@sebastienrousseau/dotfiles 0.2.519 → 0.2.520

package/docs/reference/TOOLS.md

@@ -35,7 +35,7 @@ Integrated tools organized by role in the workflow.
 | Tool | Purpose | Description |
 | :--- | :--- | :--- |
 | **Pueue** | Task queue | Offload long-running tasks to a background daemon |
-| **Wasmtime** | Wasm runtime | Run pre-compiled Rust/Zig tools as WebAssembly modules |
+| **Wasmtime** | Wasm runtime | Runs `lib/wasm-tools` (`dot-sys.wasm`) for `dot attest --verify` |
 | **SOPS** | Secrets operations | Encrypted secrets with automatic en/decryption |
 
 ---

package/docs/reference/UTILS.md

@@ -198,6 +198,7 @@ Every `dot` command's individually-enforced subcommands (see `dot help`).
 | `dot agent conformance` | Run the A2A conformance test suite |
 | `dot mcp doctor` | Run the MCP policy/supply-chain/config audit |
 | `dot mcp registry` | Show the configured MCP server registry |
+| `dot mcp serve` | Run the stdio MCP server (JSON-RPC 2.0 on stdin/stdout) |
 | `dot secrets edit` | Edit the encrypted secrets file (age) |
 | `dot secrets set` | Store a secret value under a key |
 | `dot secrets get` | Retrieve a secret value (--raw for plaintext) |

package/docs/security/COMPLIANCE.md

@@ -370,7 +370,7 @@ bash tests/unit/test_dot_commands_apply.sh
 
 | File | Purpose | Location |
 |------|---------|----------|
-| SECURITY.md | Vulnerability reporting | `.github/SECURITY.md` |
+| SECURITY.md | Vulnerability reporting | `SECURITY.md` |
 | CONTRIBUTING.md | Contribution guidelines | `.github/CONTRIBUTING.md` |
 | CODEOWNERS | Code ownership | `.github/CODEOWNERS` |
 | INCIDENT_RESPONSE.md | Incident response plan | `docs/security/` |

