@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/install.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
 # Usage: gh repo clone sebastienrousseau/dotfiles && cd dotfiles && ./install.sh
@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.519)
+  version       The version (tag or branch) to install (default: v0.2.521)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.519"
+  local version="v0.2.521"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.519)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.521)."
         fi
         version="$arg"
         version_set=1
@@ -196,6 +196,68 @@ main() {
     fi
   }
 
+  # Standalone checksum-verified chezmoi bootstrap. Keep this implementation
+  # in the entry point so a release-pinned install.sh remains self-contained;
+  # repository and npm installs may use the identical helper script below.
+  install_chezmoi_verified_embedded() {
+    local chezmoi_version="$1"
+    local destination="$2"
+    local os arch asset checksums_asset base_url temp_dir checksum_line
+
+    os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+    arch="$(uname -m)"
+    case "$os" in
+      linux | darwin) ;;
+      *)
+        echo "Unsupported OS for chezmoi bootstrap: $os" >&2
+        return 1
+        ;;
+    esac
+    case "$arch" in
+      x86_64 | amd64) arch="amd64" ;;
+      arm64 | aarch64) arch="arm64" ;;
+      *)
+        echo "Unsupported architecture for chezmoi bootstrap: $arch" >&2
+        return 1
+        ;;
+    esac
+
+    asset="chezmoi_${chezmoi_version}_${os}_${arch}.tar.gz"
+    checksums_asset="chezmoi_${chezmoi_version}_checksums.txt"
+    base_url="https://github.com/twpayne/chezmoi/releases/download/v${chezmoi_version}"
+    temp_dir="$(umask 077 && mktemp -d)"
+
+    if ! (
+      set -e
+      if ! curl --proto '=https' --tlsv1.2 -fsSL \
+        -o "$temp_dir/checksums.txt" "$base_url/$checksums_asset"; then
+        curl --proto '=https' --tlsv1.2 -fsSL \
+          -o "$temp_dir/checksums.txt" "$base_url/checksums.txt"
+      fi
+      curl --proto '=https' --tlsv1.2 -fsSL \
+        -o "$temp_dir/$asset" "$base_url/$asset"
+      checksum_line="$(grep -E "[[:space:]]${asset}$" "$temp_dir/checksums.txt" | head -n 1 || true)"
+      [[ -n "$checksum_line" ]] || {
+        echo "Checksum entry not found for $asset" >&2
+        exit 1
+      }
+      cd "$temp_dir"
+      if command -v sha256sum >/dev/null 2>&1; then
+        printf '%s\n' "$checksum_line" | sha256sum -c -
+      else
+        printf '%s\n' "$checksum_line" | shasum -a 256 -c -
+      fi
+      tar -xzf "$asset" chezmoi
+      mkdir -p "$destination"
+      install -m 755 chezmoi "$destination/chezmoi"
+    ); then
+      rm -rf "$temp_dir"
+      return 1
+    fi
+
+    rm -rf "$temp_dir"
+  }
+
   # 3. Install Chezmoi (in parallel with other checks where possible)
   install_chezmoi() {
     if command -v chezmoi >/dev/null; then
@@ -231,11 +293,15 @@ main() {
         fi
         return 0
       fi
-      echo "" >&2
-      echo "   tools/ci/install-chezmoi-verified.sh is missing; cannot verify chezmoi bootstrap." >&2
-      echo "   Install chezmoi manually (brew install chezmoi / official binary)" >&2
-      echo "   and re-run install.sh." >&2
-      return 1
+      echo "   Using embedded checksum verifier..."
