@sebastienrousseau/dotfiles 0.2.511 → 0.2.512

package/scripts/dot/commands/ai.sh

@@ -5,7 +5,7 @@
 ##
 ## Provides AI CLI status, setup, RAG query, and bridge commands.
 ## Wraps AI CLI tools with contextual patterns and system metadata.
-## Usage: dot ai [delegate|cost|dashboard|proxy|local|status]|ai-setup|ai-query|cl|copilot|agy|kiro|sgpt|ollama|opencode|aider|autohand|vibe|qwen|zai
+## Usage: dot ai [delegate|cost|dashboard|proxy|local|status]|ai-setup|ai-query|cl|copilot|kimi|agy|kiro|sgpt|ollama|opencode|aider|autohand|vibe|qwen|zai
 
 set -euo pipefail
 
@@ -36,7 +36,7 @@ _show_ai_bridge_usage() {
   echo "       dot ai <tool> --style <name> \"<prompt>\""
   echo "       dot ai chat [tool]             # interactive session"
   echo ""
-  echo "Tools: cl codex copilot goose crush amp cursor-agent grok agy kiro sgpt ollama opencode aider autohand vibe qwen zai"
+  echo "Tools: cl codex copilot goose crush amp cursor-agent grok kimi agy kiro sgpt ollama opencode aider autohand vibe qwen zai"
   echo ""
   echo "Available styles:"
   # shellcheck disable=SC2012
@@ -69,21 +69,13 @@ _ai_refresh_status_cache() {
 
   local total=${#ai_entries[@]}
 
-  # Cold-cache refresh runs `$bin --version` for every tool — node-
-  # based ones are slow to start, so the total can hit 15-30s. Show a
-  # spinner so the user has feedback.
+  # Cold-cache refresh can take 15-30s across node-based tools; show progress.
   ui_spinner_start "Probing $total AI tools (cached for ${AI_STATUS_TTL}s)"
 
   local jobs="${DOTFILES_AI_PROBE_JOBS:-$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)}"
   local probe_dir
   probe_dir="$(mktemp -d)"
 
-  # Probe via xargs -P. The probe logic lives INLINE in the bash -c
-  # string rather than as an exported function, because `export -f`
-  # doesn't always survive across bash invocations on every platform
-  # (notably macOS bash 3.2 needs the BASH_FUNC_*() env-var format,
-  # which subtly breaks for some shells in PATH). Inlining sidesteps
-  # the inheritance question entirely.
   local i=0
   local entry
   local indexed=()
@@ -110,14 +102,7 @@ _ai_refresh_status_cache() {
       printf "%s\t0\t\n" "$bin" >"$out_dir/$i"
     fi
   '
-  # NOTE: `-I{}` already implies one input line per invocation. Adding
-  # `-n1` on top triggers a BSD-xargs quirk where the input line is
-  # word-split on whitespace ("0|Agents (autonomous)|..." → multiple
-  # entries). Use only `-I{}`.
-  #
-  # ALSO: feed null-delimited records (`-0`) so apostrophes and
-  # other quote-like characters in the descriptions ("Block's coding
-  # agent") don't trigger xargs's "unterminated quote" parser.
+  # Use only `-I{}` and null records for BSD xargs and quote-safe descriptions.
   printf '%s\0' "${indexed[@]}" |
     xargs -0 -I{} -P"$jobs" \
       bash -c "$probe_script" _ {} "$probe_dir" "$_TO" \
@@ -130,12 +115,7 @@ _ai_refresh_status_cache() {
   done
   rm -rf "$probe_dir"
 
