@sebastienrousseau/dotfiles 0.2.504 → 0.2.505

package/CHANGELOG.md

@@ -2,6 +2,65 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.505 — 2026-06-04
+
+Claude Code is no longer installed through mise/npm. npm 11 silently drops
+the platform-native `optionalDependency` on global installs, leaving a stub
+binary that errors with "claude native binary not installed". The fix moves
+Claude Code to Anthropic's native installer and audits the other AI tools for
+the same class of bug. This release also repairs Linux install breaks, hardens
+cross-platform shell parity (bash, fish, nushell), and adds SPDX license
+headers across the source tree.
+
+### Fixed
+
+- **Claude Code install** — switched off the mise `npm:@anthropic-ai/claude-code`
+  pin onto Anthropic's native installer (`~/.local/bin/claude`, self-updating),
+  which fetches the platform binary directly and sidesteps the npm 11
+  optional-dependency bug. Bootstrap (`run_onchange_15-ai-cli-tools`), `dot ai`,
+  and `dot apply`'s "install missing providers" flow all install Claude Code
+  natively now instead of reinstalling the broken package.
+- **Linux install breaks (every distro):** Neovim fetched `nvim-linux64.tar.gz`,
+  an asset Neovim renamed after v0.10.3, so the pinned v0.11.6 download 404'd and
+  aborted the whole provision run — now arch-aware (`nvim-linux-{x86_64,arm64}`)
+  with ARM support; AIChat defaulted to a `latest` tag baked into the asset
+  filename (also a guaranteed 404) — now pinned via `AICHAT_TAG`.
+- **Clipboard (`cb`):** crashed under `set -u` on non-Wayland Linux
+  (`$WAYLAND_DISPLAY` was referenced unguarded); added `command -v` guards, an
+  `xsel` fallback, and clear per-backend (Wayland/X11/WSL) error messages.
+- **Bash parity:** `dot_bashrc` shipped ~14 hardcoded aliases and none of the
+  library functions — it never sourced the shared `~/.config/shell/*` hub. It
+  now loads the same layers zsh does (867 aliases + 185 functions), matching its
+  documented Tier-1 "Full" status.
+- **fish/nushell `goto`/`cdls`:** these change directory but were run through a
+  `bash -c` subshell, so the `cd` was discarded — they silently no-op'd.
+  Reimplemented natively (fish functions; nushell `def --env`, the only form
+  whose `cd` propagates to the caller).
+- **Docs:** fixed 18 hardcoded absolute markdown links (`/home/seb/.dotfiles/…`,
+  broken on GitHub and on any other machine) to file-relative paths.
+
+### Changed
+
+- **Removed two redundant mise pins** uncovered while auditing the other AI
+  tools: `npm:codex-cli` (a legacy package — codex.js — that collided on the
+  `codex` bin name; Codex is already provided by the native `codex` pin) and
+  `npm:opencode-ai` (a broken-wrapper duplicate of the native `opencode` pin).
+  Both shims already resolved to the native builds, so runtime behaviour is
+  unchanged. copilot/gemini/qwen/zai were checked and are unaffected.
+- **Extracted** the shared Claude native-installer helper and the AI
+  provider→mise-package map into `lib/dot/ai-install.sh`, removing duplication
+  across `dot ai` and `dot apply`.
+- **Cross-distro robustness:** Debian/Ubuntu now symlink `~/.local/bin/{bat,fd}`
+  to `batcat`/`fdfind`; a missing apt/dnf/pacman warns loudly instead of silently
+  installing nothing; WSL gets a best-effort `wslu` install for `wslview`. fish
+  and nushell now export `EDITOR`/`VISUAL`/`PAGER` to match the zsh/bash profile.
+- **Licensing:** added `SPDX-License-Identifier: MIT` headers (SPDX-first / REUSE
+  form) and normalized the copyright line to `Sebastien Rousseau` across 831
+  repo-only source files; dropped the contradictory `All rights reserved.`.
+- **README** — fixed the OpenSSF Best Practices badge (was linking to the
+  new-project form with a static label; now the live `cii/percentage/12840`
+  endpoint linked to the real project).
+
 ## v0.2.504 — 2026-06-03
 
