@sebastienrousseau/dotfiles 0.2.508 → 0.2.510

package/install.sh

@@ -2,9 +2,20 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
-# Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"
+# Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
 # (or ./install.sh locally)
 
+# This installer uses bash features (set -o pipefail, arrays, [[ ]]). If it is
+# run under a POSIX/other shell — e.g. `sh install.sh` or piped to `sh` where
+# /bin/sh is dash — fail fast with a clear message instead of the cryptic
+# "set: Illegal option -o pipefail" from the next line. Kept strictly POSIX so
+# it parses in any shell before bash takes over.
+if [ -z "${BASH_VERSION:-}" ]; then
+  echo "install.sh requires bash. Run:  bash install.sh" >&2
+  echo "  or:  bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)\"" >&2
+  exit 1
+fi
+
 set -euo pipefail
 
 # Restrict the permissions of any file/dir we create during bootstrap.
@@ -60,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.508)
+  version       The version (tag or branch) to install (default: v0.2.510)
 
 Options:
   --help        Show this help message
@@ -76,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.508"
+  local version="v0.2.510"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -106,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.508)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.510)."
         fi
         version="$arg"
         version_set=1
@@ -351,7 +362,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.508 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.510 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -360,7 +371,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.508 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.510 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.508",
+  "version": "0.2.510",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/ci/check-copyright-headers.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/check-copyright-headers.sh" "$@"

package/scripts/ci/check-shell-preamble.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/check-shell-preamble.sh" "$@"

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/guard-gitleaks-checkout.sh" "$@"

package/scripts/dot/commands/agent.sh

@@ -88,12 +88,13 @@ _agent_apply_profile_env() {
   # Split declare-and-assign to avoid masking the field-getter's exit
   # code (SC2155). If the profile JSON is malformed, the assignment
   # now fails the function instead of silently exporting an empty value.
-  local approval filesystem network mcp_profile max_steps
-  approval="$(_agent_profile_field "$name" "approval")"
-  filesystem="$(_agent_profile_field "$name" "filesystem")"
-  network="$(_agent_profile_field "$name" "network")"
-  mcp_profile="$(_agent_profile_field "$name" "mcpProfile")"
-  max_steps="$(_agent_profile_field "$name" "maxSteps")"
+  local approval filesystem network mcp_profile max_steps tuple
+  # One jq read of all five policy fields (was five separate jq processes on
+  # every profile application). `|| return 1` preserves fail-on-malformed.
+  tuple="$(jq -r --arg name "$name" \
+    '.profiles[$name] | [.approval, .filesystem, .network, .mcpProfile, .maxSteps] | @tsv' \
+    "$(_agent_profiles_file)")" || return 1
+  IFS=$'\t' read -r approval filesystem network mcp_profile max_steps <<<"$tuple"
   export DOT_AGENT_APPROVAL="$approval"
   export DOT_AGENT_FILESYSTEM="$filesystem"
   export DOT_AGENT_NETWORK="$network"

package/scripts/dot/commands/ai.sh

@@ -147,9 +147,7 @@ _ai_get_cached_status() {
 
 # Look up field $2 (2=present 0/1, 3=version) for binary $1 from the
 # cached TSV. Replaces a bash-4 associative array for macOS bash 3.2.
-_ai_status_field() {
-  awk -F'\t' -v b="$1" -v f="$2" '$1==b{print $f;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
-}
+# (Removed _ai_status_field — cmd_ai_status now reads both fields in one awk.)
 
 # _ai_mise_pkg (binary -> mise package map) is defined in lib/dot/ai-install.sh.
 
@@ -193,8 +191,13 @@ cmd_ai_status() {
       ui_section "$category"
       current_category="$category"
     fi
-    if [[ "$(_ai_status_field "$bin" 2)" == "1" ]]; then
-      ver="$(_ai_status_field "$bin" 3)"
+    # One awk over the cache line for this tool (was two: field 2 and field 3).
+    local _st_installed _st_ver
+    IFS=$'\t' read -r _st_installed _st_ver < <(
+      awk -F'\t' -v b="$bin" '$1==b{print $2"\t"$3;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
+    )
+    if [[ "$_st_installed" == "1" ]]; then
+      ver="$_st_ver"
       [[ -z "$ver" ]] && ver="installed"
       [[ "$bin" == "claude" ]] && ver="${ver%% *}"
       ui_ok "$name" "$ver — $desc"

