@sebastienrousseau/dotfiles 0.2.507 → 0.2.508

package/CHANGELOG.md

@@ -2,6 +2,69 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.508 — 2026-06-30
+
+Makes `dot apply` / `dot update` behave like an OS package-manager update —
+unattended and reliable on macOS — and converts the cross-platform required
+check into an always-runs gate so documentation-only PRs are mergeable.
+
+### Fixed
+
+- **`dot apply` / `dot update` run unattended** (#946). They no longer stall on
+  chezmoi's "file changed since chezmoi last wrote it" prompt, which could not
+  be answered because chezmoi always runs under `gum spin`/captured output (no
+  controlling TTY) and aborted with "could not open a new TTY". They now apply
+  the canonical source with `--force` by default, like `apt`/system updates;
+  local drift to *managed* files yields to the source. Opt back into prompts
+  with `DOTFILES_INTERACTIVE_APPLY=1`, and keep machine-local tweaks in the
+  unmanaged `~/.zshrc.local` or `~/.config/zsh/rc.d.local/*.zsh`.
+- **macOS apply no-op** (#946). The concurrency lock used `flock(1)`, which does
+  not exist on macOS — `! flock` took the "already running" branch and made
+  `dot apply` exit 0 without applying anything. It now falls back to an atomic
+  `mkdir` lock when `flock` is absent (portable to macOS/BSD). The optional
+  AI-provider installer menu is also gated on real interactivity (TTY + not CI).
+
+### Changed
+
+- **CI required check** (#944). `Test on ubuntu-latest` (path-filtered, so it
+  never ran on docs-only PRs and left them unmergeable) is replaced by an
+  always-runs `Cross-Platform Tests` gate that reports success when the OS
+  matrix is skipped and failure when it fails.
+
+## v0.2.507 — 2026-06-30
+
+This release ships the **`dot ai` cockpit** — an interactive Bubble Tea TUI for
+the 18-agent AI fleet with a local Claude gateway — grows the bundled theme
+collection from 150 to 173, and repairs the AI provider install path
+end-to-end.
+
+### Added
+
+- **`dot ai` cockpit** — bare `dot ai` now opens an interactive Bubble Tea TUI
+  to browse, launch, install, and monitor the AI fleet, backed by a local Claude
+  gateway and an 18-agent provider roster (#936).
+- **Floral theme collection** — grew the bundled themes from 150 to 173 (#940).
+
+### Fixed
+
+- **AI installs (`dot ai install`):** three reproducible failures (#942).
+  - *Duplicate banner* — the cockpit shells out to `dot ai install <tool>` once
+    per tool, and each subprocess reprinted the full command banner. `dotExec`
+    now sets `DOT_AI_RAW=1`, matching the streaming path.
+  - *amp* — `@sourcegraph/amp` publishes only prerelease-tagged npm versions,
+    which mise filters out (`@latest` resolves to nothing). Routed to amp's
+    native installer, pre-resolving `AMP_VERSION` to dodge an upstream bug where
+    amp's own version fetch builds a malformed checksum URL.
+  - *Cursor* — `cursor.com/install` User-Agent-sniffs and served marketing HTML
+    to curl (failing the shebang check); now sends a browser UA to fetch the
+    real install script.
+  - Also unified the `dot ai tools` fallback install loop (amp/cursor/goose/grok
+    were silently skipped there) and added an `ai` command summary line.
+- **CI / release reliability:** theme nil-guard and shfmt-absent skip (#939);
+  repinned a stale reusable shell-lint workflow and hardened pin-bumping (#937);
+  the distribute workflows now poll for the release asset before consuming it
+  (#931).
+
 ## v0.2.505 — 2026-06-04
 
 Claude Code is no longer installed through mise/npm. npm 11 silently drops

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.507-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.508-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.507/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.508/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.507) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.508) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/index.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL.
 