 First-class **stock-macOS** support: the installer and the entire `dot` CLI

package/README.md

@@ -10,11 +10,11 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.504-blue?style=for-the-badge" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.505-blue?style=for-the-badge" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
-  <a href="https://www.bestpractices.dev/projects/new"><img src="https://img.shields.io/badge/OpenSSF%20Best%20Practices-in%20progress-yellow?style=for-the-badge" alt="OpenSSF Best Practices" /></a>
+  <a href="https://www.bestpractices.dev/projects/12840"><img src="https://img.shields.io/cii/percentage/12840?style=for-the-badge&label=OpenSSF%20Best%20Practices" alt="OpenSSF Best Practices" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=for-the-badge" alt="License: MIT" /></a>
 </p>
 
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.504/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.505/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh
@@ -300,7 +300,7 @@ See the [Migration Guide](docs/operations/MIGRATION.md) for version upgrades.
 - **Pattern library** (`dot patterns`) — architect, hardener, and refactor patterns bundled in `dot_config/ai/patterns/`
 - **MCP policy enforcement** (`dot mcp`) — validate the Model Context Protocol registry against policy
 - **AI commit messages** (`dot commit`) — conventional commits generated from the staged diff
-- **AI tools** (`dot ai`) — Claude Code, Codex, GitHub Copilot, Gemini CLI, and friends managed via Mise
+- **AI tools** (`dot ai`) — Codex, GitHub Copilot, Gemini CLI, and friends managed via Mise; Claude Code via Anthropic's native installer
 - **Attestation logs** — every agent session is logged with a policy hash and an outcome
 
 </details>

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.504) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.505) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/index.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL.
 
 [![Build](https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github)](https://github.com/sebastienrousseau/dotfiles/actions)
-[![Version](https://img.shields.io/badge/Version-v0.2.504-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.504)
+[![Version](https://img.shields.io/badge/Version-v0.2.505-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.505)
 [![Downloads](https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases)
 
 This site is published from the `docs/` directory on `master` and tracks the current workstation baseline, operational guidance, and security material for the repository.
@@ -38,6 +38,6 @@ This site is published from the `docs/` directory on `master` and tracks the cur
 
 ## Current Release
 
-- Current tagged release: [`v0.2.504`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.504)
+- Current tagged release: [`v0.2.505`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.505)
 - Latest release feed: [GitHub releases](https://github.com/sebastienrousseau/dotfiles/releases/latest)
 - Source repository: [sebastienrousseau/dotfiles](https://github.com/sebastienrousseau/dotfiles)

package/docs/interop/A2A.md

@@ -8,8 +8,8 @@ The repository now ships an agent card and an A2A-ready discovery document.
 
 Artifacts:
 
-- [agent-card.json](/home/seb/.dotfiles/dot_config/dotfiles/agent-card.json)
-- [agent.json](/home/seb/.dotfiles/.well-known/agent.json)
+- [agent-card.json](../../defaults/dot_config/dotfiles/agent-card.json)
+- [agent.json](../../.well-known/agent.json)
 
 Core properties:
 

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.504 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.505 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/manual/02-tutorials/01-first-install.md

@@ -184,7 +184,7 @@ After `dot doctor` reports a healthy score, you have:
 | **Editor** | Neovim with lazy.nvim + LSP + theme-synced colorscheme |
 | **Terminal** | Ghostty/Alacritty/Kitty/WezTerm configs (pick whichever is installed) |
 | **Git** | Signed commits, delta diff, conventional commit template |
-| **AI tooling** | Claude Code, Codex, Copilot CLI, Gemini CLI via mise |
+| **AI tooling** | Codex, Copilot CLI, Gemini CLI via mise; Claude Code via Anthropic's native installer |
 | **Secret store** | Age key, SOPS config, `dot secrets` command ready |
 | **Security** | Gitleaks, detect-secrets baseline, signed attestation log |
 | **Theme engine** | K-Means wallpaper extractor, system + custom wallpaper discovery |

