@sebastienrousseau/dotfiles 0.2.508 → 0.2.511

package/docs/stylesheets/extra.css

@@ -0,0 +1,444 @@
+/* ──────────────────────────────────────────────────────────────────────────
+ *  doc.dotfiles.io — custom theme
+ *  Dark + terminal-green palette on MkDocs Material.
+ *  Inspired by the polish of docs.n8n.io / GitHub docs dark, adapted to
+ *  Material's structure.
+ *  ────────────────────────────────────────────────────────────────────── */
+
+/* -- font stack ------------------------------------------------------------ */
+@import url("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap");
+
+:root {
+  --dot-font-body: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI",
+    "Helvetica Neue", Arial, sans-serif;
+  --dot-font-code: "JetBrains Mono", ui-monospace, SFMono-Regular, "SF Mono",
+    Menlo, Consolas, monospace;
+
+  --dot-green: #7ee787;         /* terminal green */
+  --dot-green-bright: #b0f5b7;  /* hover / focused */
+  --dot-green-dim: #4a9153;     /* muted / secondary */
+  --dot-green-rgb: 126, 231, 135;
+
+  --dot-bg: #0b0e14;            /* base */
+  --dot-bg-elev: #111621;       /* elevated card */
+  --dot-bg-elev-2: #161b26;     /* higher elevation */
+  --dot-border: #1f2937;
+  --dot-border-strong: #2b3646;
+
+  --dot-fg: #e4e7ec;
+  --dot-fg-muted: #94a3b8;
+  --dot-fg-subtle: #64748b;
+}
+
+/* -- global typography ----------------------------------------------------- */
+body,
+.md-typeset {
+  font-family: var(--dot-font-body);
+  font-feature-settings: "ss01", "cv11";
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+.md-typeset code,
+.md-typeset kbd,
+.md-typeset pre,
+code {
+  font-family: var(--dot-font-code);
+  font-feature-settings: "calt", "ss20";
+}
+
+/* -- dark palette override (slate) ---------------------------------------- */
+[data-md-color-scheme="slate"] {
+  --md-hue: 210;
+  --md-default-bg-color: var(--dot-bg);
+  --md-default-fg-color: var(--dot-fg);
+  --md-default-fg-color--light: var(--dot-fg-muted);
+  --md-default-fg-color--lighter: var(--dot-fg-subtle);
+  --md-default-fg-color--lightest: hsla(210, 20%, 40%, 0.3);
+
+  --md-primary-fg-color: var(--dot-green);
+  --md-primary-fg-color--light: var(--dot-green-bright);
+  --md-primary-fg-color--dark: var(--dot-green-dim);
+  --md-primary-bg-color: var(--dot-bg);
+  --md-primary-bg-color--light: var(--dot-bg-elev);
+
+  --md-accent-fg-color: var(--dot-green-bright);
+  --md-accent-fg-color--transparent: rgba(126, 231, 135, 0.1);
+  --md-accent-bg-color: var(--dot-bg);
+  --md-accent-bg-color--light: var(--dot-bg-elev);
+
+  --md-typeset-a-color: var(--dot-green);
+
+  --md-code-bg-color: var(--dot-bg-elev-2);
+  --md-code-fg-color: var(--dot-fg);
+  --md-code-hl-color: rgba(126, 231, 135, 0.12);
+  --md-code-hl-color--light: rgba(126, 231, 135, 0.08);
+
+  /* Admonitions */
+  --md-admonition-bg-color: var(--dot-bg-elev);
+  --md-admonition-fg-color: var(--dot-fg);
+
+  /* Footer */
+  --md-footer-bg-color: #050710;
+  --md-footer-bg-color--dark: #030509;
+}
+
+/* -- header --------------------------------------------------------------- */
+.md-header {
+  background-color: rgba(11, 14, 20, 0.92);
+  backdrop-filter: saturate(180%) blur(12px);
+  -webkit-backdrop-filter: saturate(180%) blur(12px);
+  border-bottom: 1px solid var(--dot-border);
+  box-shadow: none;
+}
+
+.md-header[data-md-state="shadow"] {
+  box-shadow: 0 1px 0 var(--dot-border);
+}
+
+.md-header__title {
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.md-header__button.md-logo :is(img, svg) {
+  color: var(--dot-green);
+  fill: var(--dot-green);
+  height: 1.6rem;
+  width: 1.6rem;
+}
+
+/* -- tabs --------------------------------------------------------------- */
+.md-tabs {
+  background-color: rgba(11, 14, 20, 0.85);
+  border-bottom: 1px solid var(--dot-border);
+}
+
+.md-tabs__link {
+  color: var(--dot-fg-muted);
+  opacity: 1;
+  font-size: 0.75rem;
+  font-weight: 500;
+  transition: color 120ms ease;
+}