+      if ! install_chezmoi_verified_embedded "${CHEZMOI_VERSION:-2.47.1}" "$bin_dir"; then
+        echo "" >&2
+        echo "   The embedded checksum-verified chezmoi bootstrap failed." >&2
+        echo "   Refusing to fall back to an unverified remote script." >&2
+        echo "   Install chezmoi manually from https://www.chezmoi.io/install/" >&2
+        return 1
+      fi
+      return 0
     fi
   }
 
@@ -369,7 +435,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.519 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.521 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +444,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.519 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.521 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.519",
+  "version": "0.2.521",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {
     "dotfiles-install": "./install.sh"
   },
   "scripts": {
+    "prepack": "node scripts/qa/verify-npm-package.mjs",
     "test": "bash ./scripts/qa/reliability-audit.sh",
     "test:quick": "bash ./scripts/qa/reliability-audit.sh --quick",
     "test:unit": "bash ./scripts/qa/reliability-audit.sh --unit-only",
@@ -48,7 +49,7 @@
     "email": "sebastienrousseau@users.noreply.github.com",
     "url": "https://sebastienrousseau.com"
   },
-  "license": "MIT",
+  "license": "Apache-2.0 OR MIT",
   "bugs": {
     "url": "https://github.com/sebastienrousseau/dotfiles/issues"
   },
@@ -66,13 +67,12 @@
   },
   "files": [
     "install.sh",
+    "tools/ci/install-chezmoi-verified.sh",
+    "tools/README.md",
     "README.md",
-    "LICENSE",
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
     "CHANGELOG.md",
-    "docs/",
-    "dot_config/",
-    "dot_local/",
-    "scripts/",
-    "templates/"
+    "package.json"
   ]
 }

package/tools/README.md

@@ -0,0 +1,49 @@
+# `tools/` — Repo-Only Operations
+
+Everything in this directory is **internal to the repo** — CI helpers,
+release tooling, documentation generators, maintenance jobs. Nothing
+here ships to end users; the `dot` CLI doesn't dispatch to anything
+under `tools/`.
+
+Per the v0.2.503 reorg (`docs/operations/RFC_v0_2_503_reorganization.md`
+Phase 5), this directory holds what used to live under
+`scripts/{ci,release,maintenance,docs}/`. The split clarifies which
+scripts a downstream distro packager needs to ship (`scripts/` +
+`lib/` + `bin/`) versus which only run in this repo's own CI
+(`tools/`).
+
+## Subtree map
+
+| Path | Purpose | Touched by |
+|---|---|---|
+| `tools/ci/` | CI-only helpers. `dot-cli-startup-bench.sh`, `install-chezmoi-verified.sh`, `windows-smoke-test.ps1`, `run-coverage.sh`, etc. | `.github/workflows/*` |
+| `tools/release/` | Release-time tasks. | Release workflow + `gh release create` flow |
+| `tools/maintenance/` | Recurring upkeep: `check-updates.sh`, etc. | Cron, manual |
+| `tools/docs/` | Documentation-generation helpers: `generate-command-index.sh`, manual builds, screenshot capture. | `manual-publish.yml`, `dot manual`, doc-drift |
+
+## Why this directory exists
+
+The R4 audit (`docs/operations/HARD_AUDIT_2026.md` §8.3 P4) flagged
+the framework / repo-ops intermingling under `scripts/` as a
+contributor-onboarding cost. New contributors couldn't tell:
+
+> "Is `scripts/ci/install-chezmoi-verified.sh` part of the CLI, or
+> is it just a CI helper?"
+
+Splitting them physically answers the question without anyone
+having to grep. `scripts/` is now exclusively the runtime-invoked
+surface; `tools/` is exclusively repo-internal.
+
+## Conventions
+
+Same as `scripts/`:
+
+- Shell style: 2-space indent, `set -euo pipefail`, shellcheck-clean.
+- Format with `shfmt -i 2 -ci`.
+- Source `lib/dot/ui.sh` for output (no raw `printf`).
+
+## See also
+
+- `../docs/STRUCTURE.md` — top-level repo map.
+- `scripts/README.md` — the runtime-invoked sister tree.
+- `docs/operations/RFC_v0_2_503_reorganization.md` — Phase 5 spec.

