@sebastienrousseau/dotfiles 0.2.512 → 0.2.513

package/scripts/dot/commands/registry.sh

@@ -5,24 +5,18 @@
 #
 # scripts/dot/commands/registry.sh
 #
-# `dot registry` — initial scaffold for the dot module registry.
+# `dot registry` — verified module registry for reusable chezmoi sources.
 #
 # §3 audit roadmap: ship a registry of reusable dotfile modules
 # ("rust-dev-setup", "k8s-operator-laptop") to seed network effects.
 # Hosted as a GitHub-Pages-indexed JSON file to keep ops cost near
 # zero.
 #
-# Current state: SCAFFOLD ONLY. This file ships the CLI surface and
-# the JSON contract (see _registry_default_url). The registry itself
-# is empty; populating it is its own roadmap item.
-#
 # Subcommands:
 #   list           Show modules in the configured registry
 #   search <q>     Filter modules by keyword (name, description, tags)
 #   info <name>    Print full metadata for a module
-#   install <name> Apply a module to the current workstation (stub —
-#                  prints what would be installed; full implementation
-#                  needs a sandboxed apply pipeline)
+#   install <name> Verify and preview a module; --yes applies it.
 #   url            Show the active registry URL
 #   set-url <u>    Override the registry URL (writes to user config)
 #
@@ -37,7 +31,8 @@
 #         "tags": ["rust", "dev", "language"],
 #         "maintainer": "alice@example.com",
 #         "version": "1.2.0",
-#         "sha256": "abc123..." }
+#         "archive_url": "https://example.com/rust-dev-setup-1.2.0.tar.gz",
+#         "sha256": "<64 lowercase hexadecimal characters>" }
 #     ]
 #   }
 
@@ -48,6 +43,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
 # shellcheck source=../../../lib/dot/utils.sh disable=SC1091
 source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+# shellcheck source=../../../lib/dot/verified-download.sh disable=SC1091
+source "$SCRIPT_DIR/../../../lib/dot/verified-download.sh"
 
 _registry_default_url() {
   printf '%s\n' "https://sebastienrousseau.github.io/dotfiles/registry.json"
@@ -79,9 +76,32 @@ _registry_cache_dir() {
   printf '%s/dotfiles/registry\n' "${XDG_CACHE_HOME:-$HOME/.cache}"
 }
 
+_registry_data_dir() {
+  printf '%s/dotfiles/modules\n' "${XDG_DATA_HOME:-$HOME/.local/share}"
+}
+
+_registry_validate_index() {
+  local index="$1"
+  jq -e '
+    .version == 1 and
+    (.modules | type == "array") and
+    all(.modules[];
+      (.name | test("^[a-z0-9][a-z0-9-]{0,31}$")) and
+      (.version | test("^[0-9]+\\.[0-9]+\\.[0-9]+([+-][0-9A-Za-z.-]+)?$")) and
+      (.description | type == "string" and length <= 200) and
+      (.archive_url | test("^(https|file)://")) and
+      (.sha256 | test("^[0-9a-f]{64}$"))
+    )
+  ' "$index" >/dev/null 2>&1
+}
+
 _registry_fetch() {
   local url cache_dir cache_file
   url="$(_registry_url)"
+  [[ "$url" =~ ^(https://|file://) ]] || {
+    ui_err "registry" "registry URL must use https:// (or file:// for local testing)"
+    return 1
+  }
   cache_dir="$(_registry_cache_dir)"
   cache_file="$cache_dir/index.json"
   mkdir -p "$cache_dir"
@@ -89,7 +109,9 @@ _registry_fetch() {
   local now mtime
   now="$(date +%s)"
   if [[ -s "$cache_file" ]]; then
-    if mtime="$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null)"; then
+    if ! _registry_validate_index "$cache_file"; then
+      rm -f "$cache_file"
+    elif mtime="$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null)"; then
       if ((now - mtime < 21600)); then
         printf '%s\n' "$cache_file"
         return 0
@@ -108,7 +130,11 @@ _registry_fetch() {
   # into `jq FILE` as a two-argument invocation
   # (`jq \n /path/to/file`), producing a confusing
   # "Could not open file" error. Silence stdout explicitly.
-  if ! curl -fsSL --max-time 15 -o "$tmp" "$url" >/dev/null; then
+  local curl_args=(-fsSL --max-time 15)
+  if [[ "$url" == https://* ]]; then
+    curl_args+=(--proto '=https' --tlsv1.2)
+  fi
+  if ! curl "${curl_args[@]}" -o "$tmp" "$url" >/dev/null; then
     rm -f "$tmp"
     if [[ -s "$cache_file" ]]; then
       ui_warn "registry" "fetch failed; using stale cache at $cache_file"
@@ -119,6 +145,11 @@ _registry_fetch() {
     return 1
   fi
   mv "$tmp" "$cache_file"
+  if ! _registry_validate_index "$cache_file"; then
+    rm -f "$cache_file"
+    ui_err "registry" "index failed schema and integrity validation"
+    return 1
+  fi
   printf '%s\n' "$cache_file"
 }
 
