@sebastienrousseau/dotfiles 0.2.507 → 0.2.510

package/scripts/dot/commands/completion.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+## `dot completion <bash|zsh|fish|nu>` — emit shell completion for `dot`,
+## generated from the canonical _dot_help_specs registry in bin/dot. Using one
+## source of truth keeps all four shells in sync (the previously hand-maintained
+## fish/nushell lists drifted and referenced non-existent commands).
+##
+## Usage:
+##   dot completion bash  >> ~/.bashrc.d/dot.bash
+##   dot completion zsh   > "${fpath[1]}/_dot"
+##   dot completion fish  > ~/.config/fish/completions/dot.fish
+##   dot completion nu    >> ~/.config/nushell/completions.nu
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+_completion_dot_cli() {
+  local src
+  src="$(resolve_source_dir)"
+  printf '%s/bin/dot\n' "$src"
+}
+
+# Emit "name<TAB>description" for every top-level command (a _dot_help_specs
+# field-2 entry with no space; entries containing a space are subcommands).
+# Strip ": ' from descriptions so they can't break any shell's quoting.
+_completion_commands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 !~ / / {
+      name = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", name)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      if (name != "") print name "\t" desc
+    }
+  ' "$cli"
+}
+
+# Emit "parent<TAB>child<TAB>description" for every subcommand (a field-2
+# entry that contains a space, e.g. "theme list" -> parent=theme child=list).
+_completion_subcommands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 ~ / / {
+      full = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", full)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      parent = full; sub(/ .*/, "", parent)
+      child = full; sub(/^[^ ]+ /, "", child)
+      if (parent != "" && child != "") print parent "\t" child "\t" desc
+    }
+  ' "$cli"
+}
+
+gen_bash() {
+  local names
+  names="$(_completion_commands | cut -f1 | tr '\n' ' ')"
+  printf '# dot bash completion — generated by: dot completion bash\n'
+  printf "complete -W '%s' dot\n" "${names% }"
+}
+
+gen_zsh() {
+  local name desc
+  printf '#compdef dot\n# generated by: dot completion zsh\n'
+  printf '_dot() {\n  local -a commands\n  commands=(\n'
+  while IFS=$'\t' read -r name desc; do
+    printf "    '%s:%s'\n" "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  )\n  _describe '\''command'\'' commands\n}\n_dot "$@"\n'
+}
+
+gen_fish() {
+  local name desc
+  printf '# dot fish completion — generated by: dot completion fish\n'
+  printf 'complete -c dot -f\n'
+  while IFS=$'\t' read -r name desc; do
+    printf 'complete -c dot -n "__fish_use_subcommand" -a %s -d "%s"\n' "$name" "$desc"
+  done < <(_completion_commands)
+  local parent child
+  while IFS=$'\t' read -r parent child desc; do
+    printf 'complete -c dot -n "__fish_seen_subcommand_from %s" -a %s -d "%s"\n' \
+      "$parent" "$child" "$desc"
+  done < <(_completion_subcommands)
+}
+
+gen_nu() {
+  local name desc
+  printf '# dot nushell completion — generated by: dot completion nu\n'
+  printf 'export extern dot [\n  command?: string@dot_commands\n  ...args: string\n]\n'
+  printf 'def dot_commands [] {\n  [\n'
+  while IFS=$'\t' read -r name desc; do
+    printf '    { value: "%s", description: "%s" }\n' "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  ]\n}\n'
+}
+
+usage() {
+  cat <<'USAGE'
+Usage: dot completion <bash|zsh|fish|nu>
+
+Generate shell completion for `dot` from the canonical command registry.
+
+  dot completion bash  >> ~/.bashrc.d/dot.bash
+  dot completion zsh   > "${fpath[1]}/_dot"
+  dot completion fish  > ~/.config/fish/completions/dot.fish
+  dot completion nu    >> ~/.config/nushell/completions.nu
+USAGE
+}
+
+# Dispatch: $1 is the command name ("completion"); $2 is the target shell.
+case "${2:-}" in
+  bash) gen_bash ;;
+  zsh) gen_zsh ;;
+  fish) gen_fish ;;
+  nu | nushell) gen_nu ;;
+  "" | -h | --help | help) usage ;;
+  *)
+    echo "dot completion: unknown shell '${2}' (want: bash|zsh|fish|nu)" >&2
+    exit 1
+    ;;
+esac

package/scripts/dot/commands/core.sh

@@ -129,6 +129,10 @@ cmd_commit() {
   run_script "dot_local/bin/executable_git-ai-commit" "Git AI commit script" "$@"
 }
 