 [![Build](https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github)](https://github.com/sebastienrousseau/dotfiles/actions)
-[![Version](https://img.shields.io/badge/Version-v0.2.507-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.507)
+[![Version](https://img.shields.io/badge/Version-v0.2.508-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.508)
 [![Downloads](https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases)
 
 This site is published from the `docs/` directory on `master` and tracks the current workstation baseline, operational guidance, and security material for the repository.
@@ -38,6 +38,6 @@ This site is published from the `docs/` directory on `master` and tracks the cur
 
 ## Current Release
 
-- Current tagged release: [`v0.2.507`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.507)
+- Current tagged release: [`v0.2.508`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.508)
 - Latest release feed: [GitHub releases](https://github.com/sebastienrousseau/dotfiles/releases/latest)
 - Source repository: [sebastienrousseau/dotfiles](https://github.com/sebastienrousseau/dotfiles)

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.507 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.508 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/install.sh

@@ -60,7 +60,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.507)
+  version       The version (tag or branch) to install (default: v0.2.508)
 
 Options:
   --help        Show this help message
@@ -76,7 +76,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.507"
+  local version="v0.2.508"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -106,7 +106,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.507)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.508)."
         fi
         version="$arg"
         version_set=1
@@ -351,7 +351,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.507 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.508 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -360,7 +360,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.507 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.508 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.507",
+  "version": "0.2.508",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.507 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.508 standards maintained."
   exit 0
 fi

package/scripts/ops/chezmoi-apply.sh

@@ -19,9 +19,11 @@ export DOT_COMMAND="apply"
 # (macOS) expanding an empty array under `set -u` is an "unbound
 # variable" error, which would fire on every clean `dot sync`.
 _TMPFILES=()
+_LOCK_DIR=""
 cleanup() {
   set +u
   rm -f "${_TMPFILES[@]}" 2>/dev/null
+  [[ -n "$_LOCK_DIR" ]] && rmdir "$_LOCK_DIR" 2>/dev/null
   set -u
 }
 trap cleanup EXIT
@@ -39,7 +41,9 @@ Environment Variables:
   DOTFILES_CHEZMOI_APPLY_FLAGS    Extra flags for chezmoi apply
   DOTFILES_CHEZMOI_VERBOSE=1      Enable verbose output
   DOTFILES_CHEZMOI_KEEP_GOING=1   Continue on errors
-  DOTFILES_NONINTERACTIVE=1       Force non-interactive mode
+  DOTFILES_NONINTERACTIVE=1       Skip interactive menus (AI provider installer)
+  DOTFILES_INTERACTIVE_APPLY=1    Re-enable chezmoi overwrite prompts
+                                  (apply is unattended/--force by default)
   DOTFILES_ALIAS_STRICT_MODE=1    Run alias governance checks
   DOTFILES_SNAPSHOT_ON_APPLY=1    Create baseline snapshot (default)
   DOTFILES_POST_APPLY_REPAIR=1   Run post-apply repairs (default)
@@ -67,25 +71,55 @@ fi
 has_flag() {
   local needle="$1"
   local arg
+  # Guard the expansion: on bash 3.2 (macOS) iterating an empty array
+  # under `set -u` is an unbound-variable error.
+  [[ ${#args[@]} -eq 0 ]] && return 1
   for arg in "${args[@]}"; do
     [[ "$arg" == "$needle" ]] && return 0
   done
   return 1
 }
 
