@sebastienrousseau/dotfiles 0.2.511 → 0.2.512

package/docs/operations/ROADMAP_V0_2_503.md

@@ -1,134 +1,10 @@
 ---
-title: "v0.2.503 Roadmap — Enterprise-Ready, Cross-Platform"
-date: 2026-05-17
+title: "v0.2.503 Roadmap - Historical"
 ---
 
-# v0.2.503 — Enterprise-Ready Cross-Platform Polish
+# v0.2.503 Roadmap
 
-## Why this release
+This v0.2.503 planning document is historical. Active roadmap content has been
+consolidated into [`../../ROADMAP.md`](../../ROADMAP.md).
 
-The R4 audit (`HARD_AUDIT_2026.md` Part 8) ranked the framework
-9.0/10 on internal quality but only 7.5/10 on adoption readiness.
-The gap is **distribution + cross-platform polish + visible
-organisation** — not feature surface. v0.2.503 closes that gap
-without breaking existing user installs.
-
-Reference target: <https://github.com/Debian/aws-cli> — the Debian
-packaging of AWS CLI, often cited as a model of simple, focused
-top-level structure. We will not blindly copy its layout (it ships
-a Python project, we ship a chezmoi-managed shell framework), but
-we will adopt its discipline: every top-level path has a clear
-purpose, contributors orient in under 30 seconds.
-
-## Scope (non-breaking; v0.2.503)
-
-### A — Visible structure (no file moves)
-
-| | |
-|---|---|
-| `STRUCTURE.md` at root | Single-page map of every top-level path, why it exists, and what it deploys to. Answers "what is `dot_config/`?", "why are there 25 root files?", "where is the CLI?" — in under 30 seconds. |
-| `scripts/README.md` | Map of `scripts/{ci,diagnostics,dot,lib,maintenance,ops,security,tools,tuning}` subtrees. |
-| Root `dot_*` files explained | The 20+ `dot_*` / `executable_*` / `private_*` prefixed files at root are not clutter — they are required by chezmoi to render at the corresponding `~/.X` path. STRUCTURE.md makes this contract visible. |
-
-### B — UX polish
-
-| | |
-|---|---|
-| Sweep remaining tabular `dot` commands through `ui_table_begin/add/end` | Already done: `dot env`, `dot agents list`, `dot registry list/search`, `dot aliases list/search`. Identify any other listing commands not yet on the helper and convert. |
-| `dot doctor` rendering | Today emits 100+ lines of `ui_ok / ui_warn / ui_err`. Group into bordered sections with totals at the foot. |
-| `dot help` two-column table | The grouped help index could become a gum-table by section. |
-| `dot fleet status` widening | Use the table helper for the per-node status block. |
-
-### C — Performance
-
-| | |
-|---|---|
-| `_cached_eval` coverage audit | Find every `eval "$(<tool> init <shell>)"` in `rc.d/` not already wrapped; add to cache layer. |
-| Shell startup p50/p95 in CI | New `dot-cli-bench` workflow exists for the CLI cold-start gate; add an equivalent zsh/bash/fish startup-time gate (sub-150ms cold). |
-| Cross-shell `_cached_eval` parity | bash + fish + nu implementations exist; confirm they all do the realpath sidecar pin + suspicious-output check that zsh added. |
-
-### D — Cross-platform CI parity
-
-| | |
-|---|---|
-| Windows-native smoke test expansion | `tools/ci/windows-smoke-test.ps1` exists but only covers a few commands. Add `dot version / dot help / dot agents check / dot doctor` Windows-native runs. |
-| Real `ubuntu-latest` + `macos-latest` + `windows-latest` matrix for the test runner | Currently `ubuntu` + `macos` only; add `windows-latest` to the regular test workflow. |
-| `chezmoi apply --dry-run` on all three OSes | Verify our templates render on every platform on every PR. |
-
-### E — Code dedup + refactor (in-place)
-
-| | |
-|---|---|
-| Audit `scripts/dot/lib/*` for cross-file duplication | Many small helpers may exist in 2+ places. Consolidate. |
-| Consistent error-exit codes | Document the canonical exit-code map (1 = bad usage, 2 = no provider, 3 = empty, etc. — `dot secrets` already follows this). Audit other commands for drift. |
-| `set -euo pipefail` header lint | Make sure every script under `scripts/` has the canonical header. |
-
-### F — Distribution + discoverability (R4 Top-5 work)
-
-| | |
-|---|---|
-| Homebrew tap stub | Create `install/homebrew/dot.rb` formula scaffold. Real publication still needs the v0.3 reorganization. |
-| Scoop manifest stub | Same for `install/scoop/dot.json`. |
-| `awesome-dotfiles` PR draft | One-line entry + screenshot. Land it after v0.2.503 ships. |
-
-### G — OpenSSF Scorecard 10/10 across every check
-
-Target the [public Scorecard report](https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles) and drive every check to 10/10:
-
-| Check | Today (baseline) | Path to 10 |
-|---|---|---|
-| **Binary-Artifacts** | 10 (no binaries committed) | Maintain — pre-commit guard rejecting any committed binary. |