@@ -129,6 +160,101 @@ _registry_require_jq() {
   }
 }
 
+_registry_archive_is_safe() {
+  local archive="$1"
+  local entry
+  while IFS= read -r entry; do
+    [[ -n "$entry" ]] || continue
+    if [[ "$entry" == /* || "$entry" == ../* || "$entry" == *"/../"* || "$entry" == *"/.." ]]; then
+      ui_err "registry" "archive contains unsafe path: $entry"
+      return 1
+    fi
+  done < <(tar -tzf "$archive")
+  if tar -tvzf "$archive" | awk 'substr($1,1,1) == "l" || substr($1,1,1) == "h" { found=1 } END { exit !found }'; then
+    ui_err "registry" "archive contains links; links are forbidden in registry modules"
+    return 1
+  fi
+}
+
+_registry_install() (
+  local name="$1"
+  local apply="${2:-0}"
+  local index metadata version archive_url expected tmp archive extract module_root actual destination
+
+  [[ "$name" =~ ^[a-z0-9][a-z0-9-]{0,31}$ ]] || {
+    ui_err "install" "invalid module name: $name"
+    return 1
+  }
+  _registry_require_jq || return $?
+  index="$(_registry_fetch)" || return $?
+  _registry_validate_index "$index" || {
+    ui_err "registry" "index failed schema validation"
+    return 1
+  }
+  metadata="$(jq -c --arg name "$name" '.modules[] | select(.name == $name)' "$index")"
+  [[ -n "$metadata" ]] || {
+    ui_err "install" "module not found: $name"
+    return 1
+  }
+  version="$(jq -r '.version' <<<"$metadata")"
+  archive_url="$(jq -r '.archive_url' <<<"$metadata")"
+  expected="$(jq -r '.sha256' <<<"$metadata")"
+
+  tmp="$(mktemp -d -t dot-registry.XXXXXX)"
+  archive="$tmp/module.tar.gz"
+  extract="$tmp/source"
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$extract"
+  local curl_args=(-fsSL --max-time 60)
+  if [[ "$archive_url" == https://* ]]; then
+    curl_args+=(--proto '=https' --tlsv1.2)
+  fi
+  if ! curl "${curl_args[@]}" -o "$archive" "$archive_url"; then
+    ui_err "install" "could not download $archive_url"
+    return 1
+  fi
+  local archive_size
+  archive_size="$(wc -c <"$archive" | tr -d '[:space:]')"
+  if ((archive_size > 52428800)); then
+    ui_err "install" "archive exceeds the 50 MiB safety limit"
+    return 1
+  fi
+  actual="$(_dot_sha256_file "$archive")" || return $?
+  [[ "$actual" == "$expected" ]] || {
+    ui_err "install" "SHA-256 mismatch for $name@$version"
+    return 1
+  }
+  _registry_archive_is_safe "$archive" || return $?
+  tar -xzf "$archive" -C "$extract" --no-same-owner --no-same-permissions
+
+  module_root="$extract"
+  local roots=()
+  while IFS= read -r entry; do roots+=("$entry"); done < <(find "$extract" -mindepth 1 -maxdepth 1 -print)
+  if [[ ${#roots[@]} -eq 1 && -d "${roots[0]}" ]]; then
