@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/CHANGELOG.md

@@ -2,8 +2,206 @@
 
 This file documents all notable changes to this project.
 
+## Unreleased
+
+## v0.2.521 — 2026-09-20
+
+### Changed
+
+- Began the production-hardening roadmap with an immutable release-identity
+  preflight, same-commit reusable workflows, and task-scoped GitHub
+  authentication instead of a globally inherited token.
+- Promoted the verified, release-pinned installation path and tightened the
+  npm bootstrap artifact contract.
+- Added pure theme plans plus serialized, journaled theme transactions with
+  pre-apply validation and automatic file/symlink rollback on required
+  failures.
+- Hardened AI CLI theme adapters with typed outcomes, malformed-config
+  preservation, compare-before-commit writes, and global/per-provider opt-outs.
+- Added an independently versioned palette audit covering truecolor, xterm-256,
+  focus/selection contrast, perceptual separation, and color-vision simulation
+  across all 228 themes; stabilized semantic status colors in both modes.
+
+## v0.2.520 — 2026-09-13
+
+### Added
+
+- `docs/guides/MACOS_ICLOUD_SYMLINKS.md`, documenting what the hook does, the
+  cases it refuses, and how to resolve each one by hand.
+- A safety regression suite and a unit suite for the hook, covering the refusal
+  paths that the destructive version never had.
+- Performance budgets for the shell startup path, with the budget table and its
+  rationale in `docs/operations/PERFORMANCE_BUDGETS.md`.
+- A gate-integrity regression test asserting that the safety checks cannot be
+  disabled without a test failing.
+- `dot mcp serve` — a real stdio Model Context Protocol server, where the
+  published card had previously described one that did not exist. Full
+  lifecycle with version negotiation across three protocol revisions,
+  `tools/list`, `tools/call`, resources and logging, with proper JSON-RPC
+  error objects. All four tools are read-only and run from closed argument
+  vectors without a shell; the mutating operations are deliberately
+  unreachable. Go, standard library only.
+- A feature matrix covering every routable command, flag, environment
+  variable and config key, each row naming the regression test, benchmark,
+  example and manual section that covers it. The gate fails when a command
+  gains no row, or when a row names a test or example that does not exist,
+  so coverage cannot be claimed in the table without being written.
+- `dot attest --verify` (`--json|-j`, `--max-age|-a`): checks a workstation
+  evidence record against the attestation policy by running `lib/wasm-tools`
+  as WebAssembly under `wasmtime`. The module gets stdin, stdout and a clock
+  and nothing else — no filesystem, no network, no environment — so the
+  verdict does not depend on the tools installed on the machine under review.
+  Eleven checks cover evidence freshness, the required identity fields, the
+  git signing configuration, the agent profile and MCP health.
+- `scripts/diagnostics/attest-verify.sh`, the caller behind that flag: it
+  resolves the module and the runtime, builds the module on demand when a
+  Rust toolchain is present, and forwards an evidence file, a pipe, or a
+  fresh `dot attest --json`.
+- `dot-sys` gained a real `wasm32-wasip1` target, a general JSON reader
+  (`dot_sys::json`), an RFC 3339 UTC parser (`dot_sys::time`), the policy
+  itself (`dot_sys::attest`), a `verify` subcommand, `--help` and
+  `--version`, two more fuzz targets (`fuzz_json`, `fuzz_verify`), a fourth
+  example, a second benchmark suite, and `tests/wasm.rs`, which executes the
+  built module in a runtime rather than merely inspecting the artefact.
+- `rust.yml` gained a `wasm` job: clippy for the target, a build, an
+  execution assertion, the WebAssembly integration tests, the shell caller's
+  test, and the `.wasm` uploaded as an artefact.
+
+### Changed
+
+- Bash line coverage went from 59% to **98.14%**. Roughly half of that came
+  from fixing the measurement rather than adding tests: untraceable lines sat
+  in the denominator, 540 of 706 test files discarded their traces through
+  `2>&1`, silent timeout kills were counted as passes, and the sweep's `PS4`
+  truncated at 100 characters so the figure depended on how long your checkout
+  path was. Correcting those alone moved it 59.36% to 72.29% with no new test
+  written. Both Go modules are at 100%, where fuzzing found four defects.
+- The terminal palette now takes more than one colour from the wallpaper.
+  `term.bg` had two distinct values across all 228 themes; it now has 36, and
+  the status bar carries a secondary and tertiary alongside the accent. The
+  background is *tinted* rather than replaced — lightness is unchanged, so the
+  low-eye-strain surface the engine was built around is preserved, and
+  `DOTFILES_TERM_TINT=0` restores the flat neutrals.
+- Rust is no longer managed by mise. Its plugin exports `RUSTUP_TOOLCHAIN`,
+  which silently overrides `rust-toolchain.toml` in every project — a
+  repository pinned to 1.98.0 was being built with 1.97.1, and a local "all
+  green" said nothing about CI. rustup governs instead, so each project's own
+  pin is honoured.
+- `~/.cargo/config.toml` no longer sets a global `target-dir`. Cargo takes an
+  exclusive lock on it, so every repository sharing one path serialised: a
+  build in one project blocked `cargo test` in another, and cargo prints
+  nothing while it waits, so it read as a hang. sccache recovers the shared
+  dependency cache without the lock.
+- mise's tool directories are promoted above Homebrew and the shims on `PATH`,