-| **Branch-Protection** | needs token | Already configured on `main` (required reviews, signed commits, status-check gating, linear history). Verify in `gh api repos/.../branches/main/protection` and document in `docs/security/`. |
-| **CI-Tests** | 10 (CI passes on every PR) | Maintain — current 75-check matrix is comprehensive. |
-| **CII-Best-Practices** / OpenSSF Best Practices badge | not present | Apply for the badge at [bestpractices.coreinfrastructure.org](https://www.bestpractices.dev/) and embed the badge in README. |
-| **Code-Review** | needs verification | Already enforced via branch protection; document in CONTRIBUTING.md. |
-| **Contributors** | low (solo) | Acknowledge — solo-maintained framework. Add `MAINTAINERS.md` + `GOVERNANCE.md` documenting the single-maintainer model and contribution path. |
-| **Dangerous-Workflow** | 10 (no `pull_request_target` with checkout-then-build) | Maintain — `.github/workflows/` is already audited. |
-| **Dependency-Update-Tool** | 10 (Dependabot + Renovate configured) | Maintain. |
-| **Fuzzing** | partial (1 fuzz harness for `install.sh`) | Add OSS-Fuzz integration **OR** expand `tests/fuzz/` coverage (URL parsers, manifest validators, secret-bucket loaders). |
-| **License** | 10 (MIT, top-level `LICENSE`) | Maintain. |
-| **Maintained** | high (active commits weekly) | Maintain. |
-| **Packaging** | low (no distro package) | Address via the Homebrew tap / Scoop manifest / AUR PKGBUILD in §F. SLSA-attested release artefacts now exist (v0.2.502 backfill confirmed). |
-| **Pinned-Dependencies** | 9 (one tag-pinned reusable workflow — SLSA, documented exception) | Already documented; verify Scorecard accepts the SLSA exception. |
-| **SAST** | 10 (CodeQL + Semgrep + Codacy in CI) | Maintain. |
-| **Security-Policy** | 10 (`.github/SECURITY.md` + WKD-published GPG key + disclosure-key-expiry monitor) | Maintain. |
-| **Signed-Releases** | 8–10 (Cosign-signed SBOM + SLSA provenance now landing per v0.2.502 backfill) | Verify Scorecard re-scrapes the v0.2.502 release post-backfill; should bump to 10. |
-| **Token-Permissions** | 10 (top-level `permissions: contents: read`; per-job overrides) | Maintain — set during R3 hardening. |
-| **Vulnerabilities** | 10 (osv-scanner + Dependabot keep open count at 0) | Maintain. |
-| **Webhooks** | n/a | No org-level webhooks; check not applicable. |
-
-**Action items:**
-
-1. Run `scorecard` locally with the official Docker image, snapshot current scores into `docs/security/SCORECARD.md`.
-2. Apply for OpenSSF Best Practices badge (≤30-min form).
-3. Add `MAINTAINERS.md` + `GOVERNANCE.md`.
-4. Re-trigger Scorecard workflow after v0.2.502 backfill so the dashboard reflects the fixed Signed-Releases score.
-5. Track every sub-10 score with a follow-up issue tagged `scorecard`.
-
-## Reorganisation now in-scope (was deferred — see RFC)
-
-Pulled forward from v0.3.0 into this PR per maintainer request.
-The R4 audit identified the framework / user-config intermingling
-as the highest-leverage structural gap. Implementation is phased
-per `RFC_v0_2_503_reorganization.md`; each phase is independently
-atomic.
-
-| Move | Why it's breaking |
-|------|-------------------|
-| `dot_config/` → `defaults/` (with chezmoi `.chezmoiroot`) | Every existing user's chezmoi source-state would need to re-bootstrap. |
-| `bin/dot` → `bin/dot` | Same; `~/.local/bin/dot` would be removed before the new path is installed. |
-| Split `framework/` (CLI + lib) from user-facing defaults | Major restructuring; needs RFC + migration tool + 2-version deprecation window. |
-
-These will land in v0.2.503 as a coordinated single PR with a
-`migrate-v0_2-to-v0_3.sh` script.
-
-## Success criteria (v0.2.503)
-
-- [ ] New contributor can answer "where is the CLI?" / "what is `dot_config/`?" / "how do I add a new command?" in under 30 seconds using only the root `STRUCTURE.md` + `scripts/README.md`.
-- [ ] `dot lint` reports 328+ files clean.
-- [ ] Shell startup p50 ≤ 100ms in CI on all three OSes.
-- [ ] `dot env list` / `dot agents list` / `dot registry list` render with gorgeous gum tables (already done — bake into screenshot for README).
-- [ ] `windows-latest` is in the regular test matrix.
-- [ ] Pre-existing CI infrastructure failures (SLSA, etc.) stay green after the v0.2.502 fix series.
-- [ ] **OpenSSF Scorecard reports 10/10 on every applicable check** at <https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles>.
-- [ ] OpenSSF Best Practices badge displayed in README.
+Release history remains in [`../../CHANGELOG.md`](../../CHANGELOG.md).