-  # Guard with `|| true` because ui_spinner_stop's last line evaluates
-  # to rc=1 when stdout is a TTY (the `[[ ! -t 1 ]] && printf` short-
-  # circuit). Under `set -euo pipefail` that rc would kill the script
-  # right before we get to write the cache, leaving the user with a
-  # silent broken cold-cache run. Defence in depth — the function
-  # now also has an explicit `return 0` upstream.
+  # Guard against older ui_spinner_stop implementations returning 1 on a TTY.
   ui_spinner_stop || true
 
   mv "$tmp_file" "$AI_STATUS_CACHE_FILE"
@@ -145,10 +125,6 @@ _ai_get_cached_status() {
   cat "$AI_STATUS_CACHE_FILE"
 }
 
-# Look up field $2 (2=present 0/1, 3=version) for binary $1 from the
-# cached TSV. Replaces a bash-4 associative array for macOS bash 3.2.
-# (Removed _ai_status_field — cmd_ai_status now reads both fields in one awk.)
-
 # _ai_mise_pkg (binary -> mise package map) is defined in lib/dot/ai-install.sh.
 
 cmd_ai_status() {
@@ -164,6 +140,7 @@ cmd_ai_status() {
     "Agents (autonomous)|agent|Amp|amp|Sourcegraph's agentic coder"
     "Agents (autonomous)|agent|Cursor CLI|cursor-agent|Cursor's terminal agent"
     "Agents (autonomous)|agent|Grok Build|grok|xAI's terminal coding agent"
+    "Agents (autonomous)|agent|Kimi CLI|kimi|Moonshot AI's terminal coding agent"
     "Coding (interactive)|coding|Aider|aider|Git-aware AI pair programmer"
     "Coding (interactive)|coding|OpenCode|opencode|Open-source terminal coding agent"
     "Coding (interactive)|coding|Autohand Code|autohand|Autonomous multi-file coding agent"
@@ -278,6 +255,10 @@ cmd_ai_status() {
             install_grok_native "$name"
             continue
             ;;
+          kimi)
+            install_kimi_native "$name"
+            continue
+            ;;
         esac
         local pkg
         pkg=$(_ai_mise_pkg "$bin")
@@ -439,6 +420,11 @@ ${prompt}"
       ui_warn "$tool" "not installed"
       ui_info "Install" "curl -fsSL -o /tmp/agy-install.sh https://antigravity.google/cli/install.sh && bash /tmp/agy-install.sh"
       exit 1
+    elif [[ "$tool_bin" == "kimi" ]]; then
+      ui_warn "$tool" "not installed"
+      ui_info "Install" "dot ai install kimi"
+      ui_info "PATH" "Kimi Code installs to ~/.kimi-code/bin; restart your shell after install"
+      exit 1
     else
       ui_err "$tool" "not installed and mise not available"
       exit 1
@@ -478,6 +464,27 @@ ${prompt}"
 
 # Dispatch — flat, verb-first surface (see docs/AI.md).
 case "${1:-}" in
+  --help | -h | help)
+    cat <<'EOF'
+Usage: ai.sh <command> [args...]
+
+Commands:
+  ai, ai-setup, ai-query, cl, claude, codex, copilot, goose, crush, amp,
+  cursor-agent, grok, kimi, agy, kiro, sgpt, ollama, opencode, aider, autohand,
+  vibe, qwen, zai
+EOF
+    ;;
+  "")
+    cat <<'EOF'
+Usage: ai.sh <command> [args...]
+
+Commands:
+  ai, ai-setup, ai-query, cl, claude, codex, copilot, goose, crush, amp,
+  cursor-agent, grok, kimi, agy, kiro, sgpt, ollama, opencode, aider, autohand,
+  vibe, qwen, zai
+EOF
+    exit 1
+    ;;
   ai)
     shift
     case "${1:-}" in
@@ -565,7 +572,7 @@ case "${1:-}" in
     shift
     cmd_ai_query "$@"
     ;;
-  cl | claude | codex | copilot | goose | crush | amp | cursor-agent | grok | agy | kiro | sgpt | ollama | opencode | aider | autohand | vibe | qwen | zai)
+  cl | claude | codex | copilot | goose | crush | amp | cursor-agent | grok | kimi | agy | kiro | sgpt | ollama | opencode | aider | autohand | vibe | qwen | zai)
     _ai_deprecated "dot ai $1"
     tool="$1"
     shift

