@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/scripts/dot/powershell/Dot.psm1

@@ -1,319 +0,0 @@
-# Dot — native PowerShell module for the dotfiles framework.
-#
-# This module provides native PowerShell cmdlets for the daily `dot`
-# workflow. Commands with Unix-specific orchestration remain available
-# through the dispatcher's explicit bash bridge.
-#
-# Loaded by bin/dot.ps1 dispatcher; cmdlets are also callable
-# directly:
-#   Import-Module ./scripts/dot/powershell/Dot.psm1
-#   Get-DotVersion
-#   Invoke-DotHelp
-#   Test-DotAgentsSync -Verbose
-#
-# Tested via tools/ci/windows-smoke-test.ps1.
-
-#requires -Version 7.0
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-# Module-level constants -------------------------------------------------------
-
-$script:RepoRoot = if ($env:DOT_REPO_ROOT) {
-    $env:DOT_REPO_ROOT
-}
-else {
-    # When called from bin/dot.ps1 the dispatcher sets DOT_REPO_ROOT.
-    # When imported directly, infer it from this file's path:
-    #   scripts/dot/powershell/Dot.psm1  →  ../../..
-    (Resolve-Path (Join-Path $PSScriptRoot '..\..\..')).Path
-}
-
-# Post-Phase-4b (v0.2.503) .chezmoidata.toml ships under defaults/.
-# Probe defaults/ first; fall back to legacy root location for older
-# deployments that pre-date the .chezmoiroot activation.
-$script:DataFile = Join-Path $script:RepoRoot 'defaults/.chezmoidata.toml'
-if (-not (Test-Path $script:DataFile)) {
-    $script:DataFile = Join-Path $script:RepoRoot '.chezmoidata.toml'
-}
-
-# Helpers ---------------------------------------------------------------------
-
-function script:Get-DotfilesVersionFromData {
-    if (-not (Test-Path $script:DataFile)) {
-        throw "Cannot read $script:DataFile (set DOT_REPO_ROOT to override)"
-    }
-    $line = Get-Content $script:DataFile |
-        Where-Object { $_ -match '^dotfiles_version\s*=\s*"([^"]+)"' } |
-        Select-Object -First 1
-    if (-not $line) {
-        throw "dotfiles_version not found in $script:DataFile"
-    }
-    if ($line -notmatch '"([^"]+)"') {
-        throw "Could not parse dotfiles_version from line: $line"
-    }
-    return $Matches[1]
-}
-
-function script:Write-DotBanner {
-    param([string]$Section)
-    if ($env:NO_COLOR) {
-        Write-Host "Dot · $Section"
-        return
-    }
-    $esc = [char]27
-    Write-Host "$esc[1;38;5;212mDot · $Section$esc[0m"
-}
-
-function script:Assert-DotCommand {
-    param([Parameter(Mandatory)][string]$Name)
-    if (-not (Get-Command $Name -ErrorAction SilentlyContinue)) {
-        throw "$Name is required but was not found on PATH"
-    }
-}
-
-function script:Invoke-DotNativeCommand {
-    param(
-        [Parameter(Mandatory)][string]$Name,
-        [Parameter(Mandatory)][string[]]$Arguments
-    )
-    Assert-DotCommand -Name $Name
-    & $Name @Arguments
-    if ($LASTEXITCODE -ne 0) {
-        throw "$Name exited with status $LASTEXITCODE"
-    }
-}
-
-# Public cmdlets --------------------------------------------------------------
-
-<#
-.SYNOPSIS
-    Print the dotfiles framework version.
-
-.DESCRIPTION
-    Native PowerShell implementation of `dot version`. Reads the
-    canonical version from .chezmoidata.toml (the single source of
-    truth) — does NOT shell out to bash.
