@sebastienrousseau/dotfiles 0.2.508 → 0.2.511

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (82) hide show
  1. package/CHANGELOG.md +42 -0
  2. package/README.md +5 -5
  3. package/docs/COPYRIGHT +1 -1
  4. package/docs/GOVERNANCE.md +2 -2
  5. package/docs/adr/ADR-011-nushell-tier3-keep.md +2 -2
  6. package/docs/articles/.pages +6 -0
  7. package/docs/articles/2026-07-05-custom-mkdocs-material-dark-theme.md +216 -0
  8. package/docs/articles/2026-07-05-fish-startup-abbr.md +153 -0
  9. package/docs/articles/2026-07-05-master-to-main-rename-runbook.md +128 -0
  10. package/docs/articles/index.md +36 -0
  11. package/docs/guides/INSTALL.md +3 -3
  12. package/docs/index.md +116 -27
  13. package/docs/interop/A2A.md +2 -2
  14. package/docs/interop/POWERSHELL.md +4 -4
  15. package/docs/manual/00-introduction.md +3 -3
  16. package/docs/manual/01-concepts/02-trust-model.md +3 -3
  17. package/docs/manual/01-concepts/04-fleet.md +1 -1
  18. package/docs/manual/02-tutorials/01-first-install.md +1 -1
  19. package/docs/manual/02-tutorials/05-deploy-fleet.md +2 -2
  20. package/docs/manual/03-reference/02-config-files.md +1 -1
  21. package/docs/manual/03-reference/04-templates.md +1 -1
  22. package/docs/manual/04-cookbook/01-recipes.md +1 -1
  23. package/docs/manual/04-cookbook/02-troubleshooting.md +1 -1
  24. package/docs/manual/05-appendices/B-security-checklist.md +1 -1
  25. package/docs/manual/command-index.md +76 -1
  26. package/docs/manual/index.md +1 -1
  27. package/docs/operations/ARCHITECTURE_ROADMAP.md +145 -0
  28. package/docs/operations/CI_CADENCE.md +2 -2
  29. package/docs/operations/COMPLETIONS.md +2 -2
  30. package/docs/operations/COVERAGE.md +4 -4
  31. package/docs/operations/DRIFT.md +1 -1
  32. package/docs/operations/MAINTENANCE.md +6 -6
  33. package/docs/operations/PERFORMANCE.md +6 -6
  34. package/docs/operations/RELIABILITY.md +1 -1
  35. package/docs/operations/ROADMAP_V0_2_503.md +1 -1
  36. package/docs/operations/TRACEABILITY.md +2 -0
  37. package/docs/operations/TRUSTED_AGENT_WORKSTATION.md +6 -6
  38. package/docs/operations/VERSION_SYNC.md +3 -3
  39. package/docs/reference/UTILS.md +82 -0
  40. package/docs/security/AUDIT_BYPASS.md +3 -3
  41. package/docs/security/AUTOMATION_SECRETS.md +1 -1
  42. package/docs/security/CI_PINNING.md +10 -10
  43. package/docs/security/COMMIT_SIGNING.md +10 -10
  44. package/docs/security/DEPS_DEV_EXCEPTIONS.md +4 -4
  45. package/docs/security/DISCLOSURE.md +3 -3
  46. package/docs/security/INCIDENT_RESPONSE.md +1 -1
  47. package/docs/security/INSTALL_VERIFICATION.md +2 -2
  48. package/docs/security/MCP_POLICY.md +4 -4
  49. package/docs/security/SCORECARD.md +7 -7
  50. package/docs/security/SECURITY_CHECKLIST.md +1 -1
  51. package/docs/security/SHELL_EXEMPTIONS.md +2 -2
  52. package/docs/security/SOUP_REGISTER.md +4 -4
  53. package/docs/stylesheets/extra.css +444 -0
  54. package/docs/themes/hero-shot.svg +1 -1
  55. package/install.sh +17 -6
  56. package/package.json +1 -1
  57. package/scripts/ci/check-copyright-headers.sh +1 -1
  58. package/scripts/ci/check-shell-preamble.sh +1 -1
  59. package/scripts/ci/guard-gitleaks-checkout.sh +1 -1
  60. package/scripts/diagnostics/aliases-manifest.sh +19 -1
  61. package/scripts/diagnostics/verify_state.sh +6 -2
  62. package/scripts/diagnostics/version-locks.sh +10 -6
  63. package/scripts/dot/commands/agent.sh +12 -7
  64. package/scripts/dot/commands/ai.sh +8 -5