+cmd_uninstall() {
+  run_script "scripts/uninstall.sh" "Uninstall script" "$@"
+}
+
 cmd_clean_cache() {
   ui_info "Cache" "Clearing shell initialization caches"
   local cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}"
@@ -185,6 +189,10 @@ case "${1:-}" in
     shift
     cmd_clean_cache "$@"
     ;;
+  uninstall)
+    shift
+    cmd_uninstall "$@"
+    ;;
   *)
     echo "Unknown core command: ${1:-}" >&2
     exit 1

package/scripts/dot/commands/diagnostics.sh

@@ -110,6 +110,14 @@ cmd_chaos() {
   run_script "scripts/ops/chaos.sh" "Chaos engineering script" "$@"
 }
 
+cmd_teleport() {
+  run_script "scripts/ops/teleport.sh" "Teleport script" "$@"
+}
+
+cmd_secret_audit() {
+  run_script "scripts/diagnostics/secret-governance.sh" "Secret governance script" "$@"
+}
+
 cmd_bundle() {
   run_script "scripts/ops/bundle.sh" "Offline bundle script" "$@"
 }
@@ -207,6 +215,14 @@ case "${1:-}" in
     shift
     cmd_chaos "$@"
     ;;
+  teleport)
+    shift
+    cmd_teleport "$@"
+    ;;
+  secret-audit)
+    shift
+    cmd_secret_audit "$@"
+    ;;
   bundle)
     shift
     cmd_bundle "$@"

package/scripts/dot/commands/fleet.sh

@@ -202,9 +202,13 @@ cmd_fleet_drift() {
       local count="${1:-20}"
       tail -n "$count" "$_DRIFT_HISTORY_FILE" | while IFS= read -r line; do
         local time status file_count
-        time="$(printf '%s' "$line" | jq -r '.time' 2>/dev/null || echo "?")"
-        status="$(printf '%s' "$line" | jq -r '.status' 2>/dev/null || echo "?")"
-        file_count="$(printf '%s' "$line" | jq '.files | length' 2>/dev/null || echo 0)"
+        # One jq per line (was three: .time, .status, .files|length).
+        IFS=$'\t' read -r time status file_count < <(
+          printf '%s' "$line" | jq -r '[.time, .status, (.files | length)] | @tsv' 2>/dev/null
+        )
+        [[ -n "$time" ]] || time="?"
+        [[ -n "$status" ]] || status="?"
+        [[ -n "$file_count" ]] || file_count=0
         if [[ "$status" == "clean" ]]; then
           ui_ok "$time" "clean"
         else

package/scripts/dot/commands/lint.sh

@@ -19,6 +19,33 @@ dot_ui_command_banner "Lint" "${1:-}"
 SHELLCHECK_ARGS=(--severity=error -e SC1091 -e SC2030 -e SC2031)
 SHFMT_ARGS=(-i 2 -ci)
 
+# True only if the file's shebang names a shell that both shellcheck and shfmt
+# can process. The old `grep -qiE 'shell|bash|sh'` matched loosely — "sh" hit
+# "fish", and `file` output pulled in python3 scripts — so non-shell files
+# landed in the lint set and produced spurious SC1071 / shfmt parse "errors".
+_lint_is_shell() {
+  local first interp
+  first="$(head -1 "$1" 2>/dev/null)"
+  case "$first" in '#!'*) ;; *) return 1 ;; esac
+  interp="${first#\#!}"
+  interp="${interp#"${interp%%[![:space:]]*}"}" # ltrim
+  case "$interp" in
+    */env[[:space:]]*)
+      interp="${interp#*/env}"
+      interp="${interp#"${interp%%[![:space:]]*}"}"
+      interp="${interp%%[[:space:]]*}"
+      ;;
+    *)
+      interp="${interp%%[[:space:]]*}"
+      interp="${interp##*/}"
+      ;;
+  esac
+  case "$interp" in
+    sh | bash | dash | ksh | mksh | ash) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 cmd_lint() {
   local mode="${1:-all}"
   local src_dir
@@ -40,11 +67,10 @@ cmd_lint() {
   chezmoi_src="$(resolve_chezmoi_source_dir)"
   [[ -z "$chezmoi_src" ]] && chezmoi_src="$src_dir"
 