+  fused into the existing dedup pass rather than added as a second walk.
+
+### Fixed
+
+- AI provider dispatch now uses the installed CLIs' prompt modes; OpenCode
+  installs through its native mise backend. Noninteractive status checks no
+  longer open terminal pickers. Reviewed upstream installer checksums are refreshed.
+- Ollama prompts and interactive chat default to `qwen3.5:4b`; set
+  `DOTFILES_OLLAMA_MODEL` to select another downloaded model.
+- Neovim configures the current Treesitter and mason-lspconfig APIs, preserves
+  custom debugger configurations, and uses Mason's Python debug adapter.
+- Health checks recognize named SSH key pairs and the configured age identity;
+  doctor includes Codex and reports absent optional AI providers as information.
+- Homebrew's rustup is available in the shared shell and Fish paths. Go uses
+  its system temporary directory instead of a potentially missing custom directory.
+- Terminal test fixtures explicitly control `NO_COLOR`.
+
+- `dot doctor`, `dot health`, `dot fleet`, the scorecard and the drift dashboard
+  no longer report permanent drift on macOS. The iCloud symlink hook is a
+  `run_before_` script that chezmoi lists as pending on every apply by design,
+  which made plain `chezmoi verify` exit 1 and every `chezmoi status` line
+  count read 1 on a fully synchronised machine. Those callers now pass
+  `--exclude=always`; files, directories, symlinks and `run_once`/`run_onchange`
+  scripts still count as drift.
+- markdown-preview.nvim no longer blocks `dot upgrade`'s plugin sync. Its build
+  step ran `cd app && npm install`, which rewrote the upstream `app/yarn.lock`
+  on every build and left the checkout dirty, so Lazy refused to update it.
+  The spec now uses upstream's `mkdp#util#install`, which downloads the
+  prebuilt preview server and leaves the checkout untouched.
+
+- Replaced the destructive mechanism behind the macOS iCloud symlink hook. The
+  previous implementation could remove real content from `~/Documents` and
+  `~/Desktop`; the replacement only ever removes an empty directory, refuses to
+  act on a non-empty one, and leaves an existing correct symlink untouched.
+- Reported what it declined to do, and why, instead of failing silently.
+- The health-probe record no longer claims `"engine": "wasm"` when it was
+  produced by a host binary. `ENGINE` is now `cfg`-selected, so the field
+  states where the bytes were actually computed: `wasm` from the module,
+  `native` from the host build. This is what makes the field evidence rather
+  than a label, and both halves are asserted in CI.
+- Corrected the documentation that described `lib/wasm-tools` as vendored
+  third-party tooling or as "not actually WebAssembly": `docs/ECOSYSTEM.md`,
+  `docs/architecture/REPO_LAYOUT.md`, `docs/STRUCTURE.md`,
+  `docs/ARCHITECTURE.md`, `docs/reference/TOOLS.md` and `REUSE.toml`.
+- `workbench.colorTheme` had been commented out on every machine this was
+  ever applied to. A template newline was chomped, welding the setting onto
+  the comment above it. Two thirds of the theme labels also named themes no
+  extension registers — "Tokyonight Mocha" and "Everforest Latte", where
+  Mocha and Latte are Catppuccin flavours rather than a general dark/light
+  suffix. The editor is now pinned to Catppuccin, and the icon theme ids are
+  the ones the extension actually declares.
+- Twelve documented defects, each with a regression test proven to fail
+  against the unfixed code first: `dot theme set` aborting before its picker,
+  `dot fleet namespace set` reporting success while writing nothing,
+  `dot agent delegate` requiring a GNU `timeout` absent from stock macOS, a
+  registry cache keyed by path so changing the URL served a stale index for
+  six hours, and `dot doctor --audit` routing to a script not in the tree.
+  Two of the reported findings turned out to be wrong, and correcting them
+  was more useful than fixing them.
+- `chezmoi apply` no longer silently discards edits made directly in `$HOME`.
+  Local drift is captured into the source instead of overwritten.
+- macOS home folders (`~/Desktop`, `~/Documents`, `~/Public` and the rest) are
+  excluded from chezmoi management entirely, as a second layer beneath the
+  iCloud hook's own refusals.
+- `docs-coverage.sh` and `traceability-coverage.sh` stopped masking their own
+  exit codes, so a failing gate now fails.
+- `dot benchmark` is routed. Every layer but the router already had it.
+- `dot upgrade` no longer hangs on a question nobody can see. Each phase's
+  output is captured to a log, so when `chezmoi update` met a locally edited
+  managed file it asked "has changed since chezmoi last wrote it?" on the
+  terminal's tty while the run looked merely slow. The step runner now closes
+  stdin and passes `--no-tty`, so the prompt fails fast, the step is marked
+  failed, and the surfaced tail names the fix (`chezmoi apply` to choose per
+  file, or `chezmoi update --force`).
+- `dot upgrade`'s Neovim phase actually syncs plugins. `nvim -l` does not
+  load `init.lua`, so `scripts/nvim/headless-upgrade.lua` never found
+  lazy.nvim and logged "skipping plugin update" on every run. The phase now
+  passes `-u` with the user's `init.lua` (honouring `XDG_CONFIG_HOME` and
+  `NVIM_APPNAME`) ahead of `-l`, and reports a visible skip when there is no
+  config to load.
+- `dot doctor` no longer warns about a missing `cargo-install-update` on a
+  machine that has no `cargo` for it to run through; the check now reports
+  "not needed" there and keeps warning where a Rust toolchain is present.
+
 ## v0.2.519 — 2026-08-13
 