  65. package/scripts/dot/commands/appearance.sh +14 -1
  66. package/scripts/dot/commands/completion.sh +134 -0
  67. package/scripts/dot/commands/core.sh +8 -0
  68. package/scripts/dot/commands/diagnostics.sh +16 -0
  69. package/scripts/dot/commands/fleet.sh +11 -4
  70. package/scripts/dot/commands/lint.sh +55 -30
  71. package/scripts/dot/commands/registry.sh +7 -1
  72. package/scripts/dot/commands/secrets.sh +61 -7
  73. package/scripts/dot/commands/security.sh +8 -0
  74. package/scripts/dot/commands/tools.sh +11 -2
  75. package/scripts/dot/powershell/Dot.psm1 +1 -1
  76. package/scripts/git-hooks/pre-commit-audit.sh +1 -1
  77. package/scripts/ops/heal-tools.sh +28 -0
  78. package/scripts/ops/teleport.sh +2 -2
  79. package/scripts/qa/examples-coverage.sh +94 -0
  80. package/scripts/tools/detect-collisions.py +19 -1
  81. package/scripts/version-sync.sh +36 -2
  82. package/docs/_config.yml +0 -59
@@ -0,0 +1,94 @@
1
+ #!/usr/bin/env bash
2
+ # SPDX-License-Identifier: MIT
3
+ # Copyright (c) 2015-2026 Sebastien Rousseau
4
+ # =============================================================================
5
+ # examples-coverage.sh — enforce that every core feature domain ships a
6
+ # runnable example under examples/. Mirrors scripts/qa/docs-coverage.sh:
7
+ # it is a *coverage contract*, not a linter. Threshold defaults to 100%.
8
+ #
9
+ # A feature domain is "covered" when examples/example-<domain>.sh exists.
10
+ # Keep REQUIRED_AREAS in lockstep with the feature surface — adding a major
11
+ # user-facing capability (a new `dot` subsystem) means adding its example.
12
+ # =============================================================================
13
+ set -euo pipefail
14
+
15
+ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
16
+ REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
17
+ EXAMPLES_DIR="$REPO_ROOT/examples"
18
+ DOT_CLI="$REPO_ROOT/bin/dot"
19
+ MIN_EXAMPLES_COVERAGE="${MIN_EXAMPLES_COVERAGE:-100}"
20
+
21
+ # Public commands/subcommands, extracted from bin/dot's _dot_help_specs — the
22
+ # same source scripts/qa/docs-coverage.sh uses, so docs and examples stay in
23
+ # lockstep at the command granularity.
24
+ extract_public_commands() {
25
+ awk -F'|' '
26
+ /_dot_help_specs\(\)/ { in_func=1; next }
27
+ in_func && /cat <<'\''EOF'\''/ { in_block=1; next }
28
+ in_block && /^EOF$/ { exit }
29
+ in_block && NF>=2 { print $2 }
30
+ ' "$DOT_CLI"
31
+ }
32
+
33
+ # Core feature domains that must each have examples/example-<area>.sh.
34
+ REQUIRED_AREAS=(
35
+ ai-patterns
36
+ cli-utilities
37
+ coverage-gate
38
+ diagnostics
39
+ dot-commands
40
+ functions
41
+ fleet
42
+ git-hooks
43
+ install-uninstall
44
+ ops
45
+ platform-contract
46
+ qa
47
+ secrets
48
+ security
49
+ test-suite
50
+ testing-framework
51
+ theme
52
+ )
53
+
54
+ total=0
55
+ covered=0
56
+ missing=()
57
+
58
+ # --- Check 1: every feature domain has a dedicated example file. ---
59
+ for area in "${REQUIRED_AREAS[@]}"; do
60
+ total=$((total + 1))
61
+ if [ -f "$EXAMPLES_DIR/example-$area.sh" ]; then
62
+ covered=$((covered + 1))
63
+ else
64
+ missing+=("domain:$area")
65
+ fi
66
+ done
67
+
68
+ # --- Check 2: every public command/subcommand is referenced in an example. ---
69
+ while IFS= read -r cmd; do
70
+ [ -n "$cmd" ] || continue
71
+ total=$((total + 1))
72
+ # "dot <cmd>" followed by a non-identifier char (or EOL) — avoids matching
73
+ # `dot ai` against `dot ai-query`, and matches printf '...\n'-terminated refs.