package/docs/reference/THEMES.md

@@ -54,7 +54,7 @@ Examples (depend on what's present on your system):
 |:---|:---|
 | `~/Pictures/Wallpapers/tahoe.heic` (dynamic HEIC, 2 frames) | `tahoe-dark`, `tahoe-light` |
 | `/System/Library/Desktop Pictures/Sonoma.heic` | `sonoma-dark`, `sonoma-light` |
-| `/System/Library/Desktop Pictures/.thumbnails/Dome Dark.heic` + `Dome Light.heic` | `dome-dark`, `dome-light` |
+| `/System/Library/Desktop Pictures/.thumbnails/Monterey Dark.heic` + `Monterey Light.heic` | `monterey-dark`, `monterey-light` |
 
 Only paired themes (with both dark and light variants) appear in `dot theme` and `dot theme list`.
 

package/docs/reference/TOOLS.md

@@ -98,6 +98,7 @@ Detailed guide: [AI.md](../AI.md).
 | **Aider** | Git-native AI pair programming |
 | **Claude CLI** | Anthropic's terminal assistant |
 | **Copilot CLI** | GitHub Copilot in the terminal |
+| **Kimi CLI** | Moonshot AI Kimi Code terminal coding agent |
 | **Kiro CLI** | Agentic AI terminal assistant |
 | **Antigravity CLI** | Google's Antigravity CLI (`agy`) |
 | **Mods/Fabric** | Pipeline-friendly AI processing |

package/docs/reference/UTILS.md

@@ -124,6 +124,7 @@ prints a one-line hint. See [AI.md](../AI.md) for the full surface.
 |---------|-------------|
 | `dot cl` | Claude Code with context injection — use `dot ai claude` |
 | `dot copilot` | GitHub Copilot CLI — use `dot ai copilot` |
+| `dot kimi` | Kimi CLI — use `dot ai kimi` |
 | `dot agy` | Antigravity CLI — use `dot ai agy` |
 | `dot kiro` | Kiro CLI — use `dot ai kiro` |
 | `dot sgpt` | Shell-GPT — use `dot ai sgpt` |