package/scripts/dot/commands/aliases.sh

@@ -133,12 +133,36 @@ cmd_aliases() {
       rm -f "$tmp_aliases"
       ;;
     cheatsheet)
+      # Destination defaults to the checkout's docs/ but can be
+      # redirected with `--output PATH` (or `-` for stdout). The
+      # hardcoded path made this the one subcommand that could not be
+      # exercised without writing into the working tree:
+      # require_source_dir() resolves from the location of the lib that
+      # was sourced, so it always pointed at the real repo no matter
+      # how the sandbox redirected $HOME/.dotfiles.
       ui_header "Alias Cheatsheet"
-      local src_dir out
+      local src_dir out=""
       src_dir="$(require_source_dir)"
-      out="$src_dir/docs/ALIASES_CHEATSHEET.md"
-      bash "$src_dir/scripts/diagnostics/aliases-cheatsheet.sh" >"$out"
-      ui_ok "Generated" "$out"
+      while (($#)); do
+        case "$1" in
+          --output | -o)
+            out="${2:-}"
+            [[ -n "$out" ]] || die "Usage: dot aliases cheatsheet [--output PATH|-]"
+            shift 2
+            ;;
+          *)
+            die "Unknown option for cheatsheet: $1"
+            ;;
+        esac
+      done
+      out="${out:-$src_dir/docs/ALIASES_CHEATSHEET.md}"
+      if [[ "$out" == "-" ]]; then
+        bash "$src_dir/scripts/diagnostics/aliases-cheatsheet.sh"
+      else
+        mkdir -p "$(dirname "$out")"
+        bash "$src_dir/scripts/diagnostics/aliases-cheatsheet.sh" >"$out"
+        ui_ok "Generated" "$out"
+      fi
       ;;
     tiers)
       local profile ecosystems security_mode dangerous buckets

package/scripts/dot/commands/appearance.sh

@@ -12,6 +12,15 @@ source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Appearance" "${1:-}"
 
+usage() {
+  cat <<'EOF'
+Usage: appearance.sh <command> [args...]
+
+Commands:
+  theme, wallpaper, fonts, tune
+EOF
+}
+
 cmd_theme() {
   run_script "scripts/theme/switch.sh" "Theme switcher" "$@"
 }
@@ -71,6 +80,13 @@ cmd_tune() {
 
 # Dispatch
 case "${1:-}" in
+  --help | -h | help)
+    usage
+    ;;
+  "")
+    usage
+    exit 1
+    ;;
   theme)
     shift
     cmd_theme "$@"

package/scripts/dot/commands/core.sh

@@ -34,6 +34,16 @@ if [[ "${1:-}" != "cd" ]]; then
   dot_ui_command_banner "Core" "${1:-}"
 fi
 
+usage() {
+  cat <<'EOF'
+Usage: core.sh <command> [args...]
+
+Commands:
+  apply, sync, update, add, diff, status, remove, cd, edit, commit,
+  clean-cache, uninstall
+EOF
+}
+
 cmd_apply() {
   local src_dir
   src_dir="$(resolve_source_dir)"
@@ -145,6 +155,13 @@ cmd_clean_cache() {
 
 # Dispatch
 case "${1:-}" in
+  --help | -h | help)
+    usage
+    ;;
+  "")
+    usage
+    exit 1
+    ;;
   apply)
     shift
     cmd_apply "$@"

package/scripts/dot/commands/diagnostics.sh

@@ -13,6 +13,18 @@ source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Diagnostics" "${1:-}" "$@"
 
+usage() {
+  cat <<'EOF'
+Usage: diagnostics.sh <command> [args...]
+
+Commands:
+  doctor, heal, health, security-score, scorecard, perf, conflicts, locks,
+  snapshot, attest, rollback, drift, history, benchmark, verify, restore,
+  load-bench, load-bench-pty, chaos, teleport, secret-audit, bundle, metrics,
+  smoke-test, intelligence
+EOF
+}
+
 cmd_doctor() {
   local src_dir
   src_dir="$(resolve_source_dir)"
@@ -139,6 +151,13 @@ cmd_metrics() {
 