+
+.md-tabs__link:hover,
+.md-tabs__link--active {
+  color: var(--dot-green-bright);
+}
+
+.md-tabs__link--active {
+  position: relative;
+}
+.md-tabs__link--active::after {
+  content: "";
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: -2px;
+  height: 2px;
+  background: linear-gradient(90deg, transparent, var(--dot-green), transparent);
+}
+
+/* -- sidebar (left nav) --------------------------------------------------- */
+.md-nav__title {
+  font-size: 0.68rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--dot-fg-subtle);
+  padding-top: 1.2rem;
+}
+
+.md-nav__link {
+  color: var(--dot-fg-muted);
+  transition: color 120ms ease, background-color 120ms ease;
+  border-radius: 6px;
+  padding: 4px 8px;
+  margin: 1px 0;
+}
+.md-nav__link:hover {
+  color: var(--dot-fg);
+  background: rgba(126, 231, 135, 0.06);
+}
+.md-nav__link--active,
+.md-nav__link.md-nav__link--active {
+  color: var(--dot-green-bright);
+  background: rgba(126, 231, 135, 0.1);
+  font-weight: 500;
+}
+
+/* -- right TOC ------------------------------------------------------------ */
+.md-nav--secondary .md-nav__title {
+  border-left: 2px solid var(--dot-border);
+  background: transparent;
+}
+.md-nav--secondary .md-nav__link--active {
+  border-left: 2px solid var(--dot-green);
+  color: var(--dot-green-bright);
+  background: transparent;
+}
+
+/* -- content -------------------------------------------------------------- */
+.md-typeset h1,
+.md-typeset h2,
+.md-typeset h3,
+.md-typeset h4 {
+  font-family: var(--dot-font-body);
+  letter-spacing: -0.02em;
+  color: var(--dot-fg);
+}
+
+.md-typeset h1 {
+  font-weight: 700;
+  font-size: 2.2rem;
+  line-height: 1.15;
+  margin-bottom: 0.6em;
+  background: linear-gradient(180deg, #ffffff 0%, #cbd5e1 100%);
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+}
+
+.md-typeset h2 {
+  font-weight: 600;
+  font-size: 1.6rem;
+  margin-top: 2.4em;
+  padding-top: 0.4em;
+  border-top: 1px solid var(--dot-border);
+}
+
+.md-typeset h3 {
+  font-weight: 600;
+  font-size: 1.2rem;
+  color: var(--dot-green-bright);
+}
+
+.md-typeset a {
+  text-decoration: none;
+  border-bottom: 1px solid transparent;
+  transition: border-color 120ms ease, color 120ms ease;
+}
+.md-typeset a:hover {
+  border-bottom-color: var(--dot-green-bright);
+  color: var(--dot-green-bright);
+}
+
+/* -- code blocks ---------------------------------------------------------- */
+.md-typeset pre > code,
+.md-typeset .highlight pre {
+  background-color: var(--dot-bg-elev-2);
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+}
+.md-typeset code {
+  background-color: rgba(126, 231, 135, 0.08);
+  border: 1px solid rgba(126, 231, 135, 0.15);
+  color: var(--dot-green-bright);
+  border-radius: 4px;
+  padding: 0.1em 0.35em;
+  font-size: 0.88em;
+}
+.md-typeset pre > code {
+  background: transparent;
+  border: none;
+  color: var(--dot-fg);
+  padding: 0;
+}
+
+/* -- tables --------------------------------------------------------------- */
+.md-typeset table:not([class]) {
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+  overflow: hidden;
+  font-size: 0.8rem;
+}
+.md-typeset table:not([class]) th {
+  background: var(--dot-bg-elev);
+  color: var(--dot-fg);
+  font-weight: 600;
+  border-bottom: 1px solid var(--dot-border-strong);
+}
+.md-typeset table:not([class]) tr:hover {
+  background: rgba(126, 231, 135, 0.03);
+}
+
+/* -- admonitions ---------------------------------------------------------- */
+.md-typeset .admonition,
+.md-typeset details {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-left: 3px solid var(--dot-green);
+  border-radius: 8px;
+  box-shadow: none;
+}
+.md-typeset .admonition-title,
+.md-typeset summary {
+  background: transparent;
+  border-bottom: 1px solid var(--dot-border);
+  font-weight: 600;
+}
+
+/* -- grid cards ----------------------------------------------------------- */
+.md-typeset .grid.cards > :is(ul, ol) > li,