package/scripts/dot/commands/appearance.sh

@@ -33,7 +33,20 @@ cmd_wallpaper() {
 }
 
 cmd_fonts() {
-  run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+  local sub="${1:-install}"
+  case "$sub" in
+    patch)
+      shift
+      run_script "scripts/fonts/patch-fonts.sh" "Font patch helper" "$@"
+      ;;
+    install | "")
+      [[ "$sub" == install ]] && shift || true
+      run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+      ;;
+    *)
+      run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+      ;;
+  esac
 }
 
 cmd_tune() {

package/scripts/dot/commands/completion.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+## `dot completion <bash|zsh|fish|nu>` — emit shell completion for `dot`,
+## generated from the canonical _dot_help_specs registry in bin/dot. Using one
+## source of truth keeps all four shells in sync (the previously hand-maintained
+## fish/nushell lists drifted and referenced non-existent commands).
+##
+## Usage:
+##   dot completion bash  >> ~/.bashrc.d/dot.bash
+##   dot completion zsh   > "${fpath[1]}/_dot"
+##   dot completion fish  > ~/.config/fish/completions/dot.fish
+##   dot completion nu    >> ~/.config/nushell/completions.nu
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+_completion_dot_cli() {
+  local src
+  src="$(resolve_source_dir)"
+  printf '%s/bin/dot\n' "$src"
+}
+
+# Emit "name<TAB>description" for every top-level command (a _dot_help_specs
+# field-2 entry with no space; entries containing a space are subcommands).
+# Strip ": ' from descriptions so they can't break any shell's quoting.
+_completion_commands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 !~ / / {
+      name = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", name)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      if (name != "") print name "\t" desc
+    }
+  ' "$cli"
+}
+
+# Emit "parent<TAB>child<TAB>description" for every subcommand (a field-2
+# entry that contains a space, e.g. "theme list" -> parent=theme child=list).
+_completion_subcommands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 ~ / / {
+      full = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", full)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      parent = full; sub(/ .*/, "", parent)
+      child = full; sub(/^[^ ]+ /, "", child)
+      if (parent != "" && child != "") print parent "\t" child "\t" desc
+    }
+  ' "$cli"
+}
+
+gen_bash() {
+  local names
+  names="$(_completion_commands | cut -f1 | tr '\n' ' ')"
+  printf '# dot bash completion — generated by: dot completion bash\n'
+  printf "complete -W '%s' dot\n" "${names% }"
+}
+
+gen_zsh() {
+  local name desc
+  printf '#compdef dot\n# generated by: dot completion zsh\n'
+  printf '_dot() {\n  local -a commands\n  commands=(\n'
+  while IFS=$'\t' read -r name desc; do
+    printf "    '%s:%s'\n" "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  )\n  _describe '\''command'\'' commands\n}\n_dot "$@"\n'
+}
+
+gen_fish() {
+  local name desc
+  printf '# dot fish completion — generated by: dot completion fish\n'
+  printf 'complete -c dot -f\n'
+  while IFS=$'\t' read -r name desc; do
+    printf 'complete -c dot -n "__fish_use_subcommand" -a %s -d "%s"\n' "$name" "$desc"
+  done < <(_completion_commands)
+  local parent child
+  while IFS=$'\t' read -r parent child desc; do
+    printf 'complete -c dot -n "__fish_seen_subcommand_from %s" -a %s -d "%s"\n' \
+      "$parent" "$child" "$desc"
+  done < <(_completion_subcommands)
+}
+
+gen_nu() {
+  local name desc
+  printf '# dot nushell completion — generated by: dot completion nu\n'
+  printf 'export extern dot [\n  command?: string@dot_commands\n  ...args: string\n]\n'
+  printf 'def dot_commands [] {\n  [\n'
+  while IFS=$'\t' read -r name desc; do
+    printf '    { value: "%s", description: "%s" }\n' "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  ]\n}\n'
+}
+
+usage() {
+  cat <<'USAGE'
+Usage: dot completion <bash|zsh|fish|nu>
+
+Generate shell completion for `dot` from the canonical command registry.
+
+  dot completion bash  >> ~/.bashrc.d/dot.bash
+  dot completion zsh   > "${fpath[1]}/_dot"
+  dot completion fish  > ~/.config/fish/completions/dot.fish
+  dot completion nu    >> ~/.config/nushell/completions.nu
+USAGE
+}
+
+# Dispatch: $1 is the command name ("completion"); $2 is the target shell.
+case "${2:-}" in
+  bash) gen_bash ;;
+  zsh) gen_zsh ;;
+  fish) gen_fish ;;
+  nu | nushell) gen_nu ;;
+  "" | -h | --help | help) usage ;;
+  *)
+    echo "dot completion: unknown shell '${2}' (want: bash|zsh|fish|nu)" >&2
+    exit 1
+    ;;
+esac