 # Dispatch
 case "${1:-}" in
+  --help | -h | help)
+    usage
+    ;;
+  "")
+    usage
+    exit 1
+    ;;
   doctor)
     shift
     cmd_doctor "$@"

package/scripts/dot/commands/manual.sh

@@ -67,7 +67,7 @@ resolve_source() {
       echo "$src_dir/$fname"
       return 0
     fi
-    ui_err "manual" "local build not found at $src_dir/$fname — run bash tools/docs/build-manual.sh"
+    ui_err "manual" "local build not found at $src_dir/$fname — run bash tools/docs/build-manual.sh" >&2
     return 1
   fi
 
@@ -76,7 +76,7 @@ resolve_source() {
       echo "$OFFLINE_DIR/$fname"
       return 0
     fi
-    ui_err "manual" "offline copy not found at $OFFLINE_DIR/$fname"
+    ui_err "manual" "offline copy not found at $OFFLINE_DIR/$fname" >&2
     return 1
   fi
 
@@ -84,9 +84,9 @@ resolve_source() {
   if [[ ! -f "$cache_path" ]] || [[ $(find "$cache_path" -mtime +7 -print 2>/dev/null | wc -l) -gt 0 ]]; then
     mkdir -p "$(dirname "$cache_path")"
     local url="$MANUAL_URL/$fname"
-    ui_info "manual" "fetching $url"
+    ui_info "manual" "fetching $url" >&2
     if ! curl -fsSL "$url" -o "$cache_path"; then
-      ui_err "manual" "failed to download $url"
+      ui_err "manual" "failed to download $url" >&2
       return 1
     fi
   fi

package/scripts/dot/commands/meta.sh

@@ -30,30 +30,88 @@ meta_banner_section() {
 
 dot_ui_command_banner "$(meta_banner_section "${1:-}")" "${1:-}" "$@"
 
+# Last meaningful line of a captured log, used as a step's `ok` detail.
+# Collapses carriage-return progress (git/nvim spam \r), strips ANSI,
+# takes the last non-empty line, and clips it so the rendered step stays
+# on one line.
+_upgrade_last_line() {
+  tr '\r' '\n' <"$1" 2>/dev/null |
+    sed -E 's/\x1b\[[0-9;?]*[a-zA-Z]//g' |
+    awk 'NF{last=$0} END{print last}' |
+    cut -c1-56
+}
+
 cmd_upgrade() {
   local src_dir
   src_dir="$(require_source_dir)"
 
+  # Per-step logs. Each phase's stdout+stderr is captured here rather
+  # than streamed to the terminal: the git/nvim/chezmoi output is noisy
+  # (carriage-return progress bars, remote counters) and, in rich mode,
+  # writing it to the terminal corrupts the dot-ui renderer that owns
+  # the screen. Failing steps get their tail dumped after the run.
+  local log_dir
+  log_dir="$(mktemp -d "${TMPDIR:-/tmp}/dot-upgrade.XXXXXX")"
+  local fail_labels=() fail_logs=()
+
+  # _upgrade_step <id> <label> <running-detail> -- cmd [args...]
+  # Renders one tracked step: spinner while it runs, then ok (with the
+  # log's last line) or fail. Never aborts the run — a failed phase is
+  # recorded and surfaced at the end, matching the previous `|| true`
+  # behaviour but without the raw flood.
+  _upgrade_step() {
+    local id="$1" label="$2" running="$3"
+    shift 3
+    [[ "${1:-}" == "--" ]] && shift
+    local log="$log_dir/$id.log" rc=0
+    ui_step "$id" "$label" run "$running"
+    "$@" >"$log" 2>&1 || rc=$?
+    if [[ "$rc" -eq 0 ]]; then
+      ui_step "$id" "" ok "$(_upgrade_last_line "$log")"
+    else
+      ui_step "$id" "" fail "exited $rc"
+      fail_labels+=("$label")
+      fail_logs+=("$log")
+    fi
+    return 0
+  }
+
+  ui_steps_begin "Upgrade" ""
+
   if [ -f "$src_dir/nix/flake.nix" ] && has_command nix; then
-    ui_info "Updating Nix flake"
-    (cd "$src_dir" && nix flake update) || true
-    ui_info "Running Nix garbage collection"
-    nix-collect-garbage -d || true
+    _upgrade_step nix-flake "Nix flake" "updating…" -- \
+      sh -c 'cd "$1" && nix flake update' _ "$src_dir"
+    _upgrade_step nix-gc "Nix GC" "collecting…" -- nix-collect-garbage -d
   fi
 