+### Added
+
+- Implemented the Model Context Protocol server the discovery card has always
+  advertised. `dot mcp serve` now speaks JSON-RPC 2.0 over newline-delimited
+  frames on stdin/stdout: `initialize`, `initialized`, `ping`, `tools/list`,
+  `tools/call`, `resources/list`, `resources/read`,
+  `resources/templates/list`, `logging/setLevel`, and a clean shutdown on EOF.
+  It is a third Go module, `defaults/dot_local/share/dot-mcp`, deployed to
+  `~/.local/bin/dot-mcp`.
+- Served four read-only tools — `mcp-doctor`, `agent-mode`,
+  `workstation-attestation` and `fleet-status` — each a fixed `dot` argument
+  vector run without a shell, and five read-only resources covering the MCP
+  policy, the MCP registry, the agent profiles and both discovery cards.
+  Mutating paths are deliberately not exposed.
+
+### Changed
+
+- Corrected `.well-known/mcp/server-card.json` to describe the server that now
+  exists: the stdio transport is `dot mcp serve` rather than the one-shot
+  `dot mcp --strict --json` audit, and the declared tools, resources and
+  capabilities are pinned to the running registry by tests that fail in both
+  directions. `entrypoints.mcp` in the A2A card was updated to match.
+
 ### Fixed
 
 - Rendered the Nerd Font check as a chezmoi template so its verified-download
@@ -297,9 +495,11 @@ headers across the source tree.
   to `batcat`/`fdfind`; a missing apt/dnf/pacman warns loudly instead of silently
   installing nothing; WSL gets a best-effort `wslu` install for `wslview`. fish
   and nushell now export `EDITOR`/`VISUAL`/`PAGER` to match the zsh/bash profile.
+<!-- REUSE-IgnoreStart -->
 - **Licensing:** added `SPDX-License-Identifier: MIT` headers (SPDX-first / REUSE
   form) and normalized the copyright line to `Sebastien Rousseau` across 831
   repo-only source files; dropped the contradictory `All rights reserved.`.
+<!-- REUSE-IgnoreEnd -->
 - **README** — fixed the OpenSSF Best Practices badge (was linking to the
   new-project form with a static label; now the live `cii/percentage/12840`
   endpoint linked to the real project).

package/LICENSE-APACHE

@@ -0,0 +1,190 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to the Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2026 Sebastien Rousseau
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/{LICENSE → LICENSE-MIT}

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2015-2026 Sebastien Rousseau
+Copyright (c) 2026 Sebastien Rousseau
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal