@sebastienrousseau/dotfiles 0.2.508 → 0.2.511

package/scripts/dot/commands/ai.sh

@@ -147,9 +147,7 @@ _ai_get_cached_status() {
 
 # Look up field $2 (2=present 0/1, 3=version) for binary $1 from the
 # cached TSV. Replaces a bash-4 associative array for macOS bash 3.2.
-_ai_status_field() {
-  awk -F'\t' -v b="$1" -v f="$2" '$1==b{print $f;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
-}
+# (Removed _ai_status_field — cmd_ai_status now reads both fields in one awk.)
 
 # _ai_mise_pkg (binary -> mise package map) is defined in lib/dot/ai-install.sh.
 
@@ -193,8 +191,13 @@ cmd_ai_status() {
       ui_section "$category"
       current_category="$category"
     fi
-    if [[ "$(_ai_status_field "$bin" 2)" == "1" ]]; then
-      ver="$(_ai_status_field "$bin" 3)"
+    # One awk over the cache line for this tool (was two: field 2 and field 3).
+    local _st_installed _st_ver
+    IFS=$'\t' read -r _st_installed _st_ver < <(
+      awk -F'\t' -v b="$bin" '$1==b{print $2"\t"$3;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
+    )
+    if [[ "$_st_installed" == "1" ]]; then
+      ver="$_st_ver"
       [[ -z "$ver" ]] && ver="installed"
       [[ "$bin" == "claude" ]] && ver="${ver%% *}"
       ui_ok "$name" "$ver — $desc"

package/scripts/dot/commands/appearance.sh

@@ -33,7 +33,20 @@ cmd_wallpaper() {
 }
 
 cmd_fonts() {
-  run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+  local sub="${1:-install}"
+  case "$sub" in
+    patch)
+      shift
+      run_script "scripts/fonts/patch-fonts.sh" "Font patch helper" "$@"
+      ;;
+    install | "")
+      [[ "$sub" == install ]] && shift || true
+      run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+      ;;
+    *)
+      run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+      ;;
+  esac
 }
 