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.511)
+  version       The version (tag or branch) to install (default: v0.2.512)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.511"
+  local version="v0.2.512"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.511)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.512)."
         fi
         version="$arg"
         version_set=1
@@ -362,7 +362,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.511 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.512 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -371,7 +371,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.511 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.512 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.511",
+  "version": "0.2.512",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/diagnostics/aliases-manifest.sh

@@ -6,6 +6,15 @@
 
 set -euo pipefail
 
+usage() {
+  cat <<'EOF'
+Usage: aliases-manifest.sh [chezmoi-source-dir]
+
+Emit alias definitions as tab-separated rows:
+  name<TAB>value<TAB>file<TAB>line
+EOF
+}
+
 resolve_source_dir() {
   if [[ -n "${CHEZMOI_SOURCE_DIR:-}" && -d "${CHEZMOI_SOURCE_DIR}" ]]; then
     printf "%s\n" "${CHEZMOI_SOURCE_DIR}"
@@ -39,12 +48,30 @@ resolve_chezmoi_source_dir() {
   printf "%s\n" "$root"
 }
 
+case "${1:-}" in
+  -h | --help)
+    usage
+    exit 0
+    ;;
+  -*)
+    printf 'Unknown option: %s\n' "$1" >&2
+    usage >&2
+    exit 2
+    ;;
+esac
+
 src_root="${1:-$(resolve_source_dir)}"
 src_dir="$(resolve_chezmoi_source_dir "$src_root")"
 
-rg -n \
-  -e '^[[:space:]]*alias[[:space:]]+[A-Za-z0-9_.:-]+=' \
-  -e '^[[:space:]]*[^#"'\'']*&&[[:space:]]*alias[[:space:]]+[A-Za-z0-9_.:-]+=' \
-  "$src_dir/.chezmoitemplates/aliases" \
-  "$src_dir/.chezmoitemplates/functions" |
-  sed -E 's#^([^:]+):([0-9]+):.*alias[[:space:]]+([A-Za-z0-9_.:-]+)=(.*)$#\3\t\4\t\1\t\2#'
+alias_pattern='^[[:space:]]*alias[[:space:]]+[A-Za-z0-9_.:-]+='
+conditional_alias_pattern='^[[:space:]]*[^#"'\'']*&&[[:space:]]*alias[[:space:]]+[A-Za-z0-9_.:-]+='
+search_paths=(
+  "$src_dir/.chezmoitemplates/aliases"
+  "$src_dir/.chezmoitemplates/functions"
+)
+
+if command -v rg >/dev/null 2>&1; then
+  rg -n -e "$alias_pattern" -e "$conditional_alias_pattern" "${search_paths[@]}"
+else
+  grep -rEn -e "$alias_pattern" -e "$conditional_alias_pattern" "${search_paths[@]}"
+fi | sed -E 's#^([^:]+):([0-9]+):.*alias[[:space:]]+([A-Za-z0-9_.:-]+)=(.*)$#\3\t\4\t\1\t\2#'

package/scripts/diagnostics/benchmark.sh

@@ -56,6 +56,19 @@ export DOT_COMMAND="benchmark"
 BENCHMARK_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles/benchmarks"
 mkdir -p "$BENCHMARK_DIR"
 
+usage() {
+  cat <<'EOF'
+Usage: dot benchmark [--detailed] [--profile] [--compare] [--waterfall]
+
+Options:
+  -d, --detailed    Show per-component timing before the benchmark
+  -p, --profile     Run zsh zprof analysis
+  -c, --compare     Compare recent benchmark history
+  -w, --waterfall   Show an ASCII component waterfall
+  -h, --help        Show this help
+EOF
+}
+
 # Parse arguments
 DETAILED=false
 PROFILE=false
@@ -79,11 +92,24 @@ while [[ $# -gt 0 ]]; do
       WATERFALL=true
       shift
       ;;
-    *) shift ;;
+    --help | -h)
+      usage
+      exit 0
+      ;;
+    *)
+      printf 'Unknown option: %s\n' "$1" >&2
+      usage >&2
+      exit 2
+      ;;
   esac
 done
 