+    module_root="${roots[0]}"
+  fi
+  [[ -n "$(find "$module_root" -mindepth 1 -print -quit)" ]] || {
+    ui_err "install" "module archive is empty"
+    return 1
+  }
+
+  ui_ok "Verified" "$name@$version ($actual)"
+  ui_section "Chezmoi preview"
+  chezmoi apply --source "$module_root" --destination "$HOME" --dry-run --no-tty
+  if [[ "$apply" != "1" ]]; then
+    ui_info "Preview only" "rerun with --yes to install and apply"
+    return 0
+  fi
+
+  destination="$(_registry_data_dir)/$name/$version"
+  mkdir -p "$(dirname "$destination")"
+  rm -rf "$destination"
+  mv "$module_root" "$destination"
+  chezmoi apply --source "$destination" --destination "$HOME" --no-tty
+  printf '%s\n' "$metadata" >"$(dirname "$destination")/installed.json"
+  ui_ok "Installed" "$name@$version"
+)
+
 cmd_registry() {
   local subcommand="${1:-list}"
   shift || true
@@ -239,9 +365,31 @@ cmd_registry() {
         ui_err "install" "missing module name"
         return 1
       }
-      ui_warn "install" "scaffold only — full module installer is a roadmap item"
-      ui_info "install" "would fetch module $name from registry and apply it as a chezmoi sub-source"
-      return 0
+      shift || true
+      local apply=0
+      case "${1:-}" in
+        "") ;;
+        --yes | -y) apply=1 ;;
+        --dry-run | -n) apply=0 ;;
+        *)
+          ui_err "install" "unknown option: $1"
+          return 2
+          ;;
+      esac
+      _registry_install "$name" "$apply"
+      ;;
+    installed)
+      _registry_require_jq || return $?
+      local modules_dir
+      modules_dir="$(_registry_data_dir)"
+      if [[ ! -d "$modules_dir" ]]; then
+        ui_info "registry" "no modules installed"
+        return 0
+      fi
+      find "$modules_dir" -name installed.json -type f -exec jq -r '"\(.name)\t\(.version)\t\(.description)"' {} \; |
+        while IFS=$'\t' read -r module version description; do
+          ui_ok "$module" "v$version — $description"
+        done
       ;;
     --help | -h | help)
       cat <<EOF
@@ -251,7 +399,8 @@ Subcommands:
   list             List modules in the configured registry
   search <q>       Filter modules by keyword (name, description, tags)
   info <name>      Print metadata for a single module
-  install <name>   Install a module (scaffold — see docs/operations/REGISTRY.md)
+  install <name>   Verify and preview a module; pass --yes to apply
+  installed        List locally installed modules
   url              Show the active registry URL
   set-url <url>    Override the registry URL (persists to user config)
 