-  ui_info "Updating dotfiles"
-  chezmoi update || true
+  _upgrade_step dotfiles "Dotfiles" "chezmoi update…" -- chezmoi update
 
   if has_command nvim; then
-    ui_info "Updating Neovim plugins"
-    nvim --headless "+Lazy! sync" +qa || true
+    _upgrade_step nvim "Neovim plugins" "Lazy sync…" -- \
+      nvim --headless "+Lazy! sync" +qa
   fi
 
-  if [ "${DOTFILES_FONTS:-}" = "1" ]; then
-    if [ -f "$src_dir/scripts/fonts/install-nerd-fonts.sh" ]; then
-      ui_info "Installing Nerd Fonts"
+  if [ "${DOTFILES_FONTS:-}" = "1" ] &&
+    [ -f "$src_dir/scripts/fonts/install-nerd-fonts.sh" ]; then
+    _upgrade_step fonts "Nerd Fonts" "installing…" -- \
       sh "$src_dir/scripts/fonts/install-nerd-fonts.sh"
-    fi
+  fi
+
+  local n=${#fail_labels[@]}
+  if [[ "$n" -eq 0 ]]; then
+    ui_steps_end "toolchains, plugins, and dotfiles up to date"
+    rm -rf "$log_dir"
+  else
+    ui_steps_end "$n step(s) failed"
+    # Surfaced after ui_steps_end so the rich renderer has torn down —
+    # printing mid-render would garble the display.
+    local i=0
+    while ((i < n)); do
+      ui_err "${fail_labels[$i]}" "log tail:"
+      tail -n 15 "${fail_logs[$i]}" | sed 's/^/    /'
+      ((i++)) || true
+    done
+    ui_info "Logs" "$log_dir"
   fi
 }
 
@@ -251,6 +309,23 @@ case "${1:-}" in
     shift
     cmd_mode "$@"
     ;;
+  --help | -h | help)
+    cat <<'EOF'
+Usage: meta.sh <command> [args...]
+
+Commands:
+  cache-refresh, prewarm, docs, learn, keys, sandbox, mcp, mode, agent
+EOF
+    ;;
+  "")
+    cat <<'EOF'
+Usage: meta.sh <command> [args...]
+
+Commands:
+  cache-refresh, prewarm, docs, learn, keys, sandbox, mcp, mode, agent
+EOF
+    exit 1
+    ;;
   *)
     echo "Unknown meta command: ${1:-}" >&2
     exit 1

package/scripts/dot/commands/registry.sh

@@ -89,7 +89,7 @@ _registry_fetch() {
   local now mtime
   now="$(date +%s)"
   if [[ -s "$cache_file" ]]; then
-    if mtime="$(stat -f %m "$cache_file" 2>/dev/null || stat -c %Y "$cache_file" 2>/dev/null)"; then
+    if mtime="$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null)"; then
       if ((now - mtime < 21600)); then
         printf '%s\n' "$cache_file"
         return 0