package/tools/ci/install-chezmoi-verified.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+# Install a pinned Chezmoi release with checksum verification.
+set -euo pipefail
+
+VERSION="${1:-}"
+BIN_DIR="${2:-$HOME/.local/bin}"
+
+if [[ -z "$VERSION" ]]; then
+  echo "Usage: $0 <chezmoi-version> [bin-dir]" >&2
+  exit 1
+fi
+
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+
+case "$OS" in
+  linux | darwin) ;;
+  *)
+    echo "Unsupported OS: $OS" >&2
+    exit 1
+    ;;
+esac
+
+case "$ARCH" in
+  x86_64 | amd64) ARCH="amd64" ;;
+  arm64 | aarch64) ARCH="arm64" ;;
+  *)
+    # chezmoi ships amd64 + arm64 builds only. Other architectures
+    # (ppc64le, s390x, riscv64, armv7) would need a source build.
+    echo "Unsupported architecture: $ARCH (only x86_64/amd64 and arm64/aarch64 are supported)" >&2
+    echo "See https://github.com/twpayne/chezmoi/releases for the full asset list." >&2
+    exit 1
+    ;;
+esac
+
+ASSET="chezmoi_${VERSION}_${OS}_${ARCH}.tar.gz"
+CHECKSUMS_ASSET="chezmoi_${VERSION}_checksums.txt"
+BASE_URL="https://github.com/twpayne/chezmoi/releases/download/v${VERSION}"
+
+TMP_DIR="$(umask 077 && mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Support both old and new checksum filenames.
+if ! curl --proto '=https' --tlsv1.2 -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/$CHECKSUMS_ASSET"; then
+  curl --proto '=https' --tlsv1.2 -fsSL -o "$TMP_DIR/checksums.txt" "$BASE_URL/checksums.txt"
+fi
+curl --proto '=https' --tlsv1.2 -fsSL -o "$TMP_DIR/$ASSET" "$BASE_URL/$ASSET"
+
+CHECKSUM_LINE="$(grep -E "[[:space:]]${ASSET}$" "$TMP_DIR/checksums.txt" | head -n1 || true)"
+if [[ -z "$CHECKSUM_LINE" ]]; then
+  echo "Checksum entry not found for $ASSET" >&2
+  exit 1
+fi
+
+(
+  cd "$TMP_DIR"
+  if command -v sha256sum >/dev/null 2>&1; then
+    echo "$CHECKSUM_LINE" | sha256sum -c -
+  else
+    echo "$CHECKSUM_LINE" | shasum -a 256 -c -
+  fi
+)
+
+tar -xzf "$TMP_DIR/$ASSET" -C "$TMP_DIR" chezmoi
+mkdir -p "$BIN_DIR"
+install -m 755 "$TMP_DIR/chezmoi" "$BIN_DIR/chezmoi"

package/docs/.vitepress/reports/localization-readability-audit.md

@@ -1,73 +0,0 @@
----
-render_with_liquid: false
----
-
-# Localization Readability Audit
-
-Note: Flesch metrics are English-centric. For localized pages, they are used as a plain-language proxy when Latin word boundaries are available.