+.md-typeset .grid.cards > .card {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-radius: 12px;
+  padding: 1.2rem;
+  transition: transform 180ms ease, border-color 180ms ease,
+    box-shadow 180ms ease, background 180ms ease;
+  position: relative;
+  overflow: hidden;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  background: radial-gradient(
+    circle at top left,
+    rgba(126, 231, 135, 0.06),
+    transparent 60%
+  );
+  opacity: 0;
+  transition: opacity 220ms ease;
+  pointer-events: none;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li:hover {
+  transform: translateY(-2px);
+  border-color: rgba(126, 231, 135, 0.35);
+  background: var(--dot-bg-elev-2);
+  box-shadow: 0 8px 24px -8px rgba(0, 0, 0, 0.5),
+    0 0 0 1px rgba(126, 231, 135, 0.08) inset;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li:hover::before {
+  opacity: 1;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li > :first-child {
+  margin-top: 0;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li strong {
+  color: var(--dot-green-bright);
+  font-weight: 600;
+  font-size: 1rem;
+  display: block;
+  margin-bottom: 0.4rem;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li .twemoji,
+.md-typeset .grid.cards > :is(ul, ol) > li svg {
+  color: var(--dot-green);
+  fill: var(--dot-green);
+  height: 1.4rem;
+  width: 1.4rem;
+  margin-bottom: 0.6rem;
+}
+
+/* -- hero banner (used by landing page) ----------------------------------- */
+.dot-hero {
+  padding: 3rem 0 2.4rem;
+  margin: -1.6rem -0.8rem 2.4rem;
+  text-align: center;
+  border-bottom: 1px solid var(--dot-border);
+  position: relative;
+  background: radial-gradient(
+    ellipse 60% 100% at 50% 0%,
+    rgba(126, 231, 135, 0.08),
+    transparent 70%
+  );
+}
+.dot-hero h1 {
+  font-size: 3rem;
+  line-height: 1.05;
+  margin-bottom: 0.4em;
+  padding: 0;
+  border: none;
+}
+.dot-hero .tagline {
+  font-size: 1.1rem;
+  color: var(--dot-fg-muted);
+  max-width: 40rem;
+  margin: 0 auto 1.4rem;
+}
+.dot-hero .buttons {
+  display: flex;
+  gap: 0.6rem;
+  justify-content: center;
+  flex-wrap: wrap;
+}
+.dot-hero .buttons a {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  padding: 0.6rem 1.1rem;
+  border-radius: 8px;
+  font-weight: 500;
+  font-size: 0.9rem;
+  text-decoration: none;
+  border: 1px solid var(--dot-border-strong);
+  color: var(--dot-fg);
+  transition: all 160ms ease;
+}
+.dot-hero .buttons a.primary {
+  background: var(--dot-green);
+  color: var(--dot-bg);
+  border-color: var(--dot-green);
+  font-weight: 600;
+}
+.dot-hero .buttons a.primary:hover {
+  background: var(--dot-green-bright);
+  border-color: var(--dot-green-bright);
+  transform: translateY(-1px);
+}
+.dot-hero .buttons a:not(.primary):hover {
+  border-color: var(--dot-green);
+  color: var(--dot-green-bright);
+}
+
+/* -- search --------------------------------------------------------------- */
+.md-search__form {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+}
+.md-search__form:hover,
+.md-search__input:focus + .md-search__icon,
+.md-search__form:focus-within {
+  border-color: var(--dot-green);
+  background: var(--dot-bg-elev-2);
+}
+.md-search__input {
+  color: var(--dot-fg);
+}
+.md-search__input::placeholder {
+  color: var(--dot-fg-subtle);
+}
+
+/* -- footer --------------------------------------------------------------- */
+.md-footer {
+  border-top: 1px solid var(--dot-border);
+}
+.md-footer-meta {
+  background: var(--dot-bg);
+  border-top: 1px solid var(--dot-border);
+}
+.md-copyright {
+  color: var(--dot-fg-subtle);
+  font-size: 0.72rem;
+}
+
+/* -- scrollbar (webkit) --------------------------------------------------- */
+::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+}
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+::-webkit-scrollbar-thumb {
+  background: var(--dot-border-strong);
+  border-radius: 8px;
+  border: 2px solid var(--dot-bg);
+}
+::-webkit-scrollbar-thumb:hover {
+  background: var(--dot-green-dim);
+}