package/docs/operations/RELEASE_PIPELINE.md

@@ -59,7 +59,7 @@ where dependencies allow.
 | `security-release.yml` (manifest job) | `release.published`, dispatch | Build `ALL_SHA256SUMS` over every release asset, Cosign-sign it. | `ALL_SHA256SUMS` + `.sig` + `.pem`. |
 | `release-distribute-homebrew.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, regenerate `install/homebrew/dot.rb`, push branch + PR to `sebastienrousseau/homebrew-tap`. | One PR on the tap repo. |
 | `release-distribute-scoop.yml` | `release.published`, dispatch | Hash `dot-VERSION.zip`, rewrite `install/scoop/dot.json` via jq (both 64bit + arm64 point at same zip), PR to `sebastienrousseau/scoop-bucket`. | One PR on the bucket repo. |
-| `release-distribute-aur.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, rewrite `pkgver` + `sha256sums` in `install/aur/PKGBUILD`, regenerate `.SRCINFO` via dockerised `makepkg`, push to `ssh://aur@aur.archlinux.org/dotfiles-git.git`. | One commit on AUR. |
+| `release-distribute-aur.yml` | `release.published`, dispatch | Hash `dot-VERSION.tar.gz`, rewrite `pkgver` + `sha256sums` in `install/aur/PKGBUILD`, regenerate `.SRCINFO` via dockerised `makepkg`, push to `ssh://aur@aur.archlinux.org/dot-cli-git.git`. | One commit on AUR. |
 | `release-attestation-check.yml` | weekly cron + dispatch | Verify the latest release carries the full attestation bundle (SBOM + sig + cert + intoto + manifest + sig + cert). | Opens or comments on a tracking issue. |
 
 ## Why `created` vs `published`
@@ -93,7 +93,7 @@ manifest job after late asset uploads picks up the new state and the
 |---|---|---|
 | Homebrew | `sebastienrousseau/homebrew-tap` | Tap repo exists (currently bare README + LICENSE). Workflow creates the `Formula/dot.rb` path on first publish. |
 | Scoop | `sebastienrousseau/scoop-bucket` | Bucket repo exists (currently bare). Workflow creates `bucket/dot.json` on first publish. |
-| AUR | `ssh://aur@aur.archlinux.org/dotfiles-git.git` | **Manual one-time step**: the maintainer must create the package entry via the AUR web UI before the workflow's `git clone` can succeed. The workflow exits with a clear error message on the first run if the repo doesn't exist. |
+| AUR | `ssh://aur@aur.archlinux.org/dot-cli-git.git` | **Manual one-time step**: the maintainer must create the package entry via the AUR web UI before the workflow's `git clone` can succeed. The workflow exits with a clear error message on the first run if the repo doesn't exist. |
 
 ## Verifying a release
 
@@ -105,7 +105,7 @@ independently.
 
 ## Known caveats
 
-- **AUR `pkgname=dotfiles-git`**: AUR's `-git` convention means
+- **AUR `pkgname=dot-cli-git`**: AUR's `-git` convention means
   "tracks git HEAD", but the workflow publishes tagged stable
   releases. Either rename to plain `dotfiles` in
   `install/aur/PKGBUILD` and register that package, or accept the

package/docs/operations/TRUSTED_AGENT_WORKSTATION.md

@@ -20,12 +20,12 @@ It defines a signed, local-first workstation baseline for agentic development on
 
 The source of truth lives in tracked JSON artifacts:
 
-- [policy-bundles.json](/home/seb/.dotfiles/dot_config/dotfiles/policy-bundles.json)
-- [agent-profiles.json](/home/seb/.dotfiles/dot_config/dotfiles/agent-profiles.json)
-- [mcp-policy.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-policy.json)
-- [mcp-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-registry.json)
-- [model-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/model-registry.json)
-- [prompt-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/prompt-registry.json)
+- [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json)
+- [agent-profiles.json](../../defaults/dot_config/dotfiles/agent-profiles.json)
+- [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json)
+- [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json)
+- [model-registry.json](../../defaults/dot_config/dotfiles/model-registry.json)
+- [prompt-registry.json](../../defaults/dot_config/dotfiles/prompt-registry.json)
 