package/scripts/dot/commands/secrets.sh

@@ -231,6 +231,23 @@ cmd_secrets_load() {
 # Dispatch
 top="${1:-}"
 case "$top" in
+  --help | -h | help)
+    cat <<'EOF'
+Usage: secrets.sh <command> [args...]
+
+Commands:
+  secrets-init, secrets, secrets-create, ssh-key, ssh-cert, env
+EOF
+    ;;
+  "")
+    cat <<'EOF'
+Usage: secrets.sh <command> [args...]
+
+Commands:
+  secrets-init, secrets, secrets-create, ssh-key, ssh-cert, env
+EOF
+    exit 1
+    ;;
   secrets-init)
     shift
     cmd_secrets_init "$@"

package/scripts/dot/commands/security.sh

@@ -12,6 +12,16 @@ source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
 
 dot_ui_command_banner "Security" "${1:-}"
 
+usage() {
+  cat <<'EOF'
+Usage: security.sh <command> [args...]
+
+Commands:
+  backup, encrypt-check, firewall, telemetry, dns-doh, lock-screen,
+  usb-safety, policy
+EOF
+}
+
 cmd_backup() {
   run_script "scripts/security/backup.sh" "Backup script" "$@"
 }
@@ -46,6 +56,13 @@ cmd_policy() {
 
 # Dispatch
 case "${1:-}" in
+  --help | -h | help)
+    usage
+    ;;
+  "")
+    usage
+    exit 1
+    ;;
   backup)
     shift
     cmd_backup "$@"

package/scripts/dot/commands/tools.sh

@@ -490,6 +490,25 @@ cmd_profile() {
 
 # Dispatch — aliases and alias-check are defined in aliases.sh (sourced above)
 case "${1:-}" in
+  --help | -h | help)
+    cat <<'EOF'
+Usage: tools.sh <command> [args...]
+
+Commands:
+  tools, alias-check, new, packages, log-rotate, setup, aliases, env,
+  profile, lint
+EOF
+    ;;
+  "")
+    cat <<'EOF'
+Usage: tools.sh <command> [args...]
+
+Commands:
+  tools, alias-check, new, packages, log-rotate, setup, aliases, env,
+  profile, lint
+EOF
+    exit 1
+    ;;
   tools)
     shift
     cmd_tools "$@"

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.511 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.512 standards maintained."
   exit 0
 fi

package/scripts/ops/ai-setup.sh

@@ -20,6 +20,10 @@ setup_tool() {
 
   ui_section "Setting up $name"
   if command -v "$cmd" >/dev/null 2>&1; then
+    if [[ ! -t 0 && "${auth_argv[*]}" != *"--version"* ]]; then
+      ui_info "$name" "non-interactive shell; skipping login. Run '${auth_argv[*]}' in a terminal."
+      return 0
+    fi
     ui_info "Tool found, initiating authentication..."
     "${auth_argv[@]}" || ui_warn "$name" "Setup/Auth skipped or failed."
   else
@@ -43,21 +47,24 @@ setup_tool "Copilot CLI" "copilot" copilot --version
 setup_tool "Goose" "goose" goose --version
 
 # 6. Kiro
-setup_tool "Kiro CLI" "kiro-cli" kiro-cli auth login
+setup_tool "Kiro CLI" "kiro-cli" kiro-cli login
 
-# 7. Aider
+# 7. Kimi
+setup_tool "Kimi CLI" "kimi" kimi --version
+
+# 8. Aider
 setup_tool "Aider" "aider" aider --version
 
-# 7. Autohand Code
+# 9. Autohand Code
 setup_tool "Autohand Code" "autohand" autohand --version
 
-# 8. Mistral Vibe
+# 10. Mistral Vibe
 setup_tool "Mistral Vibe" "vibe" vibe --version
 