package/docs/themes/hero-shot.svg

@@ -70,7 +70,7 @@
     <!-- New prompt -->
     <text x="40" y="405" fill="#a6e3a1">&#10148;</text>
     <text x="60" y="405" fill="#cdd6f4">~/.dotfiles</text>
-    <text x="170" y="405" fill="#f5c2e7">on master</text>
+    <text x="170" y="405" fill="#f5c2e7">on main</text>
     <rect x="275" y="393" width="8" height="16" fill="#cdd6f4">
       <animate attributeName="opacity" values="1;0;1" dur="1s" repeatCount="indefinite" />
     </rect>

package/install.sh

@@ -2,9 +2,20 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
-# Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"
+# Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
 # (or ./install.sh locally)
 
+# This installer uses bash features (set -o pipefail, arrays, [[ ]]). If it is
+# run under a POSIX/other shell — e.g. `sh install.sh` or piped to `sh` where
+# /bin/sh is dash — fail fast with a clear message instead of the cryptic
+# "set: Illegal option -o pipefail" from the next line. Kept strictly POSIX so
+# it parses in any shell before bash takes over.
+if [ -z "${BASH_VERSION:-}" ]; then
+  echo "install.sh requires bash. Run:  bash install.sh" >&2
+  echo "  or:  bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)\"" >&2
+  exit 1
+fi
+
 set -euo pipefail
 
 # Restrict the permissions of any file/dir we create during bootstrap.
@@ -60,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.508)
+  version       The version (tag or branch) to install (default: v0.2.511)
 
 Options:
   --help        Show this help message
@@ -76,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.508"
+  local version="v0.2.511"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -106,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.508)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.511)."
         fi
         version="$arg"
         version_set=1
@@ -351,7 +362,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.508 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.511 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -360,7 +371,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.508 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.511 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.508",
+  "version": "0.2.511",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/ci/check-copyright-headers.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/check-copyright-headers.sh" "$@"

package/scripts/ci/check-shell-preamble.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/check-shell-preamble.sh" "$@"

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
-# Pinned reusable workflows on master still reference the old path;
+# Pinned reusable workflows on main still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail
 exec bash "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/tools/ci/guard-gitleaks-checkout.sh" "$@"

package/scripts/diagnostics/aliases-manifest.sh

@@ -22,7 +22,25 @@ resolve_source_dir() {
   return 1
 }
 
-src_dir="${1:-$(resolve_source_dir)}"
+# Descend into the chezmoi source subdir (per `.chezmoiroot`) if
+# present — post-Phase-4b (v0.2.503) the aliases + functions trees
+# live under `defaults/.chezmoitemplates/`, not at the repo root.
+# See `resolve_chezmoi_source_dir` in lib/dot/utils.sh.
+resolve_chezmoi_source_dir() {
+  local root="$1"
+  if [[ -f "$root/.chezmoiroot" ]]; then
+    local sub
+    sub="$(head -1 "$root/.chezmoiroot" | tr -d '[:space:]')"
+    if [[ -n "$sub" && -d "$root/$sub" ]]; then
+      printf "%s\n" "$root/$sub"
+      return
+    fi
+  fi
+  printf "%s\n" "$root"
+}
+
+src_root="${1:-$(resolve_source_dir)}"
+src_dir="$(resolve_chezmoi_source_dir "$src_root")"
 
 rg -n \
   -e '^[[:space:]]*alias[[:space:]]+[A-Za-z0-9_.:-]+=' \

package/scripts/diagnostics/verify_state.sh

@@ -32,8 +32,12 @@ check_alias_in_config() {
 }
 
 # 1. Verify Docs
-check_file ".chezmoitemplates/aliases/security/README.md"
-check_file ".chezmoitemplates/aliases/legal/README.md"
+# Post-Phase-4b (v0.2.503): chezmoi source is under the subdir
+# named in .chezmoiroot (typically "defaults/"). Paths without the
+# prefix silently return "missing" from any CWD other than
+# ~/.dotfiles/defaults/.
+check_file "defaults/.chezmoitemplates/aliases/security/README.md"
+check_file "defaults/.chezmoitemplates/aliases/legal/README.md"
 