 ## Enterprise path
 

package/docs/security/AUTOMATION_SECRETS.md

@@ -21,6 +21,6 @@ render_with_liquid: false
 ## Provisioning notes
 
 1. Store the SSH signing private key in GitHub Actions as `ACTIONS_BOT_SIGNING_KEY`.
-2. Store the matching public key in [allowed_signers](/home/seb/.dotfiles/dot_config/git/allowed_signers).
+2. Store the matching public key in [allowed_signers](../../defaults/dot_config/git/allowed_signers.tmpl).
 3. Rotate the key on personnel or workstation change.
 4. Fail closed when secrets are absent.

package/docs/security/MCP_POLICY.md

@@ -21,9 +21,9 @@ Properties:
 
 ## Policy artifact
 
-The source of truth lives in [mcp-policy.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-policy.json).
-Approved package pins live in [mcp-lock.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-lock.json).
-Tracked server registry entries live in [mcp-registry.json](/home/seb/.dotfiles/dot_config/dotfiles/mcp-registry.json).
+The source of truth lives in [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json).
+Approved package pins live in [mcp-lock.json](../../defaults/dot_config/dotfiles/mcp-lock.json).
+Tracked server registry entries live in [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json).
 
 Current defaults:
 
@@ -75,4 +75,4 @@ Current approved refs:
 - active servers match the tracked registry entries
 - remote HTTP transports are HTTPS and OAuth-backed
 
-Policy bundle baselines live in [policy-bundles.json](/home/seb/.dotfiles/dot_config/dotfiles/policy-bundles.json).
+Policy bundle baselines live in [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json).

package/docs/security/SECURITY_CHECKLIST.md

@@ -11,7 +11,7 @@ Use this checklist before cutting any new release (e.g., `v0.x.x`) to ensure sup
 - [ ] **Pinned Version**: Update `install.sh` `VERSION` variable to match the release tag.
 - [ ] **Docs Sync**: Ensure `README.md` and `.github/PULL_REQUEST_TEMPLATE.md` installer URLs point to the new tag (not `main`).
 - [ ] **Clean Build**: Verify `install.sh` does not curl random scripts from third parties without pinning.
-- [ ] **SOUP Register**: Review [SOUP_REGISTER.md](/home/seb/.dotfiles/docs/security/SOUP_REGISTER.md) and confirm all active external components have an owner and validation path.
+- [ ] **SOUP Register**: Review [SOUP_REGISTER.md](SOUP_REGISTER.md) and confirm all active external components have an owner and validation path.
 
 ## 2. Secrets & Leak Prevention
 

package/docs/security/SOUP_REGISTER.md

@@ -12,13 +12,13 @@ Controlled inventory for software of unknown pedigree used by the dotfiles platf
 
 | Component | Source | Version control | Verification path | Owner | Status |
 | :--- | :--- | :--- | :--- | :--- | :--- |
-| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](/home/seb/.dotfiles/install/lib/package_managers.sh) | Repo maintainer | Conditional |
+| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](../../install/lib/package_managers.sh) | Repo maintainer | Conditional |
 | Chezmoi installer | `get.chezmoi.io` | Pinned by `CHEZMOI_INSTALLER_SHA256` when used | SHA-256 in `install/lib/chezmoi.sh` | Repo maintainer | Controlled |
 | GitHub Actions marketplace actions | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pins | Repo maintainer | Controlled |
-| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](/home/seb/.dotfiles/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
-| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](/home/seb/.dotfiles/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
 | Checkov action | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pin | Repo maintainer | Controlled |
-| Nix inputs | GitHub flakes | Locked in [flake.lock](/home/seb/.dotfiles/flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
+| Nix inputs | GitHub flakes | Locked in [flake.lock](../../flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
 | GitHub release metadata queries | GitHub API | Discovery only, not release validation | `update-deps.yml` query path | Repo maintainer | Monitored |
 