package/scripts/dot/powershell/Dot.psm1

@@ -1,8 +1,8 @@
 # Dot — native PowerShell module for the dotfiles framework.
 #
-# This module provides native PowerShell cmdlets for the subset of
-# `dot` subcommands that don't require bash. Closes Stub rows in
-# docs/reference/POWERSHELL_PARITY.md.
+# This module provides native PowerShell cmdlets for the daily `dot`
+# workflow. Commands with Unix-specific orchestration remain available
+# through the dispatcher's explicit bash bridge.
 #
 # Loaded by bin/dot.ps1 dispatcher; cmdlets are also callable
 # directly:
@@ -11,7 +11,7 @@
 #   Invoke-DotHelp
 #   Test-DotAgentsSync -Verbose
 #
-# Tested via scripts/ci/windows-smoke-test.ps1.
+# Tested via tools/ci/windows-smoke-test.ps1.
 
 #requires -Version 7.0
 
@@ -66,6 +66,25 @@ function script:Write-DotBanner {
     Write-Host "$esc[1;38;5;212mDot · $Section$esc[0m"
 }
 
+function script:Assert-DotCommand {
+    param([Parameter(Mandatory)][string]$Name)
+    if (-not (Get-Command $Name -ErrorAction SilentlyContinue)) {
+        throw "$Name is required but was not found on PATH"
+    }
+}
+
+function script:Invoke-DotNativeCommand {
+    param(
+        [Parameter(Mandatory)][string]$Name,
+        [Parameter(Mandatory)][string[]]$Arguments
+    )
+    Assert-DotCommand -Name $Name
+    & $Name @Arguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "$Name exited with status $LASTEXITCODE"
+    }
+}
+
 # Public cmdlets --------------------------------------------------------------
 
 <#
@@ -110,9 +129,8 @@ function Get-DotVersion {
     Print the dot CLI help overview.
 
 .DESCRIPTION
-    Native PowerShell implementation of `dot help`. Reads command
-    metadata from CLAUDE.md / the dispatcher's help table; does
-    NOT shell out to bash.
+    Native PowerShell implementation of `dot help`. Presents the
+    native command surface without shelling out to bash.
 
     The full Linux-style help (every subcommand grouped by category)
     requires the bash dispatcher; this cmdlet shows the Windows-
@@ -132,15 +150,19 @@ function Invoke-DotHelp {
     Write-Host ''
     Write-Host '  Get-DotVersion              Print framework version'
     Write-Host '  Invoke-DotHelp              This screen'
-    Write-Host '  Test-DotAgentsSync          Check AGENTS.md ↔ CLAUDE.md sync'
+    Write-Host '  Test-DotAgentsSync          Check AGENTS.md against CLAUDE.md'
+    Write-Host '  Get-DotStatus               Show chezmoi drift'
+    Write-Host '  Invoke-DotChezmoi           Run a core chezmoi operation'
+    Write-Host '  Invoke-DotDoctor            Audit the native Windows setup'
+    Write-Host '  Get-DotEnvironment          List mise-managed tools'
+    Write-Host '  Get-DotAgents               List agent harness targets'
+    Write-Host '  Get-DotFleetStatus          Show local fleet node status'
     Write-Host ''
     Write-Host 'Bash-bridged subcommands (require bash on PATH):'
     Write-Host ''
-    Write-Host '  dot doctor                  Deep environment audit'
-    Write-Host '  dot env list                List installed mise tools'
     Write-Host '  dot env emit                Emit v1 environment manifest'
     Write-Host '  dot agents render           Re-render every AGENTS.md harness'
-    Write-Host '  dot fleet status            Single-node fleet status (Full on PowerShell)'
+    Write-Host '  dot registry ...            Verified module registry operations'
     Write-Host ''
     Write-Host 'See: dot help all (via bash) — full command index'
 }
@@ -176,24 +198,122 @@ function Test-DotAgentsSync {
             return $false
         }
     }
-    # Both files declare: "Chezmoi-managed dotfiles for macOS, Linux,
-    # WSL, and PowerShell 7.5+. Version `0.2.503`."
-    # That single line is the canonical sync surface — its content
-    # is generated from the same template by `dot agents render`.
-    $claudeLine = (Select-String -Path $claude -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
-        Select-Object -First 1).Line
-    $agentsLine = (Select-String -Path $agents -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
-        Select-Object -First 1).Line
-    if (-not $claudeLine -or -not $agentsLine) {
-        Write-Verbose "sync surface line not found — claude:[$claudeLine] agents:[$agentsLine]"
-        return $false
+    $claudeBody = Get-Content -Raw $claude
+    $agentsBody = Get-Content -Raw $agents
+    foreach ($name in @('claudeBody', 'agentsBody')) {
+        $value = Get-Variable -Name $name -ValueOnly
+        $value = $value -replace '(?s)^\s*<!--.*?-->\s*', ''
+        $value = $value -replace '(?m)^# (CLAUDE|AGENTS)\.md.*\r?\n', ''
+        $value = $value -replace '(?s)\r?\n---\r?\n\r?\n\*\*Need richer context\?.*$', ''
+        $value = ($value -replace "`r`n", "`n").Trim()
+        Set-Variable -Name $name -Value $value
     }
-    if ($claudeLine -ne $agentsLine) {
-        Write-Verbose "drift detected:`n  CLAUDE.md: $claudeLine`n  AGENTS.md: $agentsLine"
+    if ($claudeBody -cne $agentsBody) {
+        Write-Verbose 'AGENTS.md content differs from the canonical CLAUDE.md body'
         return $false
     }
-    Write-Verbose 'AGENTS.md sync surface matches CLAUDE.md'
+    Write-Verbose 'AGENTS.md content matches the canonical CLAUDE.md body'
     return $true
 }
 