package/docs/security/DISCLOSURE.md

@@ -34,7 +34,7 @@ gpg --fingerprint security@sebastienrousseau.com
 ```
 
 The fingerprint must match the one published in
-[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md). Cross-verify
+[`SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/SECURITY.md). Cross-verify
 against the SSH signing key in `dot_config/git/allowed_signers.tmpl`
 — the maintainer signs commits with the same identity, so both
 fingerprints derive from the same identity claim.
@@ -75,7 +75,7 @@ subjects in plain text).
 ## 5. Acknowledgement
 
 You should receive an acknowledgement within the SLA in
-[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md):
+[`SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/SECURITY.md):
 
 | Severity | Initial response |
 |---|---|
@@ -107,7 +107,7 @@ The maintainer commits to:
 - Public credit at fix time in the release notes (unless you
   request anonymity at report time).
 - A backport to any actively-supported release line listed in
-  `.github/SECURITY.md`.
+  `SECURITY.md`.
 
 ## What NOT to do
 
@@ -122,7 +122,7 @@ The maintainer commits to:
 
 ## See also
 
-- [`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md) — policy
+- [`SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/SECURITY.md) — policy
   overview + fingerprint.
 - [`docs/security/KEY_ROTATION.md`](KEY_ROTATION.md) — schedule for
   when the disclosure key is rotated.

package/docs/security/FUZZING.md

@@ -26,56 +26,144 @@ Drift between the shell and Go port IS the bug class the
 fuzzer is designed to surface — if the Go port accepts a string
 the shell rejects (or vice-versa), one of them has a hole.
 
+## Where the harnesses live
+
+The framework ships three Go binaries as well as the shell, so
+harnesses live in four modules:
+
+| Module | Harnesses | Runs against |
+|--------|-----------|--------------|
+| `fuzz` | 11 | ports of the shell helpers **and** of the two binaries' parsers — this is the package OSS-Fuzz and ClusterFuzzLite compile |
+| `defaults/dot_local/share/dot-ui` | 8 | the real dot-ui implementation, in-module |
+| `defaults/dot_local/share/dot-ai-tui` | 11 | the real dot-ai-tui implementation, in-module |
+| `defaults/dot_local/share/dot-mcp` | 5 | the real MCP server, in-module — everything a peer can put on the wire |
+
+`dot-ui` and `dot-ai-tui` are `package main` in their own modules,
+which OSS-Fuzz's `compile_native_go_fuzzer` cannot import — it needs a
+library package. Their parsers are therefore **ported** into
+`fuzz` alongside the shell ports, and fuzzed
+in-module as well. The in-module targets are the ones that catch real
+bugs on every push; the ports are what runs continuously at scale.
+The same lockstep rule applies: drift between a port and its original
+is a bug in one of them.
+
 ## Harnesses today
 
+### Ports (built by OSS-Fuzz / ClusterFuzzLite)
+
 | Harness | Mirrors | What it proves |
 |---------|---------|----------------|
 | `FuzzValidateName` | `scripts/dot/lib/utils.sh:101` (`validate_name`) | Every accepted name contains only `[a-zA-Z0-9._-]`; no shell metacharacter slips through; empty input refused. |
 | `FuzzInitURLResolver` | `scripts/dot/commands/init.sh` (URL construction in `dot init <user\|owner/repo\|url>`) | Accepted URLs use `https://` / `git@` / `ssh://` only; plain HTTP refused; no shell metacharacters in constructed URLs; one input shape per acceptable form. |
+| `FuzzUIEventLine` | dot-ui `run.go` (`parseEvent`, `renderBar`) | A line either decodes to valid JSON or is refused; an accepted event round-trips; the derived progress width is always a legal repeat count. |
+| `FuzzUIHexColor` | dot-ui `theme.go` (`parseColor`) | An accepted `DOT_UI_*` value is a literal `#rgb`/`#rrggbb` with no metacharacter or escape sequence — these are interpolated into terminal escapes. |
+| `FuzzUIPickFilter` | dot-ui `pick.go` (`fuzzyMatch`, `readItems`) | No blank candidate survives; every candidate matches itself in any script; a query longer than the candidate never matches. |
+| `FuzzUIPickArgs` | dot-ui `main.go` (`parsePickArgs`) | The parser never invents a value; every prefix of the argument list is safe. |
+| `FuzzUITableRows` | dot-ui `table.go` (`runTable` input) | The `\x1f` split is reversible, so no cell can merge into or leak across a neighbouring column. |
+| `FuzzAISessionFile` | dot-ai-tui `main.go` (`parseSession`) | A malformed session file decodes to nothing, never to a partial or mutated transcript; a valid one round-trips. |
+| `FuzzAISqliteOutput` | dot-ai-tui `main.go` (`filterSqliteOutput`) | No `~/.sqliterc` meta line (`.timer`, `Run Time:`) survives into the cost/run data the cockpit renders. |
+| `FuzzAIFenceTag` | dot-ai-tui `main.go` (`langRe`, `highlight`) | Every fence info string taken from model output is refused or a short identifier, so an unbounded chroma lexer lookup cannot stall rendering; prose segments survive segmentation. |
+| `FuzzAIGatewayURL` | dot-ai-tui `main.go` (`gatewayURL`) | The health-check URL always keeps the `http` scheme and the configured host and port verbatim. |
+
+### In-module (against the real implementation)
+
+| Module | Harnesses |
+|--------|-----------|
+| dot-ui | `FuzzParseEvent`, `FuzzStepApply`, `FuzzParseColor`, `FuzzFuzzyMatch`, `FuzzPickKeys`, `FuzzRunTable`, `FuzzReadItems`, `FuzzParsePickArgs` |
+| dot-ai-tui | `FuzzHighlight`, `FuzzBuildPrompt`, `FuzzHandleSlash`, `FuzzPalette`, `FuzzWindowRows`, `FuzzRenderTranscript`, `FuzzParseSession`, `FuzzFilterSqliteOutput`, `FuzzGatewayURL`, `FuzzModelKeys`, `FuzzModelCycle` |
+| dot-mcp | `FuzzReadFrames`, `FuzzDecodeRequest`, `FuzzValidateArgs`, `FuzzServeSession`, `FuzzBuildCallResult` |
+
+Each module's `FEATURES.md` maps every harness to the feature it
+covers, and a matrix test fails if a harness is missing from it.
+
+### Findings so far
+
+| Harness | Bug | Fix |
+|---------|-----|-----|
+| `FuzzStepApply` | `{"t":"progress","cur":-1,"total":1}` produced a negative `strings.Repeat` count and panicked the run view mid-apply. | Clamp the bar width to `[0, w]`. |
+| `FuzzFuzzyMatch` | The picker compared a query **byte** against a candidate **rune**, so no non-ASCII query could match — not even the identical string. | Compare both sides as runes. |
+| `FuzzHighlight` | A 5 000-character fenced-block language tag stalled every render for 13s (chroma's unknown-lexer lookup is linear in the tag length). | Validate fence tags against a short-identifier pattern and memoise the lookup. |
+| `FuzzRenderTranscript` | An empty transcript on a 12-row terminal with the palette open asked the splash for a negative height and panicked on a slice bound. | Drop the "recent runs" block when it does not fit; clamp the splash height. |
+
+### Harness files must be self-contained
+
+`compile_native_go_fuzzer` rewrites **one** `*_test.go` file into a
+regular `.go` file and builds it **without** the package's other test
+files. A harness that references a symbol declared in a sibling
+`_test.go` therefore passes `go test` everywhere and fails only inside
+the OSS-Fuzz / ClusterFuzzLite container:
+
+```
+./dot_ui_parsers_test.go_fuzz.go:117:21: undefined: dangerousChars
+2026/09/07 01:14:42 failed to build packages:exit status 1
+```
+
+So a shared constant is deliberately **duplicated** per harness file
+rather than factored out. If sharing is genuinely warranted, put the
+symbol in a non-test `.go` file in the package — those the builder keeps.
+
+`tools/ci/check-fuzz-harness-self-contained.sh` enforces this by
+type-checking each harness alone in a scratch module; it runs in the
+`Fuzz / Harness self-containment` job on every relevant PR.
 
 Add a harness when:
 
 - a new `dot <subcommand>` accepts user input via `$1` / `--flag`,
 - a new regex appears in `scripts/dot/lib/utils.sh`,
-- a new "construct a URL / path / shell-eval string" code path lands.
+- a new "construct a URL / path / shell-eval string" code path lands,
+- a new function in `dot-ui`, `dot-ai-tui` or `dot-mcp` parses or transforms
+  stdin, an environment variable, a key stream or model output —
+  add it in-module *and* port it to `fuzz`.
 
 ## Running locally
 