-  # dot_local/bin/executable_* scripts (shell scripts only)
+  # dot_local/bin/executable_* scripts — shell scripts only (skip python/zsh/etc
+  # by inspecting the shebang, so shellcheck/shfmt never see files they can't parse).
   while IFS= read -r -d '' f; do
-    if file "$f" 2>/dev/null | grep -qiE 'shell|bash|sh'; then
-      files+=("$f")
-    elif head -1 "$f" 2>/dev/null | grep -qE '^#!.*(bash|sh)'; then
+    if _lint_is_shell "$f"; then
       files+=("$f")
     fi
   done < <(find "$chezmoi_src/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
@@ -69,17 +95,16 @@ cmd_lint() {
       if has_command shellcheck; then
         ui_section "ShellCheck"
         echo ""
-        local sc_fail=0
-        for f in "${files[@]}"; do
-          if ! shellcheck "${SHELLCHECK_ARGS[@]}" "$f" 2>/dev/null; then
-            sc_fail=$((sc_fail + 1))
-          fi
-        done
-        if [[ "$sc_fail" -eq 0 ]]; then
+        # One shellcheck invocation over all files (was one fork per file).
+        # gcc format is one line per issue, so failing files = unique paths.
+        local sc_out
+        sc_out="$(shellcheck -f gcc "${SHELLCHECK_ARGS[@]}" "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$sc_out" ]]; then
           ui_ok "shellcheck" "$total files clean"
         else
-          sc_errors=$sc_fail
-          ui_err "shellcheck" "$sc_fail file(s) with errors"
+          printf '%s\n' "$sc_out"
+          sc_errors=$(printf '%s\n' "$sc_out" | cut -d: -f1 | sort -u | grep -c .)
+          ui_err "shellcheck" "$sc_errors file(s) with errors"
         fi
         echo ""
       else
@@ -91,17 +116,15 @@ cmd_lint() {
       if has_command shfmt; then
         ui_section "shfmt"
         echo ""
-        local fmt_fail=0
-        for f in "${files[@]}"; do
-          if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
-            fmt_fail=$((fmt_fail + 1))
-          fi
-        done
-        if [[ "$fmt_fail" -eq 0 ]]; then
+        # `shfmt -l` lists files needing formatting in one invocation
+        # (was `shfmt -d` per file).
+        local fmt_list
+        fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$fmt_list" ]]; then
           ui_ok "shfmt" "$total files formatted correctly"
         else
-          fmt_errors=$fmt_fail
-          ui_err "shfmt" "$fmt_fail file(s) need formatting"
+          fmt_errors=$(printf '%s\n' "$fmt_list" | grep -c .)
+          ui_err "shfmt" "$fmt_errors file(s) need formatting"
         fi
         echo ""
       else
@@ -118,17 +141,19 @@ cmd_lint() {
       fi
       ui_section "Auto-fixing with shfmt"
       echo ""
-      local fixed=0
-      for f in "${files[@]}"; do
-        if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
+      # Find files needing formatting in one `shfmt -l` pass, then only
+      # rewrite that (usually small) set — was `shfmt -d` per file.
+      local fmt_list fixed=0
+      fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+      if [[ -z "$fmt_list" ]]; then
+        ui_ok "shfmt" "All files already formatted"
+      else
+        while IFS= read -r f; do
+          [[ -n "$f" ]] || continue
           shfmt "${SHFMT_ARGS[@]}" -w "$f"
           ui_ok "fixed" "${f#"$src_dir/"}"
           fixed=$((fixed + 1))
-        fi
-      done
-      if [[ "$fixed" -eq 0 ]]; then
-        ui_ok "shfmt" "All files already formatted"
-      else
+        done <<<"$fmt_list"
         ui_ok "shfmt" "$fixed file(s) reformatted"
       fi
       echo ""