-# 9. Qwen Code
+# 11. Qwen Code
 setup_tool "Qwen Code" "qwen" qwen --version
 
-# 10. ZAI
+# 12. ZAI
 setup_tool "ZAI" "zai" zai --version
 
 ui_header "AI Setup Complete"

package/scripts/ops/bundle.sh

@@ -15,12 +15,38 @@ source "$SCRIPT_DIR/../lib/dot/ui.sh"
 source "$SCRIPT_DIR/../lib/dot/log.sh"
 export DOT_COMMAND="bundle"
 
+usage() {
+  cat <<'EOF'
+Usage: bundle.sh [output-dir]
+
+Create an offline dotfiles bundle as a .tar.zst archive.
+EOF
+}
+
+case "${1:-}" in
+  --help | -h)
+    usage
+    exit 0
+    ;;
+  -*)
+    printf 'Unknown option: %s\n' "$1" >&2
+    usage >&2
+    exit 2
+    ;;
+esac
+
 # Concurrency guard
-LOCK_FILE="${XDG_RUNTIME_DIR:-/tmp}/dotfiles-bundle.lock"
-exec 9>"$LOCK_FILE"
-if ! flock -n 9; then
-  ui_warn "Already running" "Another bundle instance is active"
-  exit 0
+LOCK_DIR="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}"
+if [[ ! -d "$LOCK_DIR" || ! -w "$LOCK_DIR" ]]; then
+  LOCK_DIR="${TMPDIR:-/tmp}"
+fi
+LOCK_FILE="$LOCK_DIR/dotfiles-bundle.lock"
+if command -v flock >/dev/null 2>&1; then
+  exec 9>"$LOCK_FILE"
+  if ! flock -n 9; then
+    ui_warn "Already running" "Another bundle instance is active"
+    exit 0
+  fi
 fi
 
 OUTPUT_DIR="${1:-$HOME/Downloads}"

package/scripts/ops/chezmoi-apply.sh

@@ -199,6 +199,7 @@ _AI_PROVIDERS=(
   "copilot|npm:@github/copilot|Copilot CLI"
   "goose|native|Goose"
   "agy|native|Antigravity CLI"
+  "kimi|native|Kimi CLI"
   "sgpt|pipx:shell-gpt|Shell-GPT"
   "ollama|aqua:ollama/ollama|Ollama"
   "opencode|npm:opencode-ai|OpenCode"
@@ -276,6 +277,10 @@ if [[ ${#_ai_missing[@]} -gt 0 ]] && [[ "$INTERACTIVE" == "1" ]]; then
           install_agy_native "$_label"
           continue
         fi
+        if [[ "$_bin" == "kimi" ]]; then
+          install_kimi_native "$_label"
+          continue
+        fi
         if command -v gum &>/dev/null; then
           if gum spin --spinner dot --title "Installing $_label ($_pkg)" -- \
             mise use -g "$_pkg@latest" 2>&1; then

package/scripts/ops/release.sh

@@ -19,6 +19,8 @@ source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="release"
 ui_init
+BOLD="${BOLD:-}"
+NC="${NC:-}"
 
 log_info() { ui_info "$@"; }
 log_success() { ui_ok "$@"; }
@@ -129,11 +131,18 @@ main() {
   done
 
   # Concurrency guard
-  LOCK_FILE="${XDG_RUNTIME_DIR:-/tmp}/dotfiles-release.lock"
-  exec 9>"$LOCK_FILE"
-  if ! flock -n 9; then
-    ui_warn "Already running" "Another release is in progress"
-    exit 0
+  local lock_dir
+  lock_dir="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}"
+  if [[ ! -d "$lock_dir" || ! -w "$lock_dir" ]]; then
+    lock_dir="${TMPDIR:-/tmp}"
+  fi
+  LOCK_FILE="$lock_dir/dotfiles-release.lock"
+  if command -v flock >/dev/null 2>&1; then
+    exec 9>"$LOCK_FILE"
+    if ! flock -n 9; then
+      ui_warn "Already running" "Another release is in progress"
+      exit 0
+    fi
   fi
 
   cd "$PROJECT_ROOT"