package/scripts/dot/commands/core.sh

@@ -129,6 +129,10 @@ cmd_commit() {
   run_script "dot_local/bin/executable_git-ai-commit" "Git AI commit script" "$@"
 }
 
+cmd_uninstall() {
+  run_script "scripts/uninstall.sh" "Uninstall script" "$@"
+}
+
 cmd_clean_cache() {
   ui_info "Cache" "Clearing shell initialization caches"
   local cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}"
@@ -185,6 +189,10 @@ case "${1:-}" in
     shift
     cmd_clean_cache "$@"
     ;;
+  uninstall)
+    shift
+    cmd_uninstall "$@"
+    ;;
   *)
     echo "Unknown core command: ${1:-}" >&2
     exit 1

package/scripts/dot/commands/diagnostics.sh

@@ -110,6 +110,14 @@ cmd_chaos() {
   run_script "scripts/ops/chaos.sh" "Chaos engineering script" "$@"
 }
 
+cmd_teleport() {
+  run_script "scripts/ops/teleport.sh" "Teleport script" "$@"
+}
+
+cmd_secret_audit() {
+  run_script "scripts/diagnostics/secret-governance.sh" "Secret governance script" "$@"
+}
+
 cmd_bundle() {
   run_script "scripts/ops/bundle.sh" "Offline bundle script" "$@"
 }
@@ -207,6 +215,14 @@ case "${1:-}" in
     shift
     cmd_chaos "$@"
     ;;
+  teleport)
+    shift
+    cmd_teleport "$@"
+    ;;
+  secret-audit)
+    shift
+    cmd_secret_audit "$@"
+    ;;
   bundle)
     shift
     cmd_bundle "$@"

package/scripts/dot/commands/fleet.sh

@@ -202,9 +202,13 @@ cmd_fleet_drift() {
       local count="${1:-20}"
       tail -n "$count" "$_DRIFT_HISTORY_FILE" | while IFS= read -r line; do
         local time status file_count
-        time="$(printf '%s' "$line" | jq -r '.time' 2>/dev/null || echo "?")"
-        status="$(printf '%s' "$line" | jq -r '.status' 2>/dev/null || echo "?")"
-        file_count="$(printf '%s' "$line" | jq '.files | length' 2>/dev/null || echo 0)"
+        # One jq per line (was three: .time, .status, .files|length).
+        IFS=$'\t' read -r time status file_count < <(
+          printf '%s' "$line" | jq -r '[.time, .status, (.files | length)] | @tsv' 2>/dev/null
+        )
+        [[ -n "$time" ]] || time="?"
+        [[ -n "$status" ]] || status="?"
+        [[ -n "$file_count" ]] || file_count=0
         if [[ "$status" == "clean" ]]; then
           ui_ok "$time" "clean"
         else

package/scripts/dot/commands/lint.sh

@@ -19,6 +19,33 @@ dot_ui_command_banner "Lint" "${1:-}"
 SHELLCHECK_ARGS=(--severity=error -e SC1091 -e SC2030 -e SC2031)
 SHFMT_ARGS=(-i 2 -ci)
 
+# True only if the file's shebang names a shell that both shellcheck and shfmt
+# can process. The old `grep -qiE 'shell|bash|sh'` matched loosely — "sh" hit
+# "fish", and `file` output pulled in python3 scripts — so non-shell files
+# landed in the lint set and produced spurious SC1071 / shfmt parse "errors".
+_lint_is_shell() {
+  local first interp
+  first="$(head -1 "$1" 2>/dev/null)"
+  case "$first" in '#!'*) ;; *) return 1 ;; esac
+  interp="${first#\#!}"
+  interp="${interp#"${interp%%[![:space:]]*}"}" # ltrim
+  case "$interp" in
+    */env[[:space:]]*)
+      interp="${interp#*/env}"
+      interp="${interp#"${interp%%[![:space:]]*}"}"
+      interp="${interp%%[[:space:]]*}"
+      ;;
+    *)
+      interp="${interp%%[[:space:]]*}"
+      interp="${interp##*/}"
+      ;;
+  esac
+  case "$interp" in
+    sh | bash | dash | ksh | mksh | ash) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 cmd_lint() {
   local mode="${1:-all}"
   local src_dir
@@ -40,11 +67,10 @@ cmd_lint() {
   chezmoi_src="$(resolve_chezmoi_source_dir)"
   [[ -z "$chezmoi_src" ]] && chezmoi_src="$src_dir"
 
-  # dot_local/bin/executable_* scripts (shell scripts only)
+  # dot_local/bin/executable_* scripts — shell scripts only (skip python/zsh/etc
+  # by inspecting the shebang, so shellcheck/shfmt never see files they can't parse).
   while IFS= read -r -d '' f; do
-    if file "$f" 2>/dev/null | grep -qiE 'shell|bash|sh'; then
-      files+=("$f")
-    elif head -1 "$f" 2>/dev/null | grep -qE '^#!.*(bash|sh)'; then
+    if _lint_is_shell "$f"; then
       files+=("$f")
     fi
   done < <(find "$chezmoi_src/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
@@ -69,17 +95,16 @@ cmd_lint() {
       if has_command shellcheck; then
         ui_section "ShellCheck"
         echo ""
-        local sc_fail=0
-        for f in "${files[@]}"; do
-          if ! shellcheck "${SHELLCHECK_ARGS[@]}" "$f" 2>/dev/null; then
-            sc_fail=$((sc_fail + 1))
-          fi
-        done
-        if [[ "$sc_fail" -eq 0 ]]; then
+        # One shellcheck invocation over all files (was one fork per file).
+        # gcc format is one line per issue, so failing files = unique paths.
+        local sc_out
+        sc_out="$(shellcheck -f gcc "${SHELLCHECK_ARGS[@]}" "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$sc_out" ]]; then
           ui_ok "shellcheck" "$total files clean"
         else
-          sc_errors=$sc_fail
-          ui_err "shellcheck" "$sc_fail file(s) with errors"
+          printf '%s\n' "$sc_out"
+          sc_errors=$(printf '%s\n' "$sc_out" | cut -d: -f1 | sort -u | grep -c .)
+          ui_err "shellcheck" "$sc_errors file(s) with errors"
         fi
         echo ""
       else
@@ -91,17 +116,15 @@ cmd_lint() {
       if has_command shfmt; then
         ui_section "shfmt"
         echo ""
-        local fmt_fail=0
-        for f in "${files[@]}"; do
-          if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
-            fmt_fail=$((fmt_fail + 1))
-          fi
-        done
-        if [[ "$fmt_fail" -eq 0 ]]; then
+        # `shfmt -l` lists files needing formatting in one invocation
+        # (was `shfmt -d` per file).
+        local fmt_list
+        fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$fmt_list" ]]; then
           ui_ok "shfmt" "$total files formatted correctly"
         else
-          fmt_errors=$fmt_fail
-          ui_err "shfmt" "$fmt_fail file(s) need formatting"
+          fmt_errors=$(printf '%s\n' "$fmt_list" | grep -c .)
+          ui_err "shfmt" "$fmt_errors file(s) need formatting"
         fi
         echo ""
       else
@@ -118,17 +141,19 @@ cmd_lint() {
       fi
       ui_section "Auto-fixing with shfmt"
       echo ""
-      local fixed=0
-      for f in "${files[@]}"; do
-        if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
+      # Find files needing formatting in one `shfmt -l` pass, then only
+      # rewrite that (usually small) set — was `shfmt -d` per file.
+      local fmt_list fixed=0
+      fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+      if [[ -z "$fmt_list" ]]; then
+        ui_ok "shfmt" "All files already formatted"
+      else
+        while IFS= read -r f; do
+          [[ -n "$f" ]] || continue
           shfmt "${SHFMT_ARGS[@]}" -w "$f"
           ui_ok "fixed" "${f#"$src_dir/"}"
           fixed=$((fixed + 1))
-        fi
-      done
-      if [[ "$fixed" -eq 0 ]]; then
-        ui_ok "shfmt" "All files already formatted"
-      else
+        done <<<"$fmt_list"
         ui_ok "shfmt" "$fixed file(s) reformatted"
       fi
       echo ""