 cmd_tune() {

package/scripts/dot/commands/completion.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+## `dot completion <bash|zsh|fish|nu>` — emit shell completion for `dot`,
+## generated from the canonical _dot_help_specs registry in bin/dot. Using one
+## source of truth keeps all four shells in sync (the previously hand-maintained
+## fish/nushell lists drifted and referenced non-existent commands).
+##
+## Usage:
+##   dot completion bash  >> ~/.bashrc.d/dot.bash
+##   dot completion zsh   > "${fpath[1]}/_dot"
+##   dot completion fish  > ~/.config/fish/completions/dot.fish
+##   dot completion nu    >> ~/.config/nushell/completions.nu
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+_completion_dot_cli() {
+  local src
+  src="$(resolve_source_dir)"
+  printf '%s/bin/dot\n' "$src"
+}
+
+# Emit "name<TAB>description" for every top-level command (a _dot_help_specs
+# field-2 entry with no space; entries containing a space are subcommands).
+# Strip ": ' from descriptions so they can't break any shell's quoting.
+_completion_commands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 !~ / / {
+      name = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", name)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      if (name != "") print name "\t" desc
+    }
+  ' "$cli"
+}
+
+# Emit "parent<TAB>child<TAB>description" for every subcommand (a field-2
+# entry that contains a space, e.g. "theme list" -> parent=theme child=list).
+_completion_subcommands() {
+  local cli
+  cli="$(_completion_dot_cli)"
+  awk -F'|' '
+    /_dot_help_specs\(\)/ { in_func = 1; next }
+    in_func && /cat <<'\''EOF'\''/ { in_block = 1; next }
+    in_block && /^EOF$/ { exit }
+    in_block && NF >= 3 && $2 ~ / / {
+      full = $2; desc = $3
+      gsub(/^[ \t]+|[ \t]+$/, "", full)
+      gsub(/^[ \t]+|[ \t]+$/, "", desc)
+      gsub(/[":\047]/, "", desc)
+      parent = full; sub(/ .*/, "", parent)
+      child = full; sub(/^[^ ]+ /, "", child)
+      if (parent != "" && child != "") print parent "\t" child "\t" desc
+    }
+  ' "$cli"
+}
+
+gen_bash() {
+  local names
+  names="$(_completion_commands | cut -f1 | tr '\n' ' ')"
+  printf '# dot bash completion — generated by: dot completion bash\n'
+  printf "complete -W '%s' dot\n" "${names% }"
+}
+
+gen_zsh() {
+  local name desc
+  printf '#compdef dot\n# generated by: dot completion zsh\n'
+  printf '_dot() {\n  local -a commands\n  commands=(\n'
+  while IFS=$'\t' read -r name desc; do
+    printf "    '%s:%s'\n" "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  )\n  _describe '\''command'\'' commands\n}\n_dot "$@"\n'
+}
+
+gen_fish() {
+  local name desc
+  printf '# dot fish completion — generated by: dot completion fish\n'
+  printf 'complete -c dot -f\n'
+  while IFS=$'\t' read -r name desc; do
+    printf 'complete -c dot -n "__fish_use_subcommand" -a %s -d "%s"\n' "$name" "$desc"
+  done < <(_completion_commands)
+  local parent child
+  while IFS=$'\t' read -r parent child desc; do
+    printf 'complete -c dot -n "__fish_seen_subcommand_from %s" -a %s -d "%s"\n' \
+      "$parent" "$child" "$desc"
+  done < <(_completion_subcommands)
+}
+
+gen_nu() {
+  local name desc
+  printf '# dot nushell completion — generated by: dot completion nu\n'
+  printf 'export extern dot [\n  command?: string@dot_commands\n  ...args: string\n]\n'
+  printf 'def dot_commands [] {\n  [\n'
+  while IFS=$'\t' read -r name desc; do
+    printf '    { value: "%s", description: "%s" }\n' "$name" "$desc"
+  done < <(_completion_commands)
+  printf '  ]\n}\n'
+}
+
+usage() {
+  cat <<'USAGE'
+Usage: dot completion <bash|zsh|fish|nu>
+
+Generate shell completion for `dot` from the canonical command registry.
+
+  dot completion bash  >> ~/.bashrc.d/dot.bash
+  dot completion zsh   > "${fpath[1]}/_dot"
+  dot completion fish  > ~/.config/fish/completions/dot.fish
+  dot completion nu    >> ~/.config/nushell/completions.nu
+USAGE
+}
+
+# Dispatch: $1 is the command name ("completion"); $2 is the target shell.
+case "${2:-}" in
+  bash) gen_bash ;;
+  zsh) gen_zsh ;;
+  fish) gen_fish ;;
+  nu | nushell) gen_nu ;;
+  "" | -h | --help | help) usage ;;
+  *)
+    echo "dot completion: unknown shell '${2}' (want: bash|zsh|fish|nu)" >&2
+    exit 1
+    ;;
+esac

package/scripts/dot/commands/core.sh

@@ -129,6 +129,10 @@ cmd_commit() {
   run_script "dot_local/bin/executable_git-ai-commit" "Git AI commit script" "$@"
 }
 
+cmd_uninstall() {
+  run_script "scripts/uninstall.sh" "Uninstall script" "$@"
+}
+
 cmd_clean_cache() {
   ui_info "Cache" "Clearing shell initialization caches"
   local cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}"
@@ -185,6 +189,10 @@ case "${1:-}" in
     shift
     cmd_clean_cache "$@"
     ;;
+  uninstall)
+    shift
+    cmd_uninstall "$@"
+    ;;
   *)
     echo "Unknown core command: ${1:-}" >&2
     exit 1

package/scripts/dot/commands/diagnostics.sh

@@ -110,6 +110,14 @@ cmd_chaos() {
   run_script "scripts/ops/chaos.sh" "Chaos engineering script" "$@"
 }
 