-
-## Readability Scorecard
-
-| Language | Reading Ease | Grade Level | Passive % | Avg Sentence Length |
-| :--- | ---: | ---: | ---: | ---: |
-| ar | n/a | n/a | n/a | n/a |
-| de | n/a | n/a | n/a | n/a |
-| es | n/a | n/a | n/a | n/a |
-| fr | n/a | n/a | n/a | n/a |
-| he | n/a | n/a | n/a | n/a |
-| hi | n/a | n/a | n/a | n/a |
-| id | n/a | n/a | n/a | n/a |
-| it | n/a | n/a | n/a | n/a |
-| ja | n/a | n/a | n/a | n/a |
-| ko | n/a | n/a | n/a | n/a |
-| nl | n/a | n/a | n/a | n/a |
-| pl | n/a | n/a | n/a | n/a |
-| pt | n/a | n/a | n/a | n/a |
-| ro | n/a | n/a | n/a | n/a |
-| ru | n/a | n/a | n/a | n/a |
-| th | n/a | n/a | n/a | n/a |
-| tr | n/a | n/a | n/a | n/a |
-| uk | n/a | n/a | n/a | n/a |
-| vi | n/a | n/a | n/a | n/a |
-| zh | n/a | n/a | n/a | n/a |
-| zh-tw | n/a | n/a | n/a | n/a |
-
-## Parity Gap Table
-
-| Priority | Locale | Route | Deviation |
-| :--- | :--- | :--- | :--- |
-
-## Active & Simple Diff
-
-### docs/adr/ADR-007-multi-shell-parity.md
-
-- Source: **Nushell spoke:** Hybrid approach: - Aliases: Runtime bash extraction cached to (in ), sourced by - Functions: Chezmoi template-generated wrappers delegating to bash (in ) **Parity tiers:** - **Tier 1 (Full):** Zsh, Bash — all aliases, functions, lazy loading, cached eval - **Tier 2 (Bridged):** Fish — all simple aliases, all functions via wrappers, caching - **Tier 3 (Compatible):** Nushell — simple aliases (no complex bash syntax), all functions via bash delegation - Single source of truth for aliases and functions - Adding a new alias/function automatically propagates to all shells - Nushell users get access to 40+ functions that were previously unavailable - Fish users get mtime-aware caching via - Complex bash aliases (pipes, conditionals) are skipped for Nushell - Function calls in Fish/Nushell incur bash subprocess overhead (~5ms per call) - Cache invalidation requires shell restart or manual cache clear - Nushell's rapid development may break bridge syntax in future versions - Very large alias sets may slow Nushell startup during cache generation.
-- Simplified: **Nushell spoke:** Hybrid approach: - Aliases: Runtime bash extraction cached to (in ), sourced by - Functions: Chezmoi template-generated wrappers delegating to bash (in ) **Parity tiers:** - **Tier 1 (Full):** Zsh, Bash — all aliases, functions, lazy loading, cached eval - **Tier 2 (Bridged):** Fish — all simple aliases, all functions via wrappers, caching - **Tier 3 (Compatible):** Nushell — simple aliases (no complex bash syntax), all functions via bash delegation - Single source of truth for aliases and functions -. Adding a new alias/function automatically propagates to all shells - Nushell users get access to 40+ functions that were previously unavailable - Fish users get mtime-aware caching via - Complex bash aliases (pipes, conditionals) are skipped for Nushell - Function calls in Fish/Nushell incur bash subprocess overhead (~5ms per call) - Cache invalidation requires shell restart or manual cache clear - Nushell's rapid development may break bridge syntax in future versions - Very large alias sets may slow Nushell startup during cache generation
-
-### docs/guides/TROUBLESHOOTING.md
-
-- Source: ) **Problem:** LSP not working - Install required language servers - Check for status - Review for errors **Problem:** Git aliases not working - Check if Git config is applied: - Re-apply dotfiles: **Problem:** Delta (diff pager) not showing colors - Verify is installed - Confirm your terminal supports 256 colors **Problem:** kubectl context issues - List contexts: - Switch context: - Check kubeconfig: **Problem:** Minikube won't start - Verify Docker is running - Try: - Check logs: **Problem:** High memory usage - Look for runaway processes: or - Review shell history size in atuin config - Disable unused plugins **Problem:** Nix isn't installed or commands not found - Ensure you have followed the installation guide: - On Linux, you might need to enable experimental features in : - Verify the daemon is running: **Problem:** Systemd isn't available (mostly WSL2) - Dotfiles functions that rely on systemd (like management) will fallback to direct execution.