 ui_init
+GREEN="${GREEN:-}"
+YELLOW="${YELLOW:-}"
+RED="${RED:-}"
+CYAN="${CYAN:-}"
+NC="${NC:-}"
 
 print_header() {
   echo ""

package/scripts/diagnostics/doctor.sh

@@ -169,7 +169,7 @@ fi
 
 # --- AI CLIs ---
 _section "AI CLIs"
-for cmd in claude copilot agy sgpt ollama opencode aider kiro-cli; do
+for cmd in claude copilot kimi agy sgpt ollama opencode aider kiro-cli; do
   if check_cmd "$cmd"; then
     _ok "$cmd" "$(pretty_path "$(get_cmd_path "$cmd")")"
   else
@@ -226,6 +226,9 @@ fi
 
 # --- OS-specific detection ---
 _os="" _host="" _cpu="" _cpu_cores="" _gpu="" _mem="" _resolution="" _packages="" _de=""
+os_release_file="${DOT_DOCTOR_OS_RELEASE:-/etc/os-release}"
+proc_root="${DOT_DOCTOR_PROC_ROOT:-/proc}"
+sys_root="${DOT_DOCTOR_SYS_ROOT:-/sys}"
 
 if [[ "$_os_name" == "Darwin" ]]; then
   # macOS
@@ -243,33 +246,37 @@ if [[ "$_os_name" == "Darwin" ]]; then
   _packages="$(brew list --formula 2>/dev/null | wc -l | tr -d ' ') (brew)"
   _de="Aqua"
 
-elif [[ -r /etc/os-release ]]; then
+elif [[ -r "$os_release_file" ]]; then
   # Linux (Debian, Ubuntu, Arch, Fedora, RHEL, etc.)
   # shellcheck disable=SC1091
-  . /etc/os-release
+  . "$os_release_file"
   _os="${PRETTY_NAME:-$ID}"
 
-  _host="$(cat /sys/devices/virtual/dmi/id/product_name 2>/dev/null || cat /sys/firmware/devicetree/base/model 2>/dev/null || echo "Linux")"
+  _host="$(cat "$sys_root/devices/virtual/dmi/id/product_name" 2>/dev/null || cat "$sys_root/firmware/devicetree/base/model" 2>/dev/null || echo "Linux")"
 
   if command -v lscpu >/dev/null 2>&1; then
     _cpu="$(lscpu | awk -F': +' '/Model name/{print $2}')"
     _cpu_cores="$(lscpu | awk -F': +' '/^CPU\(s\):/{print $2}')"
   else
-    _cpu="$(grep -m1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 | sed 's/^ //' || uname -p)"
-    _cpu_cores="$(grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo "?")"
+    _cpu="$(grep -m1 'model name' "$proc_root/cpuinfo" 2>/dev/null | cut -d: -f2 | sed 's/^ //' || uname -p)"
+    _cpu_cores="$(grep -c '^processor' "$proc_root/cpuinfo" 2>/dev/null || echo "?")"
   fi
 
   if command -v lspci >/dev/null 2>&1; then
-    _gpu="$(lspci 2>/dev/null | grep -iE 'vga|3d|display' | head -1 | sed 's/.*: //')"
+    # Headless hosts (VMs, containers, CI runners) expose no display
+    # controller, so `grep` exits 1 and — under `set -euo pipefail` —
+    # would abort the whole report mid-section. Absorb the miss.
+    _gpu="$(lspci 2>/dev/null | grep -iE 'vga|3d|display' | head -1 | sed 's/.*: //' || true)"
+    _gpu="${_gpu:-n/a}"
   else
     _gpu="n/a"
   fi
 