package/scripts/dot/commands/secrets.sh

@@ -152,26 +152,80 @@ cmd_secrets_list() {
 }
 
 cmd_env_load() {
-  local bucket="${1:-ai}" data_file key value count=0
+  # Usage: dot secrets load [<bucket>] [--shell posix|fish|nu]
+  # Emits shell code to set the bucket's secrets as env vars, in the target
+  # shell's dialect so it works beyond POSIX:
+  #   posix (default):  eval "$(dot secrets load ai)"
+  #   fish:             dot secrets load ai --shell fish | source
+  #   nu:               load-env (dot secrets load ai --shell nu | from nuon)
+  local bucket="ai" dialect="posix" data_file key value count=0
+  local -a keys=() values=()
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --shell)
+        dialect="${2:-posix}"
+        shift 2
+        ;;
+      --shell=*)
+        dialect="${1#*=}"
+        shift
+        ;;
+      -*) die "Unknown flag: $1 (usage: dot secrets load [<bucket>] [--shell posix|fish|nu])" ;;
+      *)
+        bucket="$1"
+        shift
+        ;;
+    esac
+  done
+
   data_file="$(dot_data_file)"
   [[ -f "$data_file" ]] || die "Missing data file: $data_file"
 
   while IFS= read -r key; do
     value="$(dot_secrets_get "$key" || true)"
     if [[ -n "$value" ]]; then
-      # shell-safe export lines intended for: eval "$(dot env load <bucket>)"
-      printf "export %s=%q\n" "$key" "$value"
+      keys+=("$key")
+      values+=("$value")
       count=$((count + 1))
     fi
   done < <(dot_secrets_bucket_keys "$data_file" "$bucket")
 
-  if [[ "$count" -eq 0 ]]; then
-    die "No secrets loaded for bucket: $bucket"
-  fi
+  [[ "$count" -gt 0 ]] || die "No secrets loaded for bucket: $bucket"
+
+  local i k v esc
+  case "$dialect" in
+    posix | sh | bash | zsh)
+      for i in "${!keys[@]}"; do
+        printf 'export %s=%q\n' "${keys[$i]}" "${values[$i]}"
+      done
+      ;;
+    fish)
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\'/\\\'}" # fish single-quote escaping
+        printf "set -gx %s '%s'\n" "${keys[$i]}" "$esc"
+      done
+      ;;
+    nu | nushell)
+      # Emit a NUON record for: load-env (dot secrets load <bucket> --shell nu | from nuon)
+      printf '{\n'
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\"/\\\"}" # double-quote escaping
+        printf '  "%s": "%s"\n' "${keys[$i]}" "$esc"
+      done
+      printf '}\n'
+      ;;
+    *)
+      die "Unknown shell dialect: $dialect (want: posix|fish|nu)"
+      ;;
+  esac
 }
 
 cmd_secrets_load() {
-  cmd_env_load "${1:-ai}"
+  cmd_env_load "$@"
 }
 
 # Dispatch

package/scripts/dot/commands/security.sh

@@ -40,6 +40,10 @@ cmd_usb_safety() {
   run_script "scripts/security/usb-safety.sh" "USB safety script" "$@"
 }
 
+cmd_policy() {
+  run_script "scripts/security/enforce-policies.sh" "Policy enforcement script" "$@"
+}
+
 # Dispatch
 case "${1:-}" in
   backup)
@@ -70,6 +74,10 @@ case "${1:-}" in
     shift
     cmd_usb_safety "$@"
     ;;
+  policy)
+    shift
+    cmd_policy "$@"
+    ;;
   *)
     echo "Unknown security command: ${1:-}" >&2
     exit 1

package/scripts/dot/powershell/Dot.psm1

@@ -126,7 +126,7 @@ function Invoke-DotHelp {
     Write-Host ''
     Write-Host "  Version    v$version"
     Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
-    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/master/docs/manual/"
+    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/main/docs/manual/"
     Write-Host ''
     Write-Host 'Native PowerShell commands (no bash required):'
     Write-Host ''