74
+ if grep -rqE "dot ${cmd}([^A-Za-z0-9_-]|\$)" "$EXAMPLES_DIR" 2>/dev/null; then
75
+ covered=$((covered + 1))
76
+ else
77
+ missing+=("cmd:$cmd")
78
+ fi
79
+ done < <(extract_public_commands | sort -u)
80
+
81
+ pct="$(awk -v c="$covered" -v t="$total" \
82
+ 'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
83
+ printf 'Examples coverage: %s/%s (%s%%)\n' "$covered" "$total" "$pct"
84
+ printf 'Threshold: %s%%\n' "$MIN_EXAMPLES_COVERAGE"
85
+ if [ "${#missing[@]}" -gt 0 ]; then
86
+ printf 'Missing coverage for: %s\n' "${missing[*]}" >&2
87
+ fi
88
+
89
+ if awk -v p="$pct" -v min="$MIN_EXAMPLES_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'; then
90
+ printf 'PASS: every feature domain and every public command has an example.\n'
91
+ exit 0
92
+ fi
93
+ printf 'FAIL: examples coverage %s%% is below the %s%% threshold.\n' "$pct" "$MIN_EXAMPLES_COVERAGE" >&2
94
+ exit 1
@@ -8,7 +8,25 @@ import os
8
8
  import re
9
9
  import sys
10
10
 
11
- BASE_DIR = os.path.expanduser("~/.dotfiles/.chezmoitemplates")
11
+ # Post-Phase-4b (v0.2.503): chezmoi source is under the subdir
12
+ # named in .chezmoiroot (typically "defaults/"). Prefer the
13
+ # descended path; fall back to the old top-level layout for
14
+ # backwards compatibility.
15
+ _DOTFILES_ROOT = os.path.expanduser("~/.dotfiles")
16
+ _CHEZMOIROOT_FILE = os.path.join(_DOTFILES_ROOT, ".chezmoiroot")
17
+
18
+
19
+ def _resolve_chezmoi_root() -> str:
20
+ if os.path.isfile(_CHEZMOIROOT_FILE):
21
+ with open(_CHEZMOIROOT_FILE, "r", encoding="utf-8") as _f:
22
+ sub = _f.read().strip()
23
+ cand = os.path.join(_DOTFILES_ROOT, sub)
24
+ if os.path.isdir(cand):
25
+ return cand
26
+ return _DOTFILES_ROOT
27
+
28
+
29
+ BASE_DIR = os.path.join(_resolve_chezmoi_root(), ".chezmoitemplates")
12
30
  ALIASES_DIR = os.path.join(BASE_DIR, "aliases")
13
31
  FUNCTIONS_DIR = os.path.join(BASE_DIR, "functions")
14
32
 
@@ -78,6 +78,19 @@ EXCLUDE_FILES=(
78
78
  # CI_COMPOSITES.md cites third-party action versions (e.g. v5.0.5),
79
79
  # not dotfiles_version. False-positive pattern match.
80
80
  "docs/operations/CI_COMPOSITES.md"
81
+
82
+ # Living roadmap: references branch names / target versions
83
+ # (e.g. feature-branch names like feat/v0.2.X, phase milestones)
84
+ # that are NOT the current dotfiles_version. Auto-syncing
85
+ # rewrites them incorrectly.
86
+ "docs/operations/ARCHITECTURE_ROADMAP.md"
87
+
88
+ # Dated release write-ups: each article records the release it
89
+ # shipped in (e.g. "shipped in v0.2.510" + a link to that release
90
+ # tag). Those refs are historical fact, not current-version claims —
91
+ # bumping them would falsify the history.
92
+ "docs/articles/2026-07-05-fish-startup-abbr.md"
93
+ "docs/articles/2026-07-05-master-to-main-rename-runbook.md"
81
94
  )
82
95
 
83
96
  # shellcheck source=../lib/dot/ui.sh
@@ -180,6 +193,16 @@ find_version_files() {
180
193
  echo "docs/reference/FEATURES.md" >>"$temp_file"
181
194
  echo "docs/COPYRIGHT" >>"$temp_file"
182
195
 
196
+ # Non-markdown and hidden-directory surfaces rg's `--type md` scan above
197
+ # cannot reach: a shell script, and READMEs under the dotfile-hidden
198
+ # `.chezmoitemplates/` tree (rg skips dot-dirs without --hidden). These
199
+ # carry "current version" stamps that check-version-consistency.sh and
200
+ # the test_version_consistency unit test enforce, so keep them in sync.