   if command -v free >/dev/null 2>&1; then
     _mem="$(free -b | awk '/Mem:/{printf "%.2f GiB / %.2f GiB", $3/1073741824, $2/1073741824}')"
-  elif [[ -r /proc/meminfo ]]; then
-    _mem_total_kb="$(awk '/MemTotal/{print $2}' /proc/meminfo)"
-    _mem_avail_kb="$(awk '/MemAvailable/{print $2}' /proc/meminfo)"
+  elif [[ -r "$proc_root/meminfo" ]]; then
+    _mem_total_kb="$(awk '/MemTotal/{print $2}' "$proc_root/meminfo")"
+    _mem_avail_kb="$(awk '/MemAvailable/{print $2}' "$proc_root/meminfo")"
     _mem_used_kb=$((_mem_total_kb - _mem_avail_kb))
     _mem="$(awk "BEGIN{printf \"%.2f GiB / %.2f GiB\", ${_mem_used_kb}/1048576, ${_mem_total_kb}/1048576}")"
   else
@@ -319,7 +326,7 @@ fi
 
 # WSL detection and overrides
 _wsl=""
-if [[ -f /proc/version ]] && grep -qi microsoft /proc/version 2>/dev/null; then
+if [[ -f "$proc_root/version" ]] && grep -qi microsoft "$proc_root/version" 2>/dev/null; then
   _wsl="yes"
   _os="${_os} (WSL)"
   _de="Windows Desktop (WSL)"

package/scripts/diagnostics/health.sh

@@ -198,6 +198,11 @@ check_dotfiles_core() {
 check_shell_env() {
   check_section "Shell Environment"
   local current_shell="${SHELL##*/}"
+  local default_shell="fish"
+  if [[ -f "$SCRIPT_DIR/../../defaults/.chezmoidata.toml" ]]; then
+    default_shell="$(awk -F= '/^[[:space:]]*default_shell[[:space:]]*=/{split($2, value, "#"); gsub(/[ "]/, "", value[1]); print value[1]; exit}' "$SCRIPT_DIR/../../defaults/.chezmoidata.toml")"
+    default_shell="${default_shell:-fish}"
+  fi
 
   if has_command zsh; then
     check "Zsh installed" "pass"
@@ -210,12 +215,12 @@ check_shell_env() {
     check "Zsh installed" "fail"
   fi
 
-  if [[ -d "${ZINIT_HOME:-$HOME/.local/share/zinit}" ]]; then
+  if [[ -f "${ZINIT_HOME:-$HOME/.local/share/zinit/zinit.git}/zinit.zsh" ]] || [[ -d "${ZINIT_HOME:-$HOME/.local/share/zinit}" ]]; then
     check "Zinit plugin manager" "pass"
-  elif [[ "$current_shell" == "zsh" ]]; then
+  elif [[ "$current_shell" == "zsh" && "$default_shell" == "zsh" ]]; then
     check "Zinit plugin manager" "warn" "Not found"
   else
-    check "Zinit plugin manager" "pass" "Not required for $current_shell"
+    check "Zinit plugin manager" "pass" "Not required for $default_shell"
   fi
 
   if has_command starship; then

package/scripts/diagnostics/mcp-doctor.sh

@@ -77,12 +77,14 @@ log_success() {
   if [[ "$JSON_MODE" -ne 1 ]]; then
     ui_ok "$1" "${2:-}"
   fi
+  return 0
 }
 log_fail() {
   if [[ "$JSON_MODE" -ne 1 ]]; then
     ui_err "$1" "${2:-}"
   fi
   Errors=$((Errors + 1))
+  return 0
 }
 log_warn() {
   if [[ "$JSON_MODE" -ne 1 ]]; then
@@ -91,6 +93,7 @@ log_warn() {
   Warnings=$((Warnings + 1))
   # In strict mode, warnings become errors
   [[ "$STRICT_MODE" -eq 1 ]] && Errors=$((Errors + 1))
+  return 0
 }
 
 MCP_CONFIG="${MCP_CONFIG:-$HOME/.config/claude/mcp_servers.json}"

package/scripts/diagnostics/secret-governance.sh

@@ -13,7 +13,13 @@ STRICT="${DOTFILES_ALIAS_STRICT_MODE:-${DOTFILES_SECRETS_STRICT_MODE:-0}}"
 
 cd "$REPO_ROOT"
 