+cmd_teleport() {
+  run_script "scripts/ops/teleport.sh" "Teleport script" "$@"
+}
+
+cmd_secret_audit() {
+  run_script "scripts/diagnostics/secret-governance.sh" "Secret governance script" "$@"
+}
+
 cmd_bundle() {
   run_script "scripts/ops/bundle.sh" "Offline bundle script" "$@"
 }
@@ -207,6 +215,14 @@ case "${1:-}" in
     shift
     cmd_chaos "$@"
     ;;
+  teleport)
+    shift
+    cmd_teleport "$@"
+    ;;
+  secret-audit)
+    shift
+    cmd_secret_audit "$@"
+    ;;
   bundle)
     shift
     cmd_bundle "$@"

package/scripts/dot/commands/fleet.sh

@@ -102,7 +102,10 @@ cmd_fleet_status() {
   local last_apply=""
   local state_log="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/dot.log"
   if [[ -f "$state_log" ]]; then
-    last_apply="$(grep 'apply' "$state_log" 2>/dev/null | tail -1 | sed -n 's/^\[\([^]]*\)\].*/\1/p')"
+    # `set -euo pipefail` at the top of this script kills the whole
+    # command when grep matches nothing (rc=1). Wrap the pipeline so
+    # `last_apply` cleanly becomes empty and the UI still renders.
+    last_apply="$(grep 'apply' "$state_log" 2>/dev/null | tail -1 | sed -n 's/^\[\([^]]*\)\].*/\1/p' || true)"
   fi
 
   if [[ "$json_mode" -eq 1 ]]; then
@@ -202,9 +205,13 @@ cmd_fleet_drift() {
       local count="${1:-20}"
       tail -n "$count" "$_DRIFT_HISTORY_FILE" | while IFS= read -r line; do
         local time status file_count
-        time="$(printf '%s' "$line" | jq -r '.time' 2>/dev/null || echo "?")"
-        status="$(printf '%s' "$line" | jq -r '.status' 2>/dev/null || echo "?")"
-        file_count="$(printf '%s' "$line" | jq '.files | length' 2>/dev/null || echo 0)"
+        # One jq per line (was three: .time, .status, .files|length).
+        IFS=$'\t' read -r time status file_count < <(
+          printf '%s' "$line" | jq -r '[.time, .status, (.files | length)] | @tsv' 2>/dev/null
+        )
+        [[ -n "$time" ]] || time="?"
+        [[ -n "$status" ]] || status="?"
+        [[ -n "$file_count" ]] || file_count=0
         if [[ "$status" == "clean" ]]; then
           ui_ok "$time" "clean"
         else

package/scripts/dot/commands/lint.sh

@@ -19,6 +19,33 @@ dot_ui_command_banner "Lint" "${1:-}"
 SHELLCHECK_ARGS=(--severity=error -e SC1091 -e SC2030 -e SC2031)
 SHFMT_ARGS=(-i 2 -ci)
 
+# True only if the file's shebang names a shell that both shellcheck and shfmt
+# can process. The old `grep -qiE 'shell|bash|sh'` matched loosely — "sh" hit
+# "fish", and `file` output pulled in python3 scripts — so non-shell files
+# landed in the lint set and produced spurious SC1071 / shfmt parse "errors".
+_lint_is_shell() {
+  local first interp
+  first="$(head -1 "$1" 2>/dev/null)"
+  case "$first" in '#!'*) ;; *) return 1 ;; esac
+  interp="${first#\#!}"
+  interp="${interp#"${interp%%[![:space:]]*}"}" # ltrim
+  case "$interp" in
+    */env[[:space:]]*)
+      interp="${interp#*/env}"
+      interp="${interp#"${interp%%[![:space:]]*}"}"
+      interp="${interp%%[[:space:]]*}"
+      ;;
+    *)
+      interp="${interp%%[[:space:]]*}"
+      interp="${interp##*/}"
+      ;;
+  esac
+  case "$interp" in
+    sh | bash | dash | ksh | mksh | ash) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 cmd_lint() {
   local mode="${1:-all}"
   local src_dir
@@ -40,11 +67,10 @@ cmd_lint() {
   chezmoi_src="$(resolve_chezmoi_source_dir)"
   [[ -z "$chezmoi_src" ]] && chezmoi_src="$src_dir"
 
