@sebastienrousseau/dotfiles 0.2.507 → 0.2.510

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. package/CHANGELOG.md +93 -0
  2. package/README.md +5 -5
  3. package/docs/COPYRIGHT +1 -1
  4. package/docs/GOVERNANCE.md +2 -2
  5. package/docs/adr/ADR-011-nushell-tier3-keep.md +2 -2
  6. package/docs/guides/INSTALL.md +3 -3
  7. package/docs/index.md +116 -27
  8. package/docs/interop/A2A.md +2 -2
  9. package/docs/interop/POWERSHELL.md +4 -4
  10. package/docs/manual/00-introduction.md +3 -3
  11. package/docs/manual/01-concepts/02-trust-model.md +3 -3
  12. package/docs/manual/01-concepts/04-fleet.md +1 -1
  13. package/docs/manual/02-tutorials/01-first-install.md +1 -1
  14. package/docs/manual/02-tutorials/05-deploy-fleet.md +2 -2
  15. package/docs/manual/03-reference/02-config-files.md +1 -1
  16. package/docs/manual/03-reference/04-templates.md +1 -1
  17. package/docs/manual/04-cookbook/01-recipes.md +1 -1
  18. package/docs/manual/04-cookbook/02-troubleshooting.md +1 -1
  19. package/docs/manual/05-appendices/B-security-checklist.md +1 -1
  20. package/docs/manual/command-index.md +76 -1
  21. package/docs/manual/index.md +1 -1
  22. package/docs/operations/ARCHITECTURE_ROADMAP.md +145 -0
  23. package/docs/operations/CI_CADENCE.md +2 -2
  24. package/docs/operations/COMPLETIONS.md +2 -2
  25. package/docs/operations/COVERAGE.md +4 -4
  26. package/docs/operations/DRIFT.md +1 -1
  27. package/docs/operations/MAINTENANCE.md +6 -6
  28. package/docs/operations/PERFORMANCE.md +6 -6
  29. package/docs/operations/RELIABILITY.md +1 -1
  30. package/docs/operations/ROADMAP_V0_2_503.md +1 -1
  31. package/docs/operations/TRACEABILITY.md +2 -0
  32. package/docs/operations/TRUSTED_AGENT_WORKSTATION.md +6 -6
  33. package/docs/operations/VERSION_SYNC.md +3 -3
  34. package/docs/reference/UTILS.md +82 -0
  35. package/docs/security/AUDIT_BYPASS.md +3 -3
  36. package/docs/security/AUTOMATION_SECRETS.md +1 -1
  37. package/docs/security/CI_PINNING.md +10 -10
  38. package/docs/security/COMMIT_SIGNING.md +10 -10
  39. package/docs/security/DEPS_DEV_EXCEPTIONS.md +4 -4
  40. package/docs/security/DISCLOSURE.md +3 -3
  41. package/docs/security/INCIDENT_RESPONSE.md +1 -1
  42. package/docs/security/INSTALL_VERIFICATION.md +2 -2
  43. package/docs/security/MCP_POLICY.md +4 -4
  44. package/docs/security/SCORECARD.md +7 -7
  45. package/docs/security/SECURITY_CHECKLIST.md +1 -1
  46. package/docs/security/SHELL_EXEMPTIONS.md +2 -2
  47. package/docs/security/SOUP_REGISTER.md +4 -4
  48. package/docs/stylesheets/extra.css +444 -0
  49. package/docs/themes/hero-shot.svg +1 -1
  50. package/install.sh +17 -6
  51. package/package.json +1 -1
  52. package/scripts/ci/check-copyright-headers.sh +1 -1
  53. package/scripts/ci/check-shell-preamble.sh +1 -1
  54. package/scripts/ci/guard-gitleaks-checkout.sh +1 -1
  55. package/scripts/dot/commands/agent.sh +7 -6
  56. package/scripts/dot/commands/ai.sh +8 -5
  57. package/scripts/dot/commands/appearance.sh +14 -1
  58. package/scripts/dot/commands/completion.sh +134 -0
  59. package/scripts/dot/commands/core.sh +8 -0
  60. package/scripts/dot/commands/diagnostics.sh +16 -0
  61. package/scripts/dot/commands/fleet.sh +7 -3
  62. package/scripts/dot/commands/lint.sh +55 -30
  63. package/scripts/dot/commands/secrets.sh +61 -7
  64. package/scripts/dot/commands/security.sh +8 -0
  65. package/scripts/dot/powershell/Dot.psm1 +1 -1
  66. package/scripts/git-hooks/pre-commit-audit.sh +1 -1
  67. package/scripts/ops/chezmoi-apply.sh +42 -8
  68. package/scripts/ops/chezmoi-update.sh +14 -0
  69. package/scripts/ops/heal-tools.sh +28 -0
  70. package/scripts/ops/teleport.sh +2 -2
  71. package/scripts/qa/examples-coverage.sh +94 -0
  72. package/scripts/version-sync.sh +29 -2
  73. package/docs/_config.yml +0 -59
@@ -0,0 +1,94 @@
1
+ #!/usr/bin/env bash
2
+ # SPDX-License-Identifier: MIT
3
+ # Copyright (c) 2015-2026 Sebastien Rousseau
4
+ # =============================================================================
5
+ # examples-coverage.sh — enforce that every core feature domain ships a
6
+ # runnable example under examples/. Mirrors scripts/qa/docs-coverage.sh:
7
+ # it is a *coverage contract*, not a linter. Threshold defaults to 100%.