-mapfile -t staged_files < <(git diff --cached --name-only --diff-filter=ACM || true)
+# Portable read — `mapfile` is bash 4 only, and this runs from the
+# pre-commit hook on macOS where /bin/bash is 3.2. Without this the
+# hook exits 127 and the secret scan is skipped entirely.
+staged_files=()
+while IFS= read -r _line; do
+  [[ -n "$_line" ]] && staged_files+=("$_line")
+done < <(git diff --cached --name-only --diff-filter=ACM || true)
 if [[ "${#staged_files[@]}" -eq 0 ]]; then
   echo "Secret governance: no staged files."
   exit 0

package/scripts/diagnostics/security-score.sh

@@ -171,13 +171,20 @@ check_encryption() {
     add_points "encryption" 0 5 "SOPS secrets manager"
   fi
 
-  # GPG available
+  # Signing key material: this repo uses SSH ED25519 signing by default, with
+  # GPG still accepted for users who prefer it.
+  local signing_format signing_key
+  signing_format="$(git config --global gpg.format 2>/dev/null || true)"
+  signing_key="$(git config --global user.signingkey 2>/dev/null || true)"
+  signing_key="${signing_key/#\~/$HOME}"
   if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys 2>/dev/null | grep -q sec; then
-    add_points "encryption" 10 10 "GPG keys configured"
+    add_points "encryption" 10 10 "Signing key configured (GPG)"
+  elif [[ "$signing_format" == "ssh" && -n "$signing_key" && -f "$signing_key" ]]; then
+    add_points "encryption" 10 10 "Signing key configured (SSH)"
   elif command -v gpg >/dev/null 2>&1; then
-    add_points "encryption" 3 10 "GPG keys configured"
+    add_points "encryption" 3 10 "Signing key configured"
   else
-    add_points "encryption" 0 10 "GPG keys configured"
+    add_points "encryption" 0 10 "Signing key configured"
   fi
 }
 
@@ -286,6 +293,8 @@ check_system() {
   if [[ "$(uname)" == "Darwin" ]]; then
     if fdesetup status 2>/dev/null | grep -q "FileVault is On"; then
       add_points "system" 10 10 "Disk encryption (FileVault)"
+    elif diskutil apfs list 2>/dev/null | grep -q "FileVault:[[:space:]]*Yes"; then
+      add_points "system" 10 10 "Disk encryption (APFS FileVault)"
     else
       add_points "system" 0 10 "Disk encryption (FileVault)"
     fi
@@ -323,7 +332,7 @@ check_secrets() {
     local secrets_found=false
     local match=""
     # Check for common secret patterns, ignore templates/placeholders and variable expansions.
-    match=$(grep -rE "(api_key|api_secret|password|token)[[:space:]]*=[[:space:]]*['\"][^'\"]+['\"]" \
+    match=$(grep -rE "^[[:space:]]*(export[[:space:]]+)?[A-Za-z_]*(api_key|api_secret|password|token)[A-Za-z_]*[[:space:]]*=[[:space:]]*['\"][^'\"]+['\"]" \
       "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null |
       grep -v "example\\|template\\|placeholder" | grep -F -v "\${" | head -1 || true)
     if [[ -n "$match" ]]; then

package/scripts/diagnostics/verify_state.sh

@@ -12,6 +12,8 @@ set -euo pipefail
 echo " Starting Final Environment Verification..."
 
 Errors=0
+ALIASES_CONFIG="$HOME/.config/shell/aliases.sh"
+AliasesConfigReported=0
 
 check_file() {
   if [[ ! -f "$1" ]]; then
@@ -23,7 +25,13 @@ check_file() {
 }
 
 check_alias_in_config() {
-  if ! grep -q "$1" "$HOME/.config/shell/aliases.sh"; then
+  if [[ ! -f "$ALIASES_CONFIG" ]]; then
+    if [[ "$AliasesConfigReported" -eq 0 ]]; then
+      echo " Missing aliases config: $ALIASES_CONFIG"
+      Errors=$((Errors + 1))
+      AliasesConfigReported=1
+    fi
+  elif ! grep -q "$1" "$ALIASES_CONFIG"; then
     echo " Missing alias definition '$1' in built config"
     Errors=$((Errors + 1))
   else