-# In non-interactive runs, prevent TTY prompts from blocking apply.
-if [[ "${DOTFILES_NONINTERACTIVE:-0}" == "1" ]] && ! has_flag "--force"; then
+# Apply unattended by default, like an OS package manager. chezmoi is
+# always run below under `gum spin` or with its output captured, so it
+# never has a controlling TTY; its "<file> has changed since chezmoi last
+# wrote it" confirmation prompt therefore cannot be answered and aborts
+# the run with "could not open a new TTY". Passing --force applies the
+# canonical source without prompting, so local drift to *managed* files
+# yields to the source — exactly how `apt`/system updates behave. Keep
+# machine-specific tweaks in the unmanaged ~/.zshrc.local or
+# ~/.config/zsh/rc.d.local/*.zsh, which chezmoi never overwrites.
+# Opt back into chezmoi's prompts with DOTFILES_INTERACTIVE_APPLY=1.
+if [[ "${DOTFILES_INTERACTIVE_APPLY:-0}" != "1" ]] && ! has_flag "--force"; then
   args+=("--force")
 fi
 
+# Whether interactive menus (the optional AI-provider installer below) may
+# prompt. Suppressed without a TTY, under CI, or when non-interactive is
+# requested — so unattended runs never hang waiting on input.
+INTERACTIVE=1
+if [[ "${DOTFILES_NONINTERACTIVE:-0}" == "1" ]] || [[ -n "${CI:-}" ]] || [[ ! -t 0 ]] || [[ ! -t 1 ]]; then
+  INTERACTIVE=0
+fi
+
 ui_init
 
-# Prevent concurrent execution
-LOCK_FILE="${XDG_RUNTIME_DIR:-/tmp}/dotfiles-chezmoi-apply.lock"
-exec 9>"$LOCK_FILE"
-if ! flock -n 9; then
+# Prevent concurrent execution. flock(1) is Linux-only — it does not exist
+# on macOS, where `! flock` previously took the "already running" branch and
+# made `dot apply` a silent no-op. Use flock where present, otherwise fall
+# back to an atomic mkdir lock (portable to macOS/BSD).
+_lock_base="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}/dotfiles-chezmoi-apply"
+if command -v flock >/dev/null 2>&1; then
+  exec 9>"${_lock_base}.lock"
+  if ! flock -n 9; then
+    ui_warn "Already running" "Another instance is active"
+    exit 0
+  fi
+elif ! mkdir "${_lock_base}.lock.d" 2>/dev/null; then
   ui_warn "Already running" "Another instance is active"
   exit 0
+else
+  _LOCK_DIR="${_lock_base}.lock.d" # removed by cleanup() on exit
 fi
 
 run_step() {
@@ -187,7 +221,7 @@ for _entry in "${_AI_PROVIDERS[@]}"; do
   fi
 done
 
-if [[ ${#_ai_missing[@]} -gt 0 ]] && [[ "${DOTFILES_NONINTERACTIVE:-0}" != "1" ]]; then
+if [[ ${#_ai_missing[@]} -gt 0 ]] && [[ "$INTERACTIVE" == "1" ]]; then
   if command -v mise &>/dev/null; then
     echo ""
     _ai_install_action=""

package/scripts/ops/chezmoi-update.sh

@@ -14,6 +14,20 @@ if [[ "${DOTFILES_CHEZMOI_VERBOSE:-0}" = "1" ]]; then
   args+=("--verbose")
 fi
 
+# Apply unattended by default (see chezmoi-apply.sh). `chezmoi update` runs
+# `apply` internally, so without --force it blocks on the "<file> has
+# changed since chezmoi last wrote it" prompt — and `dot update` is often
+# run from cron/CI/--async with no TTY, where that prompt aborts the run.
+# --force makes updates land like an OS package-manager update; opt back
+# into prompting with DOTFILES_INTERACTIVE_APPLY=1.
+if [[ "${DOTFILES_INTERACTIVE_APPLY:-0}" != "1" ]]; then
+  _has_force=0
+  if [[ ${#args[@]} -gt 0 ]]; then
+    for _a in "${args[@]}"; do [[ "$_a" == "--force" ]] && _has_force=1; done
+  fi
+  [[ "$_has_force" == "0" ]] && args+=("--force")
+fi
+
 ASYNC=false
 if [[ "${DOTFILES_ASYNC_UPDATE:-0}" = "1" ]]; then
   ASYNC=true