-- Simplified: ) **Problem:** LSP not working - Install required language servers - Check for status - Review for errors **Problem:** Git aliases not working - Check if Git config is applied: - Re-apply dotfiles: **Problem:** Delta (diff pager) not showing colors - Verify is installed - Confirm your terminal supports 256 colors **Problem:** kubectl context issues - List contexts: - Switch context: - Check kubeconfig: **Problem:** Minikube won't start - Verify Docker is running - Try: - Check. logs: **Problem:** High memory usage - Look for runaway processes: or - Review shell history size in atuin config - Disable unused plugins **Problem:** Nix isn't installed or commands not found - Ensure you have followed the installation guide: - On Linux, you might need to enable experimental features in : - Verify the daemon is running: **Problem:** Systemd isn't available (mostly WSL2) - Dotfiles functions that rely on systemd (like management) will fallback to direct execution
-
-### docs/operations/VERSION_SYNC.md
-
-- Source: sh --verify || echo "Version drift detected" The GitHub Actions workflow provides metrics: - Files scanned - Files updated - Verification status - Processing time - Local backups in - GitHub Actions artifacts (30-day retention) - Git history for rollback permissions: contents: write # Required for commits pull-requests: write # Required for PR comments - Version format validation ( pattern) - File path validation (no directory traversal) - Change verification before commit - All changes logged in Git history - GitHub Actions run history - Backup preservation - Git operations use shallow fetch when possible - Pattern compilation cached - File discovery optimized with - File processing is sequential but optimized - Git operations batched - Verification runs concurrently with updates - Typical run time: 30-60 seconds - Memory usage: <100MB - Network usage: Minimal (only Git operations) 1.
-- Simplified: sh --verify || echo "Version drift detected" The GitHub Actions workflow provides metrics: - Files scanned - Files updated - Verification status - Processing time - Local backups in - GitHub Actions artifacts (30-day retention) - Git history for rollback permissions: contents: write # Required for commits pull-requests: write # Required for PR comments - Version format validation ( pattern) - File path validation (no directory traversal) - Change. verification before commit - All changes logged in Git history - GitHub Actions run history - Backup preservation - Git operations use shallow fetch when possible - Pattern compilation cached - File discovery optimized with - File processing is sequential but optimized - Git operations batched - Verification runs concurrently with updates - Typical run time: 30-60 seconds - Memory usage: <100MB - Network usage: Minimal (only Git operations) 1
-
-## Localized Terminology Glossary
-
-| Term | Rule |
-| :--- | :--- |
-| macOS | Keep official Apple spelling in all locales. |
-| Linux | Keep as Linux. |
-| WSL | Keep as WSL on first use. |
-| Chezmoi | Keep product name in English. |
-| `dot doctor` | Keep command unchanged in all locales. |
-| shell | Localize only in prose; never inside commands or paths. |
-| alias | Localize in prose when natural; keep code examples unchanged. |
-
-## Priority Action Register
-
-- [P0] Meaning Drifts: 0
-- [P1] Readability Blockers: 0
-- [P2] Stylistic Polishing: 0

package/docs/AI.md

@@ -1,179 +0,0 @@
----
-render_with_liquid: false
----
-
-# AI Integrations (Opt-in)
-
-AI helpers are **off by default**. You choose if and when to turn them on.
-
-```bash
-export DOTFILES_AI=1
-exec zsh
-```
-
-This enables the local helper scripts and the `dot ai` command surface. It does **not** install any AI tools or run any background service.
-
-## Why `dot ai`?
-
-`claude` is one tool. **`dot ai` is the cockpit for your whole AI-CLI fleet.** Use it to install the tools, launch any of them with one keystroke, meter their cost in one place, and — the headline — run every one of them on your single Claude subscription through a built-in local gateway.
-
-You use `claude` to talk to Claude. You use `dot ai` to run *everything else* on Claude and keep one cockpit over all of it.