-  # dot_local/bin/executable_* scripts (shell scripts only)
+  # dot_local/bin/executable_* scripts — shell scripts only (skip python/zsh/etc
+  # by inspecting the shebang, so shellcheck/shfmt never see files they can't parse).
   while IFS= read -r -d '' f; do
-    if file "$f" 2>/dev/null | grep -qiE 'shell|bash|sh'; then
-      files+=("$f")
-    elif head -1 "$f" 2>/dev/null | grep -qE '^#!.*(bash|sh)'; then
+    if _lint_is_shell "$f"; then
       files+=("$f")
     fi
   done < <(find "$chezmoi_src/dot_local/bin" -name 'executable_*' -type f -print0 2>/dev/null)
@@ -69,17 +95,16 @@ cmd_lint() {
       if has_command shellcheck; then
         ui_section "ShellCheck"
         echo ""
-        local sc_fail=0
-        for f in "${files[@]}"; do
-          if ! shellcheck "${SHELLCHECK_ARGS[@]}" "$f" 2>/dev/null; then
-            sc_fail=$((sc_fail + 1))
-          fi
-        done
-        if [[ "$sc_fail" -eq 0 ]]; then
+        # One shellcheck invocation over all files (was one fork per file).
+        # gcc format is one line per issue, so failing files = unique paths.
+        local sc_out
+        sc_out="$(shellcheck -f gcc "${SHELLCHECK_ARGS[@]}" "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$sc_out" ]]; then
           ui_ok "shellcheck" "$total files clean"
         else
-          sc_errors=$sc_fail
-          ui_err "shellcheck" "$sc_fail file(s) with errors"
+          printf '%s\n' "$sc_out"
+          sc_errors=$(printf '%s\n' "$sc_out" | cut -d: -f1 | sort -u | grep -c .)
+          ui_err "shellcheck" "$sc_errors file(s) with errors"
         fi
         echo ""
       else
@@ -91,17 +116,15 @@ cmd_lint() {
       if has_command shfmt; then
         ui_section "shfmt"
         echo ""
-        local fmt_fail=0
-        for f in "${files[@]}"; do
-          if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
-            fmt_fail=$((fmt_fail + 1))
-          fi
-        done
-        if [[ "$fmt_fail" -eq 0 ]]; then
+        # `shfmt -l` lists files needing formatting in one invocation
+        # (was `shfmt -d` per file).
+        local fmt_list
+        fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+        if [[ -z "$fmt_list" ]]; then
           ui_ok "shfmt" "$total files formatted correctly"
         else
-          fmt_errors=$fmt_fail
-          ui_err "shfmt" "$fmt_fail file(s) need formatting"
+          fmt_errors=$(printf '%s\n' "$fmt_list" | grep -c .)
+          ui_err "shfmt" "$fmt_errors file(s) need formatting"
         fi
         echo ""
       else
@@ -118,17 +141,19 @@ cmd_lint() {
       fi
       ui_section "Auto-fixing with shfmt"
       echo ""
-      local fixed=0
-      for f in "${files[@]}"; do
-        if ! shfmt "${SHFMT_ARGS[@]}" -d "$f" >/dev/null 2>&1; then
+      # Find files needing formatting in one `shfmt -l` pass, then only
+      # rewrite that (usually small) set — was `shfmt -d` per file.
+      local fmt_list fixed=0
+      fmt_list="$(shfmt "${SHFMT_ARGS[@]}" -l "${files[@]}" 2>/dev/null || true)"
+      if [[ -z "$fmt_list" ]]; then
+        ui_ok "shfmt" "All files already formatted"
+      else
+        while IFS= read -r f; do
+          [[ -n "$f" ]] || continue
           shfmt "${SHFMT_ARGS[@]}" -w "$f"
           ui_ok "fixed" "${f#"$src_dir/"}"
           fixed=$((fixed + 1))
-        fi
-      done
-      if [[ "$fixed" -eq 0 ]]; then
-        ui_ok "shfmt" "All files already formatted"
-      else
+        done <<<"$fmt_list"
         ui_ok "shfmt" "$fixed file(s) reformatted"
       fi
       echo ""

package/scripts/dot/commands/registry.sh

@@ -102,7 +102,13 @@ _registry_fetch() {
   fi
   local tmp
   tmp="$(mktemp "${cache_file}.XXXXXX")"
-  if ! curl -fsSL --max-time 15 -o "$tmp" "$url"; then
+  # `-fsSL -o file` should be silent, but with some upstreams (e.g.
+  # GitHub Pages) curl still writes a stray newline to stdout. That
+  # newline leaks into the caller's `$(_registry_fetch)` and later
+  # into `jq FILE` as a two-argument invocation
+  # (`jq \n /path/to/file`), producing a confusing
+  # "Could not open file" error. Silence stdout explicitly.
+  if ! curl -fsSL --max-time 15 -o "$tmp" "$url" >/dev/null; then
     rm -f "$tmp"
     if [[ -s "$cache_file" ]]; then
       ui_warn "registry" "fetch failed; using stale cache at $cache_file"

package/scripts/dot/commands/secrets.sh

@@ -152,26 +152,80 @@ cmd_secrets_list() {
 }
 
 cmd_env_load() {
-  local bucket="${1:-ai}" data_file key value count=0
+  # Usage: dot secrets load [<bucket>] [--shell posix|fish|nu]
+  # Emits shell code to set the bucket's secrets as env vars, in the target
+  # shell's dialect so it works beyond POSIX:
+  #   posix (default):  eval "$(dot secrets load ai)"
+  #   fish:             dot secrets load ai --shell fish | source
+  #   nu:               load-env (dot secrets load ai --shell nu | from nuon)
+  local bucket="ai" dialect="posix" data_file key value count=0
+  local -a keys=() values=()
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --shell)
+        dialect="${2:-posix}"
+        shift 2
+        ;;
+      --shell=*)
+        dialect="${1#*=}"
+        shift
+        ;;
+      -*) die "Unknown flag: $1 (usage: dot secrets load [<bucket>] [--shell posix|fish|nu])" ;;
+      *)
+        bucket="$1"
+        shift
+        ;;
+    esac
+  done
+
   data_file="$(dot_data_file)"
   [[ -f "$data_file" ]] || die "Missing data file: $data_file"
 
   while IFS= read -r key; do
     value="$(dot_secrets_get "$key" || true)"
     if [[ -n "$value" ]]; then
-      # shell-safe export lines intended for: eval "$(dot env load <bucket>)"
-      printf "export %s=%q\n" "$key" "$value"
+      keys+=("$key")
+      values+=("$value")
       count=$((count + 1))
     fi
   done < <(dot_secrets_bucket_keys "$data_file" "$bucket")
 
-  if [[ "$count" -eq 0 ]]; then
-    die "No secrets loaded for bucket: $bucket"
-  fi
+  [[ "$count" -gt 0 ]] || die "No secrets loaded for bucket: $bucket"
+
+  local i k v esc
+  case "$dialect" in
+    posix | sh | bash | zsh)
+      for i in "${!keys[@]}"; do
+        printf 'export %s=%q\n' "${keys[$i]}" "${values[$i]}"
+      done
+      ;;
+    fish)
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\'/\\\'}" # fish single-quote escaping
+        printf "set -gx %s '%s'\n" "${keys[$i]}" "$esc"
+      done
+      ;;
+    nu | nushell)
+      # Emit a NUON record for: load-env (dot secrets load <bucket> --shell nu | from nuon)
+      printf '{\n'
+      for i in "${!keys[@]}"; do
+        v="${values[$i]}"
+        esc="${v//\\/\\\\}"
+        esc="${esc//\"/\\\"}" # double-quote escaping
+        printf '  "%s": "%s"\n' "${keys[$i]}" "$esc"
+      done
+      printf '}\n'
+      ;;
+    *)
+      die "Unknown shell dialect: $dialect (want: posix|fish|nu)"
+      ;;
+  esac
 }
 
 cmd_secrets_load() {
-  cmd_env_load "${1:-ai}"
+  cmd_env_load "$@"
 }
 
 # Dispatch

package/scripts/dot/commands/security.sh

@@ -40,6 +40,10 @@ cmd_usb_safety() {
   run_script "scripts/security/usb-safety.sh" "USB safety script" "$@"
 }
 