 # 2. Verify Scripts
 check_file "scripts/security/lock-configs.sh"

package/scripts/diagnostics/version-locks.sh

@@ -67,20 +67,24 @@ else
 fi
 
 ui_section "Node/Python pins"
-if [[ -f "$src_dir/dot_node-version" ]]; then
-  ui_kv "node" "$(cat "$src_dir/dot_node-version")"
+# Chezmoi-tracked files (dot_*) live under $cm_src (defaults/) post-
+# Phase-4b, NOT at repo root. Using $src_dir here silently rendered
+# an empty section on every workstation.
+if [[ -f "$cm_src/dot_node-version" ]]; then
+  ui_kv "node" "$(cat "$cm_src/dot_node-version")"
 fi
-if [[ -f "$src_dir/dot_noderc.tmpl" ]]; then
-  ui_kv "noderc" "$(sed -n '1p' "$src_dir/dot_noderc.tmpl")"
+if [[ -f "$cm_src/dot_noderc.tmpl" ]]; then
+  ui_kv "noderc" "$(sed -n '1p' "$cm_src/dot_noderc.tmpl")"
 fi
 
 ui_section "Package manager locks"
-if [[ -f "$src_dir/dot_config/shell/Brewfile" ]]; then
+if [[ -f "$cm_src/dot_config/shell/Brewfile" ]]; then
   ui_kv "brew" "Brewfile present"
 fi
-if [[ -f "$src_dir/dot_config/shell/Brewfile.cli" ]]; then
+if [[ -f "$cm_src/dot_config/shell/Brewfile.cli" ]]; then
   ui_kv "brew-cli" "Brewfile.cli present"
 fi
+# package.json (if any) is a repo-root artefact — use $src_dir.
 if [[ -f "$src_dir/package.json" ]]; then
   ui_kv "node" "package.json version pinned"
 fi

package/scripts/dot/commands/agent.sh

@@ -88,12 +88,13 @@ _agent_apply_profile_env() {
   # Split declare-and-assign to avoid masking the field-getter's exit
   # code (SC2155). If the profile JSON is malformed, the assignment
   # now fails the function instead of silently exporting an empty value.
-  local approval filesystem network mcp_profile max_steps
-  approval="$(_agent_profile_field "$name" "approval")"
-  filesystem="$(_agent_profile_field "$name" "filesystem")"
-  network="$(_agent_profile_field "$name" "network")"
-  mcp_profile="$(_agent_profile_field "$name" "mcpProfile")"
-  max_steps="$(_agent_profile_field "$name" "maxSteps")"
+  local approval filesystem network mcp_profile max_steps tuple
+  # One jq read of all five policy fields (was five separate jq processes on
+  # every profile application). `|| return 1` preserves fail-on-malformed.
+  tuple="$(jq -r --arg name "$name" \
+    '.profiles[$name] | [.approval, .filesystem, .network, .mcpProfile, .maxSteps] | @tsv' \
+    "$(_agent_profiles_file)")" || return 1
+  IFS=$'\t' read -r approval filesystem network mcp_profile max_steps <<<"$tuple"
   export DOT_AGENT_APPROVAL="$approval"
   export DOT_AGENT_FILESYSTEM="$filesystem"
   export DOT_AGENT_NETWORK="$network"
@@ -404,7 +405,11 @@ EOF
     a2a-card)
       local a2a_card_file json_mode=0 validate_mode=0 strict_mode=0
       local repo_root
-      repo_root="$(_agent_repo_root)"
+      # `.well-known/` is NOT chezmoi-tracked — it lives at the
+      # actual repo root, not the descended `defaults/` subdir.
+      # Bypass `_agent_repo_root` (which descends) and read the
+      # true root directly.
+      repo_root="$(require_source_dir)"
       a2a_card_file="$repo_root/.well-known/agent-card.json"
       while [[ $# -gt 0 ]]; do
         case "$1" in