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.507 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.510 standards maintained."
   exit 0
 fi

package/scripts/ops/chezmoi-apply.sh

@@ -19,9 +19,11 @@ export DOT_COMMAND="apply"
 # (macOS) expanding an empty array under `set -u` is an "unbound
 # variable" error, which would fire on every clean `dot sync`.
 _TMPFILES=()
+_LOCK_DIR=""
 cleanup() {
   set +u
   rm -f "${_TMPFILES[@]}" 2>/dev/null
+  [[ -n "$_LOCK_DIR" ]] && rmdir "$_LOCK_DIR" 2>/dev/null
   set -u
 }
 trap cleanup EXIT
@@ -39,7 +41,9 @@ Environment Variables:
   DOTFILES_CHEZMOI_APPLY_FLAGS    Extra flags for chezmoi apply
   DOTFILES_CHEZMOI_VERBOSE=1      Enable verbose output
   DOTFILES_CHEZMOI_KEEP_GOING=1   Continue on errors
-  DOTFILES_NONINTERACTIVE=1       Force non-interactive mode
+  DOTFILES_NONINTERACTIVE=1       Skip interactive menus (AI provider installer)
+  DOTFILES_INTERACTIVE_APPLY=1    Re-enable chezmoi overwrite prompts
+                                  (apply is unattended/--force by default)
   DOTFILES_ALIAS_STRICT_MODE=1    Run alias governance checks
   DOTFILES_SNAPSHOT_ON_APPLY=1    Create baseline snapshot (default)
   DOTFILES_POST_APPLY_REPAIR=1   Run post-apply repairs (default)
@@ -67,25 +71,55 @@ fi
 has_flag() {
   local needle="$1"
   local arg
+  # Guard the expansion: on bash 3.2 (macOS) iterating an empty array
+  # under `set -u` is an unbound-variable error.
+  [[ ${#args[@]} -eq 0 ]] && return 1
   for arg in "${args[@]}"; do
     [[ "$arg" == "$needle" ]] && return 0
   done
   return 1
 }
 
-# In non-interactive runs, prevent TTY prompts from blocking apply.
-if [[ "${DOTFILES_NONINTERACTIVE:-0}" == "1" ]] && ! has_flag "--force"; then
+# Apply unattended by default, like an OS package manager. chezmoi is
+# always run below under `gum spin` or with its output captured, so it
+# never has a controlling TTY; its "<file> has changed since chezmoi last
+# wrote it" confirmation prompt therefore cannot be answered and aborts
+# the run with "could not open a new TTY". Passing --force applies the
+# canonical source without prompting, so local drift to *managed* files
+# yields to the source — exactly how `apt`/system updates behave. Keep
+# machine-specific tweaks in the unmanaged ~/.zshrc.local or
+# ~/.config/zsh/rc.d.local/*.zsh, which chezmoi never overwrites.
+# Opt back into chezmoi's prompts with DOTFILES_INTERACTIVE_APPLY=1.
+if [[ "${DOTFILES_INTERACTIVE_APPLY:-0}" != "1" ]] && ! has_flag "--force"; then
   args+=("--force")
 fi
 
+# Whether interactive menus (the optional AI-provider installer below) may
+# prompt. Suppressed without a TTY, under CI, or when non-interactive is
+# requested — so unattended runs never hang waiting on input.
+INTERACTIVE=1
+if [[ "${DOTFILES_NONINTERACTIVE:-0}" == "1" ]] || [[ -n "${CI:-}" ]] || [[ ! -t 0 ]] || [[ ! -t 1 ]]; then
+  INTERACTIVE=0
+fi
+
 ui_init
 
-# Prevent concurrent execution
-LOCK_FILE="${XDG_RUNTIME_DIR:-/tmp}/dotfiles-chezmoi-apply.lock"
-exec 9>"$LOCK_FILE"
-if ! flock -n 9; then
+# Prevent concurrent execution. flock(1) is Linux-only — it does not exist
+# on macOS, where `! flock` previously took the "already running" branch and
+# made `dot apply` a silent no-op. Use flock where present, otherwise fall
+# back to an atomic mkdir lock (portable to macOS/BSD).
+_lock_base="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}/dotfiles-chezmoi-apply"
+if command -v flock >/dev/null 2>&1; then
+  exec 9>"${_lock_base}.lock"
+  if ! flock -n 9; then
+    ui_warn "Already running" "Another instance is active"
+    exit 0
+  fi
+elif ! mkdir "${_lock_base}.lock.d" 2>/dev/null; then
   ui_warn "Already running" "Another instance is active"
   exit 0
+else
+  _LOCK_DIR="${_lock_base}.lock.d" # removed by cleanup() on exit
 fi
 
 run_step() {
@@ -187,7 +221,7 @@ for _entry in "${_AI_PROVIDERS[@]}"; do
   fi
 done
 