 ```sh
-cd oss-fuzz-integration/fuzz
+# Ports (also what OSS-Fuzz builds)
+cd fuzz
+go test -run '^$' -fuzz=FuzzValidateName -fuzztime=30s ./...
+go test -run '^$' -fuzz=FuzzUIEventLine  -fuzztime=30s ./...
 
-# 30-second smoke (find regressions quickly)
-go test -run TestNothing -fuzz=FuzzValidateName    -fuzztime=30s ./...
-go test -run TestNothing -fuzz=FuzzInitURLResolver -fuzztime=30s ./...
+# In-module, against the real implementation
+cd defaults/dot_local/share/dot-ui
+go test -run '^$' -fuzz=FuzzStepApply -fuzztime=30s ./...
 
-# Longer run when investigating a flake
-go test -run TestNothing -fuzz=FuzzValidateName    -fuzztime=10m ./...
+cd defaults/dot_local/share/dot-ai-tui
+go test -run '^$' -fuzz=FuzzHighlight -fuzztime=30s ./...
+
+# Replay every committed corpus in a module (no fuzzing, no flakes)
+go test -run '^Fuzz' -v ./...
 ```
 
+Each module's README lists every harness with a copy-pasteable
+command.
+
 Failures land in `testdata/fuzz/Fuzz<Name>/` as auto-saved
 reproducers. Commit them — they become permanent regression
-guards via `go test ./...`.
+guards, replayed by `go test ./...` and by the `replay` job in
+`.github/workflows/fuzz.yml`.
 
 ## OSS-Fuzz integration (pending)
 
-The `oss-fuzz-integration/` directory contains everything OSS-Fuzz
+The `fuzz/oss-fuzz/` directory contains everything OSS-Fuzz
 needs to onboard this project:
 