+cmd_policy() {
+  run_script "scripts/security/enforce-policies.sh" "Policy enforcement script" "$@"
+}
+
 # Dispatch
 case "${1:-}" in
   backup)
@@ -70,6 +74,10 @@ case "${1:-}" in
     shift
     cmd_usb_safety "$@"
     ;;
+  policy)
+    shift
+    cmd_policy "$@"
+    ;;
   *)
     echo "Unknown security command: ${1:-}" >&2
     exit 1

package/scripts/dot/commands/tools.sh

@@ -189,8 +189,17 @@ show_language_package_managers() {
     echo "  pip: $(pip3 --version | cut -d' ' -f2)"
   fi
   if has_command pipx; then
-    local pipx_installed
-    pipx_installed=$(pipx list --short 2>/dev/null | wc -l | tr -d ' ')
+    local pipx_installed pipx_list_out
+    # `pipx list --short` returns non-zero when any installed package
+    # has a broken interpreter (common). Under `set -euo pipefail` a
+    # naive `local x=$(pipx …)` cascades and kills `dot packages`
+    # mid-output. Capture the pipeline separately so we can fall back
+    # cleanly without stray "N/A" lines from pipe-with-|| tricks.
+    if pipx_list_out="$(pipx list --short 2>/dev/null)"; then
+      pipx_installed="$(printf '%s' "$pipx_list_out" | wc -l | tr -d ' ')"
+    else
+      pipx_installed="N/A"
+    fi
     echo "  pipx: $(pipx --version)"
     echo "    Installed: $pipx_installed"
   fi

package/scripts/dot/powershell/Dot.psm1

@@ -126,7 +126,7 @@ function Invoke-DotHelp {
     Write-Host ''
     Write-Host "  Version    v$version"
     Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
-    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/master/docs/manual/"
+    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/main/docs/manual/"
     Write-Host ''
     Write-Host 'Native PowerShell commands (no bash required):'
     Write-Host ''

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.508 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.511 standards maintained."
   exit 0
 fi

package/scripts/ops/heal-tools.sh

@@ -31,6 +31,12 @@ detect_pkg_manager() {
     echo "dnf"
   elif command -v pacman >/dev/null 2>&1; then
     echo "pacman"
+  elif command -v zypper >/dev/null 2>&1; then
+    echo "zypper"
+  elif command -v apk >/dev/null 2>&1; then
+    echo "apk"
+  elif command -v pkg >/dev/null 2>&1; then
+    echo "pkg"
   elif command -v nix-env >/dev/null 2>&1; then
     echo "nix"
   else
@@ -66,6 +72,28 @@ install_package() {
       fi
       sudo pacman -S --noconfirm --quiet "$pkg" >/dev/null 2>&1
       ;;
+    zypper)
+      if ! command -v sudo >/dev/null 2>&1; then
+        log_error "sudo not found — cannot install '$pkg' via zypper"
+        return 1
+      fi
+      sudo zypper --quiet install -y "$pkg" >/dev/null 2>&1
+      ;;
+    apk)
+      if command -v sudo >/dev/null 2>&1; then
+        sudo apk add --quiet "$pkg" >/dev/null 2>&1
+      else
+        apk add --quiet "$pkg" >/dev/null 2>&1
+      fi
+      ;;
+    pkg)
+      # FreeBSD/OpenBSD/NetBSD — install as root when available.
+      if command -v sudo >/dev/null 2>&1; then
+        sudo pkg install -y "$pkg" >/dev/null 2>&1
+      else
+        pkg install -y "$pkg" >/dev/null 2>&1
+      fi
+      ;;
     nix) nix-env -iA "nixpkgs.$pkg" >/dev/null 2>&1 ;;
     *)
       log_error "No supported package manager found. Install '$pkg' manually."

package/scripts/ops/teleport.sh

@@ -7,10 +7,10 @@
 
 set -euo pipefail
 
-TARGET="$1"
+TARGET="${1:-}"
 
 if [[ -z "$TARGET" ]]; then
-  echo "Usage: $0 user@host"
+  echo "Usage: dot teleport user@host"
   exit 1
 fi