-if [[ ${#_ai_missing[@]} -gt 0 ]] && [[ "${DOTFILES_NONINTERACTIVE:-0}" != "1" ]]; then
+if [[ ${#_ai_missing[@]} -gt 0 ]] && [[ "$INTERACTIVE" == "1" ]]; then
   if command -v mise &>/dev/null; then
     echo ""
     _ai_install_action=""

package/scripts/ops/chezmoi-update.sh

@@ -14,6 +14,20 @@ if [[ "${DOTFILES_CHEZMOI_VERBOSE:-0}" = "1" ]]; then
   args+=("--verbose")
 fi
 
+# Apply unattended by default (see chezmoi-apply.sh). `chezmoi update` runs
+# `apply` internally, so without --force it blocks on the "<file> has
+# changed since chezmoi last wrote it" prompt — and `dot update` is often
+# run from cron/CI/--async with no TTY, where that prompt aborts the run.
+# --force makes updates land like an OS package-manager update; opt back
+# into prompting with DOTFILES_INTERACTIVE_APPLY=1.
+if [[ "${DOTFILES_INTERACTIVE_APPLY:-0}" != "1" ]]; then
+  _has_force=0
+  if [[ ${#args[@]} -gt 0 ]]; then
+    for _a in "${args[@]}"; do [[ "$_a" == "--force" ]] && _has_force=1; done
+  fi
+  [[ "$_has_force" == "0" ]] && args+=("--force")
+fi
+
 ASYNC=false
 if [[ "${DOTFILES_ASYNC_UPDATE:-0}" = "1" ]]; then
   ASYNC=true

package/scripts/ops/heal-tools.sh

@@ -31,6 +31,12 @@ detect_pkg_manager() {
     echo "dnf"
   elif command -v pacman >/dev/null 2>&1; then
     echo "pacman"
+  elif command -v zypper >/dev/null 2>&1; then
+    echo "zypper"
+  elif command -v apk >/dev/null 2>&1; then
+    echo "apk"
+  elif command -v pkg >/dev/null 2>&1; then
+    echo "pkg"
   elif command -v nix-env >/dev/null 2>&1; then
     echo "nix"
   else
@@ -66,6 +72,28 @@ install_package() {
       fi
       sudo pacman -S --noconfirm --quiet "$pkg" >/dev/null 2>&1
       ;;
+    zypper)
+      if ! command -v sudo >/dev/null 2>&1; then
+        log_error "sudo not found — cannot install '$pkg' via zypper"
+        return 1
+      fi
+      sudo zypper --quiet install -y "$pkg" >/dev/null 2>&1
+      ;;
+    apk)
+      if command -v sudo >/dev/null 2>&1; then
+        sudo apk add --quiet "$pkg" >/dev/null 2>&1
+      else
+        apk add --quiet "$pkg" >/dev/null 2>&1
+      fi
+      ;;
+    pkg)
+      # FreeBSD/OpenBSD/NetBSD — install as root when available.
+      if command -v sudo >/dev/null 2>&1; then
+        sudo pkg install -y "$pkg" >/dev/null 2>&1
+      else
+        pkg install -y "$pkg" >/dev/null 2>&1
+      fi
+      ;;
     nix) nix-env -iA "nixpkgs.$pkg" >/dev/null 2>&1 ;;
     *)
       log_error "No supported package manager found. Install '$pkg' manually."

package/scripts/ops/teleport.sh

@@ -7,10 +7,10 @@
 
 set -euo pipefail
 
-TARGET="$1"
+TARGET="${1:-}"
 
 if [[ -z "$TARGET" ]]; then
-  echo "Usage: $0 user@host"
+  echo "Usage: dot teleport user@host"
   exit 1
 fi