 ```
-oss-fuzz-integration/
+fuzz/oss-fuzz/
 ├── project.yaml      # OSS-Fuzz project metadata
 ├── Dockerfile        # build environment
 ├── build.sh          # compiles every harness in fuzz/
 └── fuzz/             # the harnesses themselves
     ├── go.mod
     ├── validate_name_test.go
-    └── init_url_resolver_test.go
+    ├── init_url_resolver_test.go
+    ├── dot_ui_parsers_test.go       # ports of the dot-ui parsers
+    └── dot_ai_tui_parsers_test.go   # ports of the dot-ai-tui parsers
 ```
 
 To onboard:
 
 1. Fork `github.com/google/oss-fuzz`.
-2. Copy `oss-fuzz-integration/` contents to `projects/dotfiles/` in the fork.
+2. Copy `fuzz/oss-fuzz/` contents to `projects/dotfiles/` in the fork.
 3. Verify locally per <https://google.github.io/oss-fuzz/getting-started/new-project-guide/#testing-locally>:
 
    ```sh
@@ -95,16 +183,23 @@ which runs OSS-Fuzz-style fuzzing on every PR in this repo
 
 ## CI workflow
 
-`.github/workflows/fuzz.yml` (planned) runs each harness for
-60 seconds on every PR touching:
+`.github/workflows/fuzz.yml` has two gates:
 
-- `scripts/dot/lib/utils.sh`
-- `scripts/dot/commands/init.sh`
-- `oss-fuzz-integration/**`
+- **replay** — on every push and PR, every committed corpus (seed
+  entries plus the minimized crashers of previously-fixed findings) is
+  replayed in all three modules with `go test -run '^Fuzz'`. No
+  fuzzing, so no flakes: a fixed crash cannot silently come back.
+- **fuzz** — a 60-second window per harness (configurable via
+  `workflow_dispatch`) on PRs touching an input-parsing surface:
+  `scripts/dot/lib/utils.sh`, `scripts/dot/commands/init.sh`,
+  `fuzz/**`, `.clusterfuzzlite/**` or either Go
+  module.
 
 This is the local equivalent of CIFuzz and catches the
 "shell-regex-change without Go-port update" drift class before
-PR merge.
+PR merge. The per-module test workflows (`dot-ui-test.yml`,
+`cockpit-test.yml`) replay their own corpus too, so the guard holds
+even when only one module changes.
 
 ## See also
 

package/docs/security/KEY_ROTATION.md

@@ -6,7 +6,7 @@ render_with_liquid: false
 
 This page tracks two distinct key lifecycles:
 
-1. **Disclosure key** — the GPG key reporters use to encrypt vulnerability reports to the maintainer. Single key, public, rotated annually or on compromise. Source of truth for the active fingerprint is `.github/SECURITY.md`.
+1. **Disclosure key** — the GPG key reporters use to encrypt vulnerability reports to the maintainer. Single key, public, rotated annually or on compromise. Source of truth for the active fingerprint is `SECURITY.md`.
 2. **Secrets encryption keys** — the Age and SOPS keys that protect encrypted dotfiles in this repo. Multiple keys, per-machine, rotated annually or on personnel / device change.
 
 Both sections live here so a single audit can confirm the project's

package/docs/security/SCORECARD.md

@@ -69,13 +69,13 @@ marks reflect this repo's posture at the time of writing — the
 | Code-Review | ⚠ | Single-maintainer repo; PRs are self-merged after CI. Scorecard scores 0/30 here by design — see `Open findings` below. |
 | Signed-Commits | ✓ | Enforced by pre-push hook (`scripts/git-hooks/pre-push`) and at-push by branch protection (#853 + #857). |
 | Dependency-Update-Tool | ✓ | Dependabot configured for github-actions / npm / docker / devcontainers / uv. |
-| Fuzzing | ⚠ | `install.sh` fuzz harness lives under `tests/fuzz/` (closes #881), but it's shell-based and Scorecard's heuristic only recognizes OSS-Fuzz / ClusterFuzzLite / native Go fuzz / libFuzzer / Atheris. None support shell. Property tests under `tests/unit/functions/test_property_*.sh` cover the closest equivalent surface. |
+| Fuzzing | ⚠ | `install.sh` fuzz harness lives under `fuzz/install/` (closes #881), but it's shell-based and Scorecard's heuristic only recognizes OSS-Fuzz / ClusterFuzzLite / native Go fuzz / libFuzzer / Atheris. None support shell. Property tests under `tests/unit/functions/test_property_*.sh` cover the closest equivalent surface. |