-
-## Quick start
-
-```bash
-dot ai install all        # install the fleet (only what's missing)
-dot ai                    # open the cockpit (TUI)
-dot ai "fix the auth bug" # one-shot on Claude — just like `claude "…"`
-dot ai serve              # serve your Claude subscription locally to the fleet
-```
-
-## Command surface
-
-The interface is flat and verb-first, modelled on the Claude CLI: bare opens an interactive view, a prompt runs it, and old commands keep working as deprecated aliases.
-
-| Command | What it does |
-|---------|--------------|
-| `dot ai` | Open the **cockpit** — a Bubble Tea TUI for the fleet, gateway, and cost |
-| `dot ai "<prompt>"` | One-shot prompt on Claude |
-| `dot ai <tool> "<prompt>"` | One-shot prompt on a named tool (e.g. `dot ai codex "add tests"`) |
-| `dot ai chat [tool]` | Open an interactive session (picker if no tool) |
-| `dot ai tools` | Install / manage the fleet |
-| `dot ai install [all\|<tool>]` | Install all missing tools, or one |
-| `dot ai serve [stop\|status]` | Start the local Claude gateway **and** route the fleet through it |
-| `dot ai cost` | Spend report across providers |
-| `dot ai login [tool]` | Authenticate a tool |
-| `dot ai doctor` | Health-check the fleet and the gateway |
-| `--style <name>` | Steer any prompt with a pattern (see [Steering styles](#steering-styles)) |
-
-## The cockpit (`dot ai`)
-
-Running `dot ai` on a terminal opens a glamorous, chat-centric TUI (built with [Bubble Tea](https://github.com/charmbracelet/bubbletea), Charm/Crush-style):
-
-- **Header** — the `◆ dot ai` wordmark plus gateway status (`● :3456` / `○ off`) and today's cost as colour chips.
-- **Left** — the fleet grouped by role, with `●`/`○` install markers and a `▌` selection accent.
-- **Right** — a **chat panel**: pick a tool, type a prompt in the input box, press `Enter`, and the response streams back in the transcript — all without leaving the TUI.
-
-```text
-Tab focus   ↑↓ move   ⏎ send   s serve   i install   c refresh   q quit
-```
-
-Two modes per tool: **Enter on the fleet** opens the tool's *full native session* (where its own `/exit`, `/model`, `/clear`, … work); **Tab / `/`** drops into the quick in-cockpit streaming chat. In the chat input, typing `/` opens a **tool-aware command palette** — the cockpit commands (`/help /clear /style /tool /serve /cost /exit`, which run in-chat) plus the selected provider's common REPL commands (`/compact /model /resume /agents` for claude; `/add /diff /commit` for aider; `/approvals /status` for codex; …), tagged `→ <tool> session`. Navigate with `↑↓`, `Tab` to complete, `Enter` to run. Prompts run through `dot ai <tool>`, so the cockpit and the command line behave identically.
-
-The cockpit also offers a **model picker** (`/model <name>` or the `m` key cycles `default → opus → sonnet → haiku`; the active model shows in the header and is applied to the Claude engine via `ANTHROPIC_MODEL`), **session persistence** (each completed turn is saved to `$XDG_STATE_HOME/dot-ai-tui/session.json`; `/resume` restores your last conversation, `/save` snapshots the current one), and **desktop notifications** when a reply takes longer than ~8s (macOS `osascript` / Linux `notify-send`). In non-interactive contexts (CI, pipes) `dot ai` falls back to a plain text fleet listing. The cockpit binary (`dot-ai-tui`) is built on `chezmoi apply` via the mise-managed Go toolchain; `DOT_AI_SNAPSHOT=1 dot-ai-tui` prints a single frame for previews.
-
-## Steering styles
-
-Styles in `~/.dotfiles/dot_config/ai/patterns/` add focused context to any prompt with `--style <name>`:
-
-- **architect** — shell setup and stack tuning
-- **hardener** — security, encryption, and compliance
-- **refactor** — POSIX compatibility, performance, and linting
-
-```bash
-dot ai claude --style architect "optimize my zshrc"
-dot ai agy --style hardener "audit my ssh config"
-```
-
-The bridge also injects system details (OS, architecture, date) so the model has the context it needs. Quick aliases ship for the common combinations: `dcla` (Claude + architect), `dagyh` (Antigravity + hardener), `dkir` (Kiro + refactor).
-
-## Running tools
-
-```bash
-dot ai "explain this stack trace"     # one-shot on Claude
-dot ai codex "add a test for parse()" # one-shot on a specific tool
-dot ai chat                            # pick a tool and open its session
-dot ai chat aider                      # open aider directly
-```
-
-## The local Claude gateway (`dot ai serve`)
-
-Run one Claude subscription locally and point your whole fleet at it — with **no third-party dependency**. `dot-ai-serve` is a small, stdlib-only Python server (no pip packages) that wraps the `claude` CLI you already have and exposes the standard Anthropic (`/v1/messages`) **and** OpenAI (`/v1/chat/completions`) endpoints. Any tool that speaks either protocol — codex, aider, Open WebUI, an OpenAI SDK — connects to `http://127.0.0.1:3456` and gets Claude on your existing subscription.
-
-```bash
-claude login              # one-time: authenticate the engine
-dot ai serve              # start the gateway AND route the non-Claude fleet
-dot ai serve status       # process + /health + routing state
-dot ai serve stop         # stop the gateway and un-route
-```
-
-**Native session, never a key.** The gateway authenticates through your `claude` CLI's native session — there is no API key anywhere. Routing is applied **per-invocation** to non-Claude tools (`dot ai codex "…"`); it is **not** sourced into your interactive shell. The primary `claude` is never routed — it always uses its own native session, so claude.ai connectors stay enabled. (Setting `ANTHROPIC_API_KEY` in your shell would disable those connectors, which is exactly why routing stays scoped to each tool's subprocess.)
-
-**Streaming, routing & metering.** Replies stream **token-by-token** (real SSE for both protocols). Model **aliases/routing** map friendly names to a Claude tier — `cheap`/`fast` → haiku, `smart` → opus, and common OpenAI ids (`gpt-4` → sonnet, `gpt-3.5-turbo` → haiku); extend with `DOT_AI_MODEL_MAP`. Every request is **metered**: `GET /metrics` (Prometheus text) and `GET /v1/usage` (JSON) report requests, tokens, and estimated cost per model. An optional `DOT_AI_DAILY_BUDGET` (USD) caps daily spend — once reached, requests get `429`.
-
-**Config:** `DOT_AI_HOST` (default `127.0.0.1`), `DOT_AI_PORT` (default `3456`), `DOT_AI_DEFAULT_MODEL` (default `sonnet`), `DOT_AI_API_KEY` (optional shared secret), `DOT_AI_DAILY_BUDGET` (USD, `0` = off), `DOT_AI_MODEL_MAP` / `DOT_AI_PRICING` (JSON overrides).
-
-**Security:** the server binds to loopback by default. If you set `DOT_AI_HOST` to a LAN address, both the launcher *and* the server itself refuse to start unless `DOT_AI_API_KEY` is set — an unprotected network proxy leaks your subscription.
-
-**Engine limits.** The gateway wraps the `claude` CLI (an agent), not the raw API, so two things are handled gracefully rather than forwarded: **image** blocks are acknowledged inline but not sent (the engine is text-only), and **function/tool-calling** requests are answered in plain text (the CLI can't return caller-defined `tool_use` blocks). Session resumption is still out of scope.