-Export-ModuleMember -Function Get-DotVersion, Invoke-DotHelp, Test-DotAgentsSync
+function Invoke-DotChezmoi {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        [ValidateSet('apply', 'diff', 'update', 'add', 'remove', 'init')]
+        [string]$Operation,
+        [Parameter(ValueFromRemainingArguments = $true)]
+        [string[]]$Arguments = @()
+    )
+    Invoke-DotNativeCommand -Name 'chezmoi' -Arguments (@($Operation) + $Arguments)
+}
+
+function Get-DotStatus {
+    [CmdletBinding()]
+    param([switch]$AsObject)
+    Assert-DotCommand -Name 'chezmoi'
+    $output = @(& chezmoi status 2>&1)
+    if ($LASTEXITCODE -ne 0) {
+        throw "chezmoi status exited with status $LASTEXITCODE`: $($output -join [Environment]::NewLine)"
+    }
+    $state = if ($output.Count -eq 0) { 'clean' } else { 'drifted' }
+    if ($AsObject) {
+        return [pscustomobject]@{ State = $state; Changes = $output; Native = $true }
+    }
+    Write-DotBanner -Section 'Status'
+    if ($state -eq 'clean') { Write-Host '[OK] Clean - no local drift detected' }
+    else { $output | Write-Output }
+}
+
+function Get-DotSourcePath {
+    [CmdletBinding()]
+    param()
+    Assert-DotCommand -Name 'chezmoi'
+    $path = (& chezmoi source-path 2>&1 | Out-String).Trim()
+    if ($LASTEXITCODE -ne 0 -or -not $path) { throw 'chezmoi source-path failed' }
+    return $path
+}
+
+function Invoke-DotDoctor {
+    [CmdletBinding()]
+    param([switch]$AsObject)
+    $checks = @(
+        [pscustomobject]@{ Name = 'PowerShell 7.4+'; Ok = ($PSVersionTable.PSVersion -ge [version]'7.4') }
+        [pscustomobject]@{ Name = 'chezmoi'; Ok = [bool](Get-Command chezmoi -ErrorAction SilentlyContinue) }
+        [pscustomobject]@{ Name = 'git'; Ok = [bool](Get-Command git -ErrorAction SilentlyContinue) }
+        [pscustomobject]@{ Name = 'repository data'; Ok = (Test-Path $script:DataFile) }
+        [pscustomobject]@{ Name = 'PowerShell module'; Ok = (Test-Path (Join-Path $PSScriptRoot 'Dot.psm1')) }
+    )
+    if ($AsObject) { return $checks }
+    Write-DotBanner -Section 'Doctor'
+    foreach ($check in $checks) {
+        $prefix = if ($check.Ok) { '[OK]' } else { '[FAIL]' }
+        Write-Host "$prefix $($check.Name)"
+    }
+    return -not ($checks.Ok -contains $false)
+}
+
+function Get-DotEnvironment {
+    [CmdletBinding()]
+    param([switch]$AsJson)
+    Assert-DotCommand -Name 'mise'
+    $arguments = if ($AsJson) { @('ls', '--json') } else { @('ls') }
+    Invoke-DotNativeCommand -Name 'mise' -Arguments $arguments
+}
+
+function Get-DotAgents {
+    [CmdletBinding()]
+    param()
+    $targets = [ordered]@{
+        'agents-md' = 'AGENTS.md'; 'cursor' = '.cursor/rules/dotfiles.mdc'
+        'codex' = '.codex/config.toml'; 'windsurf' = '.windsurf/rules.md'
+        'zed' = '.zed/agent-config.toml'; 'roo' = '.roo/rules.md'
+        'cline' = '.clinerules'; 'aider' = '.aider.conf.yml'
+        'continue' = '.continuerc.json'; 'jules' = '.jules/system.md'
+        'agy' = '.agy/AGY.md'
+    }
+    foreach ($entry in $targets.GetEnumerator()) {
+        $path = Join-Path $script:RepoRoot $entry.Value
+        [pscustomobject]@{ Harness = $entry.Key; Path = $path; Rendered = (Test-Path $path) }
+    }
+}
+
+function Get-DotFleetStatus {
+    [CmdletBinding()]
+    param([switch]$AsJson)
+    $status = Get-DotStatus -AsObject
+    $record = [pscustomobject]@{
+        NodeId = [Environment]::MachineName
+        Namespace = 'default'
+        Version = Get-DotfilesVersionFromData
+        OS = [System.Runtime.InteropServices.RuntimeInformation]::OSDescription
+        Architecture = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString()
+        Drift = $status.State
+    }
+    if ($AsJson) { return $record | ConvertTo-Json -Compress }
+    return $record
+}
+
+Export-ModuleMember -Function Get-DotVersion, Invoke-DotHelp, Test-DotAgentsSync, `
+    Invoke-DotChezmoi, Get-DotStatus, Get-DotSourcePath, Invoke-DotDoctor, `
+    Get-DotEnvironment, Get-DotAgents, Get-DotFleetStatus