 | License | ✓ | MIT at repo root (`LICENSE`). |
 | Maintained | ✓ | Active commit cadence; the [README](https://github.com/sebastienrousseau/dotfiles/blob/main/README.md) lists the current `dotfiles_version`. |
 | Pinned-Dependencies | ⚠ | Closed 8 of 14 findings this cycle (every Dockerfile base + every workflow action + 2 `curl \| sh` installers + the `npm install -g npm` upgrade step). 5 residual findings stay open by design — see `Open findings`. |
 | SAST | ✓ | CodeQL (`.github/workflows/codeql.yml`) + Checkov + Grype. |
 | SBOM | ✓ | Generated per PR by `sbom-diff.yml` and per release by `security-release.yml`. |
-| Security-Policy | ✓ | `.github/SECURITY.md` + this page + `docs/security/THREAT_MODEL.md`. |
+| Security-Policy | ✓ | `SECURITY.md` + this page + `docs/security/THREAT_MODEL.md`. |
 | Token-Permissions | ✓ | Top-level `permissions:` blocks restricted to `contents: read`. `write` scopes scoped to the jobs that need them (#886). |
 | Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `main` (#852). |
 | Webhooks | n/a | No external webhooks configured. |
@@ -117,7 +117,7 @@ false positives in Scorecard's regex.
 
 | Alert | Action |
 |---|---|
-| `FuzzingID` (medium) | Dismiss as **Won't fix** with comment: "Repo is bash + Go-template + Lua. ClusterFuzzLite / OSS-Fuzz / native Go fuzz / libFuzzer / Atheris (the frameworks Scorecard recognises) all target compiled languages, none support shell. The `tests/fuzz/fuzz_install.sh` harness + property tests under `tests/unit/functions/test_property_*.sh` cover the equivalent surface." |
+| `FuzzingID` (medium) | Dismiss as **Won't fix** with comment: "Repo is bash + Go-template + Lua. ClusterFuzzLite / OSS-Fuzz / native Go fuzz / libFuzzer / Atheris (the frameworks Scorecard recognises) all target compiled languages, none support shell. The `fuzz/install/fuzz_install.sh` harness + property tests under `tests/unit/functions/test_property_*.sh` cover the equivalent surface." |
 | `CIIBestPracticesID` (low) | Apply at <https://www.bestpractices.dev/projects/new>. ~67 self-attested questions, free, 1-2 hours. After silver-tier approval, paste the badge into `README.md` next to the existing Scorecard badge. Most criteria already met (signed commits, CI, security policy, license). |
 
 ## Closed this cycle

package/docs/security/VERIFY_RELEASE.md

@@ -187,13 +187,13 @@ verify-dot-release v0.2.502    # verify specific tag
    `security@sebastienrousseau.com` (encrypted to the WKD-published
    GPG key — fingerprint
    `55AFAD364FD9DB3819E61F0C8D688FAFA9144693`). Acknowledgement
-   SLA: 72 hours per `.github/SECURITY.md`.
+   SLA: 72 hours per `SECURITY.md`.
 
 ---
 
 ## See also
 
-- `.github/SECURITY.md` — coordinated disclosure policy.
+- `SECURITY.md` — coordinated disclosure policy.
 - `docs/security/KEY_ROTATION.md` — disclosure-key rotation procedure.
 - `docs/security/SCORECARD.md` — OpenSSF Scorecard posture.
 - `docs/operations/HARD_AUDIT_2026.md` Part 7 — the GPG key generation + WKD publication record.

package/install.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
 # Usage: gh repo clone sebastienrousseau/dotfiles && cd dotfiles && ./install.sh
@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.519)
+  version       The version (tag or branch) to install (default: v0.2.520)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.519"
+  local version="v0.2.520"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.519)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.520)."
         fi
         version="$arg"
         version_set=1
@@ -369,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.519 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.520 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.519 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.520 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.519",
+  "version": "0.2.520",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {
@@ -48,7 +48,7 @@
     "email": "sebastienrousseau@users.noreply.github.com",
     "url": "https://sebastienrousseau.com"
   },
-  "license": "MIT",
+  "license": "Apache-2.0 OR MIT",
   "bugs": {
     "url": "https://github.com/sebastienrousseau/dotfiles/issues"
   },

package/scripts/ci/check-copyright-headers.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on main still reference the old path;

package/scripts/ci/check-shell-preamble.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on main still reference the old path;

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on main still reference the old path;

package/scripts/demo/record.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/diagnostics/a2a-conformance.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 ## A2A v0.3 and agent card conformance validation.
 

package/scripts/diagnostics/alias-governance.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Alias governance checks:
 # - duplicate alias names
@@ -54,6 +54,31 @@ if [[ -f "$SCRIPT_DIR/../../package.json" ]]; then
 fi
 repo_version="${repo_version:-0.0.0}"
 
+# ripgrep is preferred but is NOT guaranteed to be installed (the CI
+# runners and minimal setups often lack it, which is why
+# aliases-manifest.sh already carries a grep fallback). Without one
+# here, `rg` exiting 127 reads as "no match": every gated override was
+# reported as ungated, and this gate failed with false errors on any
+# machine without ripgrep.
+_gov_grep_file() { # <ere-pattern> <file>
+  if command -v rg >/dev/null 2>&1; then
+    rg -q "$1" "$2"
+  else
+    grep -qE "$1" "$2"
+  fi
+}
+
+_gov_grep_tree() { # <ere-pattern> <dir>...
+  local pattern="$1"
+  shift
+  if command -v rg >/dev/null 2>&1; then
+    rg -q --glob '*.sh' --glob '*.aliases.sh' --glob '*.tmpl' "$pattern" "$@" 2>/dev/null
+  else
+    grep -rqE --include='*.sh' --include='*.aliases.sh' --include='*.tmpl' \
+      "$pattern" "$@" 2>/dev/null
+  fi
+}
+
 # 1) Duplicate alias names
 dupes="$(awk -F'\t' '{count[$1]++} END {for (k in count) if (count[k] > 1) print k}' "$tmp_manifest" | sort)"
 if [[ -n "$dupes" ]]; then
@@ -77,7 +102,7 @@ while IFS=$'\t' read -r name _value file _line; do
       if [[ "$file" == *"/aliases/gnu/"* ]]; then
         continue
       fi
-      if ! rg -q 'DOTFILES_(ENABLE|SAFE|ALIAS)' "$file"; then
+      if ! _gov_grep_file 'DOTFILES_(ENABLE|SAFE|ALIAS)' "$file"; then
         echo "ERROR: risky override '$name' in $file is not gated by a DOTFILES_* flag"
         errors=$((errors + 1))
       fi
@@ -111,7 +136,9 @@ if [[ -f "$deprecations_file" ]]; then
         alias_found=1
       fi
       function_found=0
-      if rg -q --glob '*.sh' --glob '*.aliases.sh' --glob '*.tmpl' "^[[:space:]]*(function[[:space:]]+)?${alias_name}[[:space:]]*\\(\\)" "$SCRIPT_DIR/../../defaults/.chezmoitemplates/aliases" "$SCRIPT_DIR/../../scripts/dot"; then
+      if _gov_grep_tree "^[[:space:]]*(function[[:space:]]+)?${alias_name}[[:space:]]*\\(\\)" \
+        "$SCRIPT_DIR/../../defaults/.chezmoitemplates/aliases" \
+        "$SCRIPT_DIR/../../scripts/dot"; then
         function_found=1
       fi
       if [[ $alias_found -eq 1 || $function_found -eq 1 ]]; then

package/scripts/diagnostics/aliases-cheatsheet.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/diagnostics/aliases-manifest.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Emit alias manifest as TSV:
 # name<TAB>value<TAB>file<TAB>line

package/scripts/diagnostics/attest-verify.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+## Verify workstation attestation evidence with the WebAssembly verifier.
+##
+## Runs `lib/wasm-tools` built for `wasm32-wasip1` under `wasmtime` and feeds
+## it an evidence record on stdin. The module has no filesystem, no network
+## and no environment: it reads the document, applies the policy and writes a
+## verdict. Nothing about the verdict depends on the tools installed on the
+## machine under review — which is the point, since that machine is the one
+## making the claims.
+##
+## Usage: dot attest --verify [--json|-j] [--max-age SECS] [FILE]
+##        dot attest --json | bash scripts/diagnostics/attest-verify.sh
+##
+## Exit codes: 0 every check passed, 1 a check failed, 2 the evidence or the
+## toolchain was unusable.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+export REPO_ROOT
+
+# shellcheck source=../../lib/dot/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+
+CRATE_DIR="$REPO_ROOT/lib/wasm-tools"
+WASM_TARGET="wasm32-wasip1"
+DEFAULT_MODULE="$CRATE_DIR/target/$WASM_TARGET/release/dot-sys.wasm"
+
+JSON_MODE=0
+MAX_AGE=""
+EVIDENCE_FILE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --json | -j)
+      JSON_MODE=1
+      shift
+      ;;
+    --max-age | -a)
+      MAX_AGE="${2:-}"
+      shift 2
+      ;;
+    --verify | -V)
+      # Accepted so the flag can be forwarded verbatim from `dot attest`.
+      shift
+      ;;
+    --help | -h)
+      cat <<'USAGE'
+Usage: dot attest --verify [--json|-j] [--max-age SECS] [FILE]
+
+Runs the wasm32-wasip1 build of lib/wasm-tools under wasmtime and checks an
+evidence record against the workstation policy. Reads FILE, or stdin, or a
+fresh `dot attest --json` when given neither.
+
+  --json, -j        emit the machine-readable verdict
+  --max-age SECS    freshness window for `generated_at` (`any` to lift it)
+  --help, -h        print this text
+
+Exit codes: 0 every check passed, 1 a check failed, 2 unusable input or
+toolchain.
+USAGE
+      exit 0
+      ;;
+    --)
+      shift
+      break
+      ;;
+    -*)
+      echo "attest-verify: unknown option $1" >&2
+      exit 2
+      ;;
+    *)
+      EVIDENCE_FILE="$1"
+      shift
+      ;;
+  esac
+done
+
+# Resolve the WebAssembly runtime. `wasmtime` is pinned in mise.toml, shipped
+# by flake.nix and the Brewfile, and checked by `dot doctor`.
+WASMTIME_BIN="${WASMTIME:-wasmtime}"
+if ! command -v "$WASMTIME_BIN" >/dev/null 2>&1; then
+  echo "attest-verify: no WebAssembly runtime found (looked for '$WASMTIME_BIN')." >&2
+  echo "attest-verify: install it with 'mise install wasmtime' or set WASMTIME." >&2
+  exit 2
+fi
+
+# Resolve the module, building it on demand when a Rust toolchain is present.
+MODULE="${DOT_SYS_WASM:-$DEFAULT_MODULE}"
+if [[ ! -f "$MODULE" ]]; then
+  if [[ -n "${DOT_SYS_WASM:-}" ]]; then
+    echo "attest-verify: DOT_SYS_WASM points at a missing file: $MODULE" >&2
+    exit 2
+  fi
+  if ! command -v cargo >/dev/null 2>&1; then
+    echo "attest-verify: no verifier at $MODULE and no cargo to build one." >&2
+    echo "attest-verify: build it with:" >&2
+    echo "  cargo build --release --target $WASM_TARGET --manifest-path lib/wasm-tools/Cargo.toml" >&2
+    exit 2
+  fi
+  echo "attest-verify: building the verifier for $WASM_TARGET ..." >&2
+  cargo build --quiet --release --target "$WASM_TARGET" \
+    --manifest-path "$CRATE_DIR/Cargo.toml" --bin dot-sys >&2
+fi
+
+# Collect the evidence: an explicit file, a pipe, or a fresh attestation.
+evidence=""
+if [[ -n "$EVIDENCE_FILE" ]]; then
+  if [[ ! -f "$EVIDENCE_FILE" ]]; then
+    echo "attest-verify: no such evidence file: $EVIDENCE_FILE" >&2
+    exit 2
+  fi
+  evidence="$(cat "$EVIDENCE_FILE")"
+elif [[ ! -t 0 ]]; then
+  evidence="$(cat)"
+else
+  evidence="$(bash "$SCRIPT_DIR/workstation-attestation.sh" --json)"
+fi
+
+module_args=(verify)
+[[ "$JSON_MODE" -eq 1 ]] && module_args+=(--json)
+[[ -n "$MAX_AGE" ]] && module_args+=(--max-age "$MAX_AGE")
+
+set +e
+verdict="$(printf '%s' "$evidence" | "$WASMTIME_BIN" run "$MODULE" "${module_args[@]}")"
+status=$?
+set -e
+
+if [[ "$JSON_MODE" -eq 1 ]]; then
+  printf '%s\n' "$verdict"
+  exit "$status"
+fi
+
+ui_init
+ui_dot_banner "Diagnostics"
+ui_header "Attestation Verification"
+printf '%s\n' "$verdict"
+if [[ "$status" -eq 0 ]]; then
+  ui_ok "Verdict" "every check passed"
+else
+  ui_err "Verdict" "see the failed checks above"
+fi
+ui_info "Verifier" "$MODULE (wasm32-wasip1, $("$WASMTIME_BIN" --version | head -n 1))"
+exit "$status"

package/scripts/diagnostics/benchmark.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 ## Shell Performance Benchmark.
 ##