8
+ #
9
+ # A feature domain is "covered" when examples/example-<domain>.sh exists.
10
+ # Keep REQUIRED_AREAS in lockstep with the feature surface — adding a major
11
+ # user-facing capability (a new `dot` subsystem) means adding its example.
12
+ # =============================================================================
13
+ set -euo pipefail
14
+
15
+ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
16
+ REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
17
+ EXAMPLES_DIR="$REPO_ROOT/examples"
18
+ DOT_CLI="$REPO_ROOT/bin/dot"
19
+ MIN_EXAMPLES_COVERAGE="${MIN_EXAMPLES_COVERAGE:-100}"
20
+
21
+ # Public commands/subcommands, extracted from bin/dot's _dot_help_specs — the
22
+ # same source scripts/qa/docs-coverage.sh uses, so docs and examples stay in
23
+ # lockstep at the command granularity.
24
+ extract_public_commands() {
25
+ awk -F'|' '
26
+ /_dot_help_specs\(\)/ { in_func=1; next }
27
+ in_func && /cat <<'\''EOF'\''/ { in_block=1; next }
28
+ in_block && /^EOF$/ { exit }
29
+ in_block && NF>=2 { print $2 }
30
+ ' "$DOT_CLI"
31
+ }
32
+
33
+ # Core feature domains that must each have examples/example-<area>.sh.
34
+ REQUIRED_AREAS=(
35
+ ai-patterns
36
+ cli-utilities
37
+ coverage-gate
38
+ diagnostics
39
+ dot-commands
40
+ functions
41
+ fleet
42
+ git-hooks
43
+ install-uninstall
44
+ ops
45
+ platform-contract
46
+ qa
47
+ secrets
48
+ security
49
+ test-suite
50
+ testing-framework
51
+ theme
52
+ )
53
+
54
+ total=0
55
+ covered=0
56
+ missing=()
57
+
58
+ # --- Check 1: every feature domain has a dedicated example file. ---
59
+ for area in "${REQUIRED_AREAS[@]}"; do
60
+ total=$((total + 1))
61
+ if [ -f "$EXAMPLES_DIR/example-$area.sh" ]; then
62
+ covered=$((covered + 1))
63
+ else
64
+ missing+=("domain:$area")
65
+ fi
66
+ done
67
+
68
+ # --- Check 2: every public command/subcommand is referenced in an example. ---
69
+ while IFS= read -r cmd; do
70
+ [ -n "$cmd" ] || continue
71
+ total=$((total + 1))
72
+ # "dot <cmd>" followed by a non-identifier char (or EOL) — avoids matching
73
+ # `dot ai` against `dot ai-query`, and matches printf '...\n'-terminated refs.
74
+ if grep -rqE "dot ${cmd}([^A-Za-z0-9_-]|\$)" "$EXAMPLES_DIR" 2>/dev/null; then
75
+ covered=$((covered + 1))
76
+ else
77
+ missing+=("cmd:$cmd")
78
+ fi
79
+ done < <(extract_public_commands | sort -u)
80
+
81
+ pct="$(awk -v c="$covered" -v t="$total" \
82
+ 'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
83
+ printf 'Examples coverage: %s/%s (%s%%)\n' "$covered" "$total" "$pct"
84
+ printf 'Threshold: %s%%\n' "$MIN_EXAMPLES_COVERAGE"
85
+ if [ "${#missing[@]}" -gt 0 ]; then
86
+ printf 'Missing coverage for: %s\n' "${missing[*]}" >&2
87
+ fi
88
+
89
+ if awk -v p="$pct" -v min="$MIN_EXAMPLES_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'; then
90
+ printf 'PASS: every feature domain and every public command has an example.\n'
91
+ exit 0
92
+ fi
93
+ printf 'FAIL: examples coverage %s%% is below the %s%% threshold.\n' "$pct" "$MIN_EXAMPLES_COVERAGE" >&2
94
+ exit 1
@@ -78,6 +78,12 @@ EXCLUDE_FILES=(
78
78
  # CI_COMPOSITES.md cites third-party action versions (e.g. v5.0.5),
79
79
  # not dotfiles_version. False-positive pattern match.
80
80
  "docs/operations/CI_COMPOSITES.md"
81
+
82
+ # Living roadmap: references branch names / target versions
83
+ # (e.g. feature-branch names like feat/v0.2.X, phase milestones)
84
+ # that are NOT the current dotfiles_version. Auto-syncing
85
+ # rewrites them incorrectly.