package/scripts/dot/commands/secrets.sh

@@ -152,26 +152,80 @@ cmd_secrets_list() {
 }
 
 cmd_env_load() {
-  local bucket="${1:-ai}" data_file key value count=0
+  # Usage: dot secrets load [<bucket>] [--shell posix|fish|nu]
+  # Emits shell code to set the bucket's secrets as env vars, in the target
+  # shell's dialect so it works beyond POSIX:
+  #   posix (default):  eval "$(dot secrets load ai)"
+  #   fish:             dot secrets load ai --shell fish | source
+  #   nu:               load-env (dot secrets load ai --shell nu | from nuon)
+  local bucket="ai" dialect="posix" data_file key value count=0
+  local -a keys=() values=()
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --shell)
+        dialect="${2:-posix}"
+        shift 2
+        ;;
+      --shell=*)
+        dialect="${1#*=}"
+        shift
+        ;;
+      -*) die "Unknown flag: $1 (usage: dot secrets load [<bucket>] [--shell posix|fish|nu])" ;;
+      *)
+        bucket="$1"
+        shift
+        ;;
+    esac
+  done
+
   data_file="$(dot_data_file)"
   [[ -f "$data_file" ]] || die "Missing data file: $data_file"
 
   while IFS= read -r key; do
     value="$(dot_secrets_get "$key" || true)"
     if [[ -n "$value" ]]; then
-      # shell-safe export lines intended for: eval "$(dot env load <bucket>)"
-      printf "export %s=%q\n" "$key" "$value"
+      keys+=("$key")
+      values+=("$value")
       count=$((count + 1))
     fi
   done < <(dot_secrets_bucket_keys "$data_file" "$bucket")
 
-  if [[ "$count" -eq 0 ]]; then
-    die "No secrets loaded for bucket: $bucket"
-  fi
+  [[ "$count" -gt 0 ]] || die "No secrets loaded for bucket: $bucket"
+
+  local i k v esc
+  case "$dialect" in
+    posix | sh | bash | zsh)
+      for i in "${!keys[@]}"; do
+        printf 'export %s=%q\n' "${keys[$i]}" "${values[$i]}"
+      done
+      ;;
+    fish)
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\'/\\\'}" # fish single-quote escaping
+        printf "set -gx %s '%s'\n" "${keys[$i]}" "$esc"
+      done
+      ;;
+    nu | nushell)
+      # Emit a NUON record for: load-env (dot secrets load <bucket> --shell nu | from nuon)
+      printf '{\n'
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\"/\\\"}" # double-quote escaping
+        printf '  "%s": "%s"\n' "${keys[$i]}" "$esc"
+      done
+      printf '}\n'
+      ;;
+    *)
+      die "Unknown shell dialect: $dialect (want: posix|fish|nu)"
+      ;;
+  esac
 }
 
 cmd_secrets_load() {
-  cmd_env_load "${1:-ai}"
+  cmd_env_load "$@"
 }
 
 # Dispatch

package/scripts/dot/commands/security.sh

@@ -40,6 +40,10 @@ cmd_usb_safety() {
   run_script "scripts/security/usb-safety.sh" "USB safety script" "$@"
 }
 
+cmd_policy() {
+  run_script "scripts/security/enforce-policies.sh" "Policy enforcement script" "$@"
+}
+
 # Dispatch
 case "${1:-}" in
   backup)
@@ -70,6 +74,10 @@ case "${1:-}" in
     shift
     cmd_usb_safety "$@"
     ;;
+  policy)
+    shift
+    cmd_policy "$@"
+    ;;
   *)
     echo "Unknown security command: ${1:-}" >&2
     exit 1

package/scripts/dot/powershell/Dot.psm1

@@ -126,7 +126,7 @@ function Invoke-DotHelp {
     Write-Host ''
     Write-Host "  Version    v$version"
     Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
-    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/master/docs/manual/"
+    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/main/docs/manual/"
     Write-Host ''
     Write-Host 'Native PowerShell commands (no bash required):'
     Write-Host ''

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.508 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.510 standards maintained."
   exit 0
 fi