 ## Validation record

package/install.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
 # Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"
 # (or ./install.sh locally)
@@ -59,7 +60,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.504)
+  version       The version (tag or branch) to install (default: v0.2.505)
 
 Options:
   --help        Show this help message
@@ -75,7 +76,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.504"
+  local version="v0.2.505"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -105,7 +106,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.504)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.505)."
         fi
         version="$arg"
         version_set=1
@@ -350,7 +351,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.504 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.505 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -359,7 +360,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.504 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.505 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.504",
+  "version": "0.2.505",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/ci/check-copyright-headers.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.

package/scripts/ci/check-shell-preamble.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.

package/scripts/demo/record.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 OUT="${1:-$HOME/.dotfiles/docs/demo/demo.gif}"

package/scripts/diagnostics/a2a-conformance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## A2A v0.3 and agent card conformance validation.
 
 set -euo pipefail

package/scripts/diagnostics/alias-governance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Alias governance checks:
 # - duplicate alias names
 # - risky overrides must be gated

package/scripts/diagnostics/aliases-cheatsheet.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/aliases-manifest.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Emit alias manifest as TSV:
 # name<TAB>value<TAB>file<TAB>line
 

package/scripts/diagnostics/benchmark.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Shell Performance Benchmark.
 ##
 ## Measures shell startup time with per-component profiling. Uses hyperfine

package/scripts/diagnostics/conflicts.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Alias/Command Conflicts Report
 # Usage: dot conflicts
 

package/scripts/diagnostics/doctor-unified.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Unified doctor orchestrator — parses flags and dispatches to existing scripts.
 set -euo pipefail
 

package/scripts/diagnostics/doctor.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Dotfiles Doctor.
 ##
 ## Diagnoses dotfiles environment health by checking dependencies, paths,

package/scripts/diagnostics/drift-dashboard.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # =============================================================================
 # drift-dashboard.sh — Consolidated drift report.
 #

package/scripts/diagnostics/health.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles Health Check Dashboard
 # Usage: dot health [--verbose|-v] [--json|-j] [--fix|-f] [--force|-F]
 

package/scripts/diagnostics/history-analysis.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/mcp-doctor.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## MCP configuration diagnostics and hardening checks.
 ##
 ## Validates MCP (Model Context Protocol) server configurations for security

package/scripts/diagnostics/perf.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Shell Performance Profiling
 # Usage: dot perf [--json|-j] [--profile|-p] [--runs|-r N] [--target|-t MS]
 

package/scripts/diagnostics/scorecard.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles Scorecard
 # Usage: dot scorecard [--json|-j]
 

package/scripts/diagnostics/secret-governance.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

package/scripts/diagnostics/security-score.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Security Score Assessment.
 ##
 ## Evaluates system security posture across encryption, SSH, Git, system

package/scripts/diagnostics/smoke-test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Smoke tests to quickly verify toolchain health after installation/updates.
 
 set -euo pipefail

package/scripts/diagnostics/snapshot.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Snapshot current system/tooling state
 # Usage: dot snapshot [--baseline|-b] [--force|-f]
 

package/scripts/diagnostics/verify.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles post-merge verification checks
 # Runs doctor + status + diff checks and exits non-zero on issues.
 

package/scripts/diagnostics/verify_state.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # MIT License
-# Copyright (c) 2026
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # See LICENSE file for details.
 
 # Script: verify_state.sh

package/scripts/diagnostics/version-locks.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Version Locks Summary
 # Usage: dot locks
 

package/scripts/diagnostics/workstation-attestation.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 ## Workstation attestation export.
 ##
 ## Produces a machine-readable evidence record for the current dotfiles

package/scripts/dot/commands/agent.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # Dotfiles CLI - Agent Mode Commands (extracted from meta.sh)
 # mode list|current|show|set|run|doctor|card|log|checkpoint|conformance
 

package/scripts/dot/commands/agents.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck shell=bash
 #
 # scripts/dot/commands/agents.sh