201
+ echo "scripts/git-hooks/pre-commit-audit.sh" >>"$temp_file"
202
+ echo "defaults/.chezmoitemplates/README.md" >>"$temp_file"
203
+ echo "defaults/.chezmoitemplates/functions/README.md" >>"$temp_file"
204
+ echo "defaults/.chezmoitemplates/aliases/README.md" >>"$temp_file"
205
+
183
206
  # Remove duplicates and filter existing files
184
207
  sort -u "$temp_file" | while IFS= read -r file; do
185
208
  if [[ -f "$file" ]]; then
@@ -257,8 +280,11 @@ update_version_references() {
257
280
  temp_file=$(umask 077 && mktemp)
258
281
  cp "$file" "$temp_file"
259
282
 
260
- # Update various version reference patterns
261
- case "$(basename "$file")" in
283
+ # Update various version reference patterns. Match on the full repo
284
+ # path (not basename) so the root README's badge rules don't also
285
+ # capture other README.md files (e.g. the .chezmoitemplates READMEs),
286
+ # which carry a `(vX.Y.Z)` stamp handled by the generic case below.
287
+ case "$file" in
262
288
  "README.md")
263
289
  # Update badge and release link versions.
264
290
  sed_in_place "$temp_file" \
@@ -266,6 +292,14 @@ update_version_references() {
266
292
  -e "s|/releases/tag/v$SED_VERSION_PATTERN|/releases/tag/v$target_version|g" \
267
293
  -e "s|/dotfiles/v$SED_VERSION_PATTERN/|/dotfiles/v$target_version/|g"
268
294
  ;;
295
+ "scripts/git-hooks/pre-commit-audit.sh")
296
+ # "vX.Y.Z standards maintained" banner. Matched explicitly with a
297
+ # portable pattern — the generic `\bvX.Y.Z\b` rule below relies on
298
+ # GNU `\b`, which BSD/macOS sed does not support, so a local
299
+ # `version-sync` run would otherwise leave this script stale.
300
+ sed_in_place "$temp_file" \
301
+ -e "s|v$SED_VERSION_PATTERN standards maintained|v$target_version standards maintained|g"
302
+ ;;
269
303
  *)
270
304
  # Update explicit markdown version labels, backticks, and parentheses.
271
305
  # Skip lines containing MILESTONE.
package/docs/_config.yml DELETED
@@ -1,59 +0,0 @@
1
- title: ".dotfiles"
2
- description: "Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL — published at doc.dotfiles.io."
3
- url: "https://doc.dotfiles.io"
4
- baseurl: ""
5
-
6
- # Jekyll renders this site from docs/ — see .github/workflows/pages.yml.
7
- # Theme is the GitHub-hosted Cayman skin (zero-Gemfile setup); switch to
8
- # `remote_theme: just-the-docs/just-the-docs` later if a richer
9
- # navigation/search UX is wanted (requires plugin allowlist update on
10
- # GH Pages side).
11
- theme: jekyll-theme-cayman
12
-
13
- plugins:
14
- - jekyll-relative-links
15
- - jekyll-seo-tag
16
- - jekyll-sitemap
17
- - jekyll-redirect-from
18
- # Renders `README.md` as the directory index where present (matches
19
- # the GitHub-browse experience for users coming from the repo links
20
- # in docs/index.md).
21
- - jekyll-readme-index
22
-
23
- relative_links:
24
- enabled: true
25
- collections: true
26
-
27
- # Treat *.md as pages so cross-page links work without trailing-slash
28
- # kludges; include CNAME so the published artifact preserves it across
29
- # workflow deploys.
30
- include:
31
- - CNAME
32
- - .well-known
33
-
34
- exclude:
35
- - "*.tmpl"
36
- - "manual/_toc.yml"
37
- - "scripts/"
38
- - "Gemfile"
39
- - "Gemfile.lock"
40
- - "vendor/"
41
-
42
- markdown: kramdown
43
- kramdown:
44
- input: GFM
45
- syntax_highlighter: rouge
46
- hard_wrap: false
47
-
48
- # Many of our docs include chezmoi/Go-template snippets like
49
- # `{{ .variable }}` inside fenced code blocks. Liquid runs BEFORE
50
- # kramdown sees those fences and would try to resolve the placeholders
51
- # as Liquid expressions (silently dropping them from the output). Each
52
- # .md file therefore carries explicit `render_with_liquid: false` in
53
- # its frontmatter — a site-wide default in this block was not honored
54
- # reliably, so we keep the kill-switch per-page instead.
55
- defaults:
56
- - scope:
57
- path: ""
58
- values:
59
- layout: default