86
+ "docs/operations/ARCHITECTURE_ROADMAP.md"
81
87
  )
82
88
 
83
89
  # shellcheck source=../lib/dot/ui.sh
@@ -180,6 +186,16 @@ find_version_files() {
180
186
  echo "docs/reference/FEATURES.md" >>"$temp_file"
181
187
  echo "docs/COPYRIGHT" >>"$temp_file"
182
188
 
189
+ # Non-markdown and hidden-directory surfaces rg's `--type md` scan above
190
+ # cannot reach: a shell script, and READMEs under the dotfile-hidden
191
+ # `.chezmoitemplates/` tree (rg skips dot-dirs without --hidden). These
192
+ # carry "current version" stamps that check-version-consistency.sh and
193
+ # the test_version_consistency unit test enforce, so keep them in sync.
194
+ echo "scripts/git-hooks/pre-commit-audit.sh" >>"$temp_file"
195
+ echo "defaults/.chezmoitemplates/README.md" >>"$temp_file"
196
+ echo "defaults/.chezmoitemplates/functions/README.md" >>"$temp_file"
197
+ echo "defaults/.chezmoitemplates/aliases/README.md" >>"$temp_file"
198
+
183
199
  # Remove duplicates and filter existing files
184
200
  sort -u "$temp_file" | while IFS= read -r file; do
185
201
  if [[ -f "$file" ]]; then
@@ -257,8 +273,11 @@ update_version_references() {
257
273
  temp_file=$(umask 077 && mktemp)
258
274
  cp "$file" "$temp_file"
259
275
 
260
- # Update various version reference patterns
261
- case "$(basename "$file")" in
276
+ # Update various version reference patterns. Match on the full repo
277
+ # path (not basename) so the root README's badge rules don't also
278
+ # capture other README.md files (e.g. the .chezmoitemplates READMEs),
279
+ # which carry a `(vX.Y.Z)` stamp handled by the generic case below.
280
+ case "$file" in
262
281
  "README.md")
263
282
  # Update badge and release link versions.
264
283
  sed_in_place "$temp_file" \
@@ -266,6 +285,14 @@ update_version_references() {
266
285
  -e "s|/releases/tag/v$SED_VERSION_PATTERN|/releases/tag/v$target_version|g" \
267
286
  -e "s|/dotfiles/v$SED_VERSION_PATTERN/|/dotfiles/v$target_version/|g"
268
287
  ;;
288
+ "scripts/git-hooks/pre-commit-audit.sh")
289
+ # "vX.Y.Z standards maintained" banner. Matched explicitly with a
290
+ # portable pattern — the generic `\bvX.Y.Z\b` rule below relies on
291
+ # GNU `\b`, which BSD/macOS sed does not support, so a local
292
+ # `version-sync` run would otherwise leave this script stale.
293
+ sed_in_place "$temp_file" \
294
+ -e "s|v$SED_VERSION_PATTERN standards maintained|v$target_version standards maintained|g"
295
+ ;;
269
296
  *)
270
297
  # Update explicit markdown version labels, backticks, and parentheses.
271
298
  # Skip lines containing MILESTONE.
package/docs/_config.yml DELETED
@@ -1,59 +0,0 @@
1
- title: ".dotfiles"
2
- description: "Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL — published at doc.dotfiles.io."
3
- url: "https://doc.dotfiles.io"
4
- baseurl: ""
5
-
6
- # Jekyll renders this site from docs/ — see .github/workflows/pages.yml.
7
- # Theme is the GitHub-hosted Cayman skin (zero-Gemfile setup); switch to
8
- # `remote_theme: just-the-docs/just-the-docs` later if a richer
9
- # navigation/search UX is wanted (requires plugin allowlist update on
10
- # GH Pages side).
11
- theme: jekyll-theme-cayman
12
-
13
- plugins:
14
- - jekyll-relative-links
15
- - jekyll-seo-tag
16
- - jekyll-sitemap
17
- - jekyll-redirect-from
18
- # Renders `README.md` as the directory index where present (matches
19
- # the GitHub-browse experience for users coming from the repo links
20
- # in docs/index.md).
21
- - jekyll-readme-index
22
-
23
- relative_links:
24
- enabled: true
25
- collections: true
26
-
27
- # Treat *.md as pages so cross-page links work without trailing-slash
28
- # kludges; include CNAME so the published artifact preserves it across
29
- # workflow deploys.
30
- include:
31
- - CNAME
32
- - .well-known
33
-
34
- exclude:
35
- - "*.tmpl"
36
- - "manual/_toc.yml"
37
- - "scripts/"
38
- - "Gemfile"
39
- - "Gemfile.lock"
40
- - "vendor/"
41
-
42
- markdown: kramdown
43
- kramdown:
44
- input: GFM
45
- syntax_highlighter: rouge
46
- hard_wrap: false
47
-
48
- # Many of our docs include chezmoi/Go-template snippets like
49
- # `{{ .variable }}` inside fenced code blocks. Liquid runs BEFORE
50
- # kramdown sees those fences and would try to resolve the placeholders
51
- # as Liquid expressions (silently dropping them from the output). Each
52
- # .md file therefore carries explicit `render_with_liquid: false` in
53
- # its frontmatter — a site-wide default in this block was not honored
54
- # reliably, so we keep the kill-switch per-page instead.
55
- defaults:
56
- - scope:
57
- path: ""
58
- values:
59
- layout: default