-
-## The fleet
-
-These tools are not installed for you. Install what you want with `dot ai install <tool>` (or `dot ai install all`):
-
-- **Agents (autonomous)** — full coding agents that plan and execute:
-  - `claude` — Anthropic's flagship agentic coder (Claude Code)
-  - `codex` — OpenAI's autonomous coding agent
-  - `copilot` — GitHub Copilot in the terminal
-  - `goose` — Block's open-source coding agent
-  - `crush` — Charm's glamorous TUI coding agent
-  - `amp` — Sourcegraph's agentic coder
-  - `cursor-agent` — Cursor's terminal agent
-  - `grok` — xAI's terminal coding agent (Grok Build; needs a SuperGrok / X Premium+ plan)
-  - `kimi` — Moonshot AI's Kimi Code CLI; installed natively to `~/.kimi-code/bin/kimi` and supports native interactive use and one-shot prompts
-
-- **Coding (interactive)** — focused pair-programming assistants:
-  - `aider` — Git-aware AI pair programmer
-  - `opencode` — open-source terminal coding agent
-  - `autohand` — autonomous multi-file coding agent
-  - `vibe` — Mistral's coding agent
-  - `qwen` — Alibaba Qwen coding assistant
-  - `zai` — Zhipu GLM coding agent
-
-- **General (prompt-based)** — quick prompt/shell helpers:
-  - `agy` — Google's Antigravity agent
-  - `sgpt` — ChatGPT for the shell (Shell-GPT)
-
-- **Runtime (local)**:
-  - `ollama` — run local **and** cloud-hosted open models (`ollama signin` for cloud)
-
-- **Cloud (platform)**:
-  - `kiro-cli` — AWS's agentic dev assistant
-
-`dot ai tools` shows install status grouped by role and offers an interactive install picker. Status is cached in `~/.cache/dotfiles/ai/status.tsv` for 5 minutes (tune with `DOTFILES_AI_STATUS_TTL`).
-
-## Run cost and telemetry
-
-Every run through the bridge is logged to a local SQLite database (`~/.local/share/dotfiles-ai.db`). `dot ai cost` reports spend across providers, and the cockpit's cost panel and recent-runs list read from the same log. Token-level cost is populated for providers that surface it (and for everything routed through `dot ai serve`).
-
-## Deprecated commands
-
-The old command shapes still work, but print a one-line hint pointing at the new name. Update your muscle memory when convenient — the shortcut aliases (`dcl`, `dagy`, `dki`, …) already target the new surface.
-
-| Deprecated | Use instead |
-|------------|-------------|
-| `dot cl` | `dot ai claude` |
-| `dot codex` / `dot copilot` / `dot kimi` / `dot agy` / `dot goose` | `dot ai codex` / `dot ai copilot` / `dot ai kimi` / `dot ai agy` / `dot ai goose` |
-| `dot kiro` / `dot sgpt` / `dot ollama` / `dot opencode` | `dot ai kiro` / `dot ai sgpt` / `dot ai ollama` / `dot ai opencode` |
-| `dot aider` / `dot autohand` / `dot vibe` / `dot qwen` / `dot zai` | `dot ai aider` / `dot ai autohand` / `dot ai vibe` / `dot ai qwen` / `dot ai zai` |
-| `dot ai status` | `dot ai tools` |
-| `dot ai dashboard` / `dot ai dash` | `dot ai` (the cockpit) |
-| `dot ai proxy …` / `dot ai local on\|off` | `dot ai serve` |
-| `dot ai-setup` | `dot ai login` |
-| `dot ai-query` | `dot ai ask` |
-| `--pattern <name>` | `--style <name>` |
-
-## Agentic terminal workflows
-
-If your terminal has built-in AI agents, keep your shell lean and fast:
-
-- Use `DOTFILES_FAST=1` or `DOTFILES_ULTRA_FAST=1`.
-- Let the terminal handle agents and its own UI.
-- Keep dotfiles focused on consistency, safety, and clean repeats.
-
-## Privacy and safety
-
-- No AI tools are installed for you.
-- No background services run by default; the gateway runs only while you keep `dot ai serve` up.
-- You control AI helpers with `DOTFILES_AI=1`.
-- The gateway uses your native Claude session — no API keys are stored or required.

package/docs/CNAME

@@ -1 +0,0 @@
-doc.dotfiles.io