package/scripts/fonts/install-nerd-fonts.sh

@@ -7,32 +7,38 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/verified-download.sh disable=SC1091
+source "$SCRIPT_DIR/../../lib/dot/verified-download.sh"
 
 ui_init
 ui_header "Nerd Fonts"
 
 DEFAULT_FONTS="JetBrainsMono FiraCode Iosevka"
 FONT_LIST="${*:-$DEFAULT_FONTS}"
+FONT_VERSION="v3.4.0"
+FONT_BASE_URL="https://github.com/ryanoasis/nerd-fonts/releases/download/${FONT_VERSION}"
+FONT_CHECKSUM_URL="${FONT_BASE_URL}/SHA-256.txt"
 
-install_linux() {
-  font_name="$1"
-  target_dir="$HOME/.local/share/fonts/${font_name}NerdFont"
+install_linux() (
+  local font_name="$1"
+  local target_dir="$HOME/.local/share/fonts/${font_name}NerdFont"
   mkdir -p "$target_dir"
+  local tmp_dir
   tmp_dir="$(umask 077 && mktemp -d)"
-  # shellcheck disable=SC2064
-  trap "rm -rf '$tmp_dir'" RETURN
-  url="https://github.com/ryanoasis/nerd-fonts/releases/latest/download/${font_name}.zip"
+  trap 'rm -rf "$tmp_dir"' EXIT
+  local asset="${font_name}.zip"
+  local url="${FONT_BASE_URL}/${asset}"
   ui_info "Downloading" "$font_name Nerd Font"
-  curl -fL --connect-timeout 10 --max-time 300 "$url" -o "$tmp_dir/${font_name}.zip"
-  if ! unzip -o "$tmp_dir/${font_name}.zip" -d "$target_dir" >/dev/null; then
-    ui_err "Unzip failed" "${font_name}.zip" >&2
+  download_verified_asset "$url" "$FONT_CHECKSUM_URL" "$asset" "$tmp_dir/$asset" 104857600
+  if ! unzip -o "$tmp_dir/$asset" -d "$target_dir" >/dev/null; then
+    ui_err "Unzip failed" "$asset" >&2
     return 1
   fi
   if command -v fc-cache >/dev/null; then
     fc-cache -f "$target_dir"
   fi
   ui_ok "Installed" "$target_dir"
-}
+)
 
 install_macos() {
   font_name="$1"

package/scripts/git-hooks/pre-commit-audit.sh

@@ -141,6 +141,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.512 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.513 standards maintained."
   exit 0
 fi