) echo "npm:@guizmo-ai/zai-cli" ;;
-    *) echo "" ;;
-  esac
+# Look up field $2 (2=present 0/1, 3=version) for binary $1 from the
+# cached TSV. Replaces a bash-4 associative array for macOS bash 3.2.
+_ai_status_field() {
+  awk -F'\t' -v b="$1" -v f="$2" '$1==b{print $f;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
 }
 
+# _ai_mise_pkg (binary -> mise package map) is defined in lib/dot/ai-install.sh.
+
 cmd_ai_status() {
   ui_header "AI CLI Status"
 
@@ -177,17 +166,9 @@ cmd_ai_status() {
   )
 
   if ! _ai_cache_fresh "$AI_STATUS_CACHE_FILE"; then
-    _ai_refresh_status_cache ai_clis
+    _ai_refresh_status_cache "${ai_clis[@]}"
   fi
 
-  declare -A ai_present=()
-  declare -A ai_version=()
-  local cached_bin cached_present cached_version
-  while IFS=$'\t' read -r cached_bin cached_present cached_version; do
-    ai_present["$cached_bin"]="$cached_present"
-    ai_version["$cached_bin"]="$cached_version"
-  done < <(_ai_get_cached_status)
-
   local -a installed=()
   local -a missing=()
   local current_category=""
@@ -199,8 +180,9 @@ cmd_ai_status() {
       ui_section "$category"
       current_category="$category"
     fi
-    if [[ "${ai_present[$bin]:-0}" == "1" ]]; then
-      ver="${ai_version[$bin]:-installed}"
+    if [[ "$(_ai_status_field "$bin" 2)" == "1" ]]; then
+      ver="$(_ai_status_field "$bin" 3)"
+      [[ -z "$ver" ]] && ver="installed"
       [[ "$bin" == "claude" ]] && ver="${ver%% *}"
       ui_ok "$name" "$ver — $desc"
       installed+=("$name|$bin|$role")
@@ -254,6 +236,10 @@ cmd_ai_status() {
       echo ""
       for entry in "${_ai_to_install[@]}"; do
         IFS='|' read -r name bin <<<"$entry"
+        if [[ "$bin" == "claude" ]]; then
+          install_claude_native "$name"
+          continue
+        fi
         local pkg
         pkg=$(_ai_mise_pkg "$bin")
         if [[ -n "$pkg" ]]; then
@@ -334,7 +320,7 @@ cmd_ai_delegate() {
   # Usage: dot ai delegate "<prompt>" [max-turns] [agent] [timeout]
   if [[ $# -lt 1 ]]; then
     ui_err "Usage" "dot ai delegate \"<prompt>\" [max-turns] [agent] [timeout-secs]"
-    ui_info "Example" "dot ai delegate \"add a CHANGELOG entry for v0.2.504\""
+    ui_info "Example" "dot ai delegate \"add a CHANGELOG entry for v0.2.505\""
     return 1
   fi
   local prompt="$1"

package/scripts/dot/commands/aliases.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Aliases Commands (extracted from tools.sh)
 # aliases list|search|why|stats|cheatsheet|tiers, alias-check
 

package/scripts/dot/commands/appearance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Appearance Commands
 # theme, wallpaper, fonts, tune
 

package/scripts/dot/commands/core.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Dotfiles Core Commands — Core chezmoi operations for the dot CLI.
 ##
 ## Provides apply, sync, update, add, diff, status, remove, cd, and edit

package/scripts/dot/commands/diagnostics.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Diagnostics Commands
 # doctor, heal, health, rollback, drift, history, benchmark, verify, perf,
 # scorecard, conflicts, locks, snapshot, load-bench, chaos, bundle, attest

package/scripts/dot/commands/env-emit.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 #
 # `dot env emit` — render a portable workstation-environment
 # manifest. The output is the canonical "what is installed on this

package/scripts/dot/commands/fleet.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Fleet Commands
 # fleet status|nodes|drift|events|namespace
 
@@ -583,16 +584,21 @@ EOF
     fi
   }
 
-  local running=0
+  # Throttle to `jobs` concurrent workers. `wait -n` (wait for the next
+  # job to finish) is bash 4.3+, but macOS ships bash 3.2 — there it
+  # silently fails and the throttle collapses to unbounded parallelism.
+  # Track PIDs and block on the oldest when at capacity instead; works on
+  # bash 3.2 and 4+ alike.
+  local _pids=()
   while IFS=$'\t' read -r name ssh profile; do
     [[ -n "$name" && -n "$ssh" ]] || continue
     total=$((total + 1))
-    while ((running >= jobs)); do
-      wait -n 2>/dev/null || break
-      running=$((running - 1))
+    while ((${#_pids[@]} >= jobs)); do
+      wait "${_pids[0]}" 2>/dev/null || true
+      _pids=("${_pids[@]:1}")
     done
     _fleet_apply_one "$name" "$ssh" "$effective_cmd" "$tmpdir" &
-    running=$((running + 1))
+    _pids+=("$!")
   done <<<"$entries"
   wait
 

package/scripts/dot/commands/init.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck shell=bash
 #
 # scripts/dot/commands/init.sh

package/scripts/dot/commands/lint.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Lint Command
 # Wraps shellcheck and shfmt with project-specific flags
 

package/scripts/dot/commands/manual.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # dot manual — open or download the dotfiles manual in multiple formats.
 #
 # Usage:

package/scripts/dot/commands/meta.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Meta Commands
 # upgrade, prewarm, docs, learn, keys, sandbox, mcp, mode, agent
 

package/scripts/dot/commands/patterns.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # AI Steering Patterns Management.
 # Usage: dot patterns [list|view|edit] [name]
 

package/scripts/dot/commands/registry.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck shell=bash
 #
 # scripts/dot/commands/registry.sh

package/scripts/dot/commands/restore.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # dot restore - Restore dotfiles from backup or previous state
 # Usage: dot restore [--list|-l|--latest|-L|<backup-id>]
 

package/scripts/dot/commands/secrets.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Secrets/Env Commands
 # secrets-init, secrets, secrets-create, ssh-key, env load
 

package/scripts/dot/commands/security.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Security Commands
 # backup, encrypt-check, firewall, telemetry, dns-doh, lock-screen, usb-safety
 

package/scripts/dot/commands/tools.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Tools Commands
 # tools, new, packages, log-rotate, aliases, alias-check, env, profile
 

package/scripts/fonts/install-nerd-fonts.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/fonts/patch-fonts.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 if [[ $# -lt 1 ]]; then

package/scripts/git-hooks/install.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

package/scripts/git-hooks/pre-commit-audit.sh

@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles Pre-Commit Sentinel (Audit Hook)
 # Prevents secrets, hardcoded paths, and shell hygiene violations.
 
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # ANSI Colors
 RED='\033[0;31m'
@@ -140,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.503 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.505 standards maintained."
   exit 0
 fi

package/scripts/lib/secrets_provider.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Provider-agnostic secrets bridge for dotfiles.
 
 set -euo pipefail

package/scripts/ops/ai-setup.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal AI Toolchain Setup & Authentication.
 
 set -euo pipefail

package/scripts/ops/bundle.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Create an offline bundle of the dotfiles environment for air-gapped systems.
 
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091