-
-.EXAMPLE
-    Get-DotVersion
-    0.2.503
-
-.EXAMPLE
-    Get-DotVersion -AsObject | ConvertTo-Json
-    {
-      "Version": "0.2.503",
-      "Source": "...\\.chezmoidata.toml",
-      "Native": true
-    }
-#>
-function Get-DotVersion {
-    [CmdletBinding()]
-    param(
-        [switch]$AsObject
-    )
-    $version = Get-DotfilesVersionFromData
-    if ($AsObject) {
-        return [pscustomobject]@{
-            Version = $version
-            Source  = $script:DataFile
-            Native  = $true
-        }
-    }
-    return $version
-}
-
-<#
-.SYNOPSIS
-    Print the dot CLI help overview.
-
-.DESCRIPTION
-    Native PowerShell implementation of `dot help`. Presents the
-    native command surface without shelling out to bash.
-
-    The full Linux-style help (every subcommand grouped by category)
-    requires the bash dispatcher; this cmdlet shows the Windows-
-    native subset.
-#>
-function Invoke-DotHelp {
-    [CmdletBinding()]
-    param()
-    $version = Get-DotfilesVersionFromData
-    Write-DotBanner -Section 'Help'
-    Write-Host ''
-    Write-Host "  Version    v$version"
-    Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
-    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/main/docs/manual/"
-    Write-Host ''
-    Write-Host 'Native PowerShell commands (no bash required):'
-    Write-Host ''
-    Write-Host '  Get-DotVersion              Print framework version'
-    Write-Host '  Invoke-DotHelp              This screen'
-    Write-Host '  Test-DotAgentsSync          Check AGENTS.md against CLAUDE.md'
-    Write-Host '  Get-DotStatus               Show chezmoi drift'
-    Write-Host '  Invoke-DotChezmoi           Run a core chezmoi operation'
-    Write-Host '  Invoke-DotDoctor            Audit the native Windows setup'
-    Write-Host '  Get-DotEnvironment          List mise-managed tools'
-    Write-Host '  Get-DotAgents               List agent harness targets'
-    Write-Host '  Get-DotFleetStatus          Show local fleet node status'
-    Write-Host ''
-    Write-Host 'Bash-bridged subcommands (require bash on PATH):'
-    Write-Host ''
-    Write-Host '  dot env emit                Emit v1 environment manifest'
-    Write-Host '  dot agents render           Re-render every AGENTS.md harness'
-    Write-Host '  dot registry ...            Verified module registry operations'
-    Write-Host ''
-    Write-Host 'See: dot help all (via bash) — full command index'
-}
-
-<#
-.SYNOPSIS
-    Verify that AGENTS.md is in sync with CLAUDE.md.
-
-.DESCRIPTION
-    Native PowerShell implementation of `dot agents check`. Both
-    files share a "Project Overview" paragraph that is the canonical
-    sync surface. If they diverge, AGENTS.md needs re-rendering
-    (run `dot agents render` via bash; native PowerShell render is
-    a separate ticket).
-
-.OUTPUTS
-    [bool] — $true when in sync, $false otherwise.
-
-.EXAMPLE
-    if (-not (Test-DotAgentsSync)) {
-      Write-Warning 'AGENTS.md is stale; run: bash dot_local/bin/executable_dot agents render'
-    }
-#>
-function Test-DotAgentsSync {
-    [CmdletBinding()]
-    [OutputType([bool])]
-    param()
-    $claude = Join-Path $script:RepoRoot 'CLAUDE.md'
-    $agents = Join-Path $script:RepoRoot 'AGENTS.md'
-    foreach ($f in @($claude, $agents)) {
-        if (-not (Test-Path $f)) {
-            Write-Error "missing: $f"
-            return $false
-        }
-    }
-    $claudeBody = Get-Content -Raw $claude
-    $agentsBody = Get-Content -Raw $agents
-    foreach ($name in @('claudeBody', 'agentsBody')) {
-        $value = Get-Variable -Name $name -ValueOnly
-        $value = $value -replace '(?s)^\s*<!--.*?-->\s*', ''
-        $value = $value -replace '(?m)^# (CLAUDE|AGENTS)\.md.*\r?\n', ''
-        $value = $value -replace '(?s)\r?\n---\r?\n\r?\n\*\*Need richer context\?.*$', ''
-        $value = ($value -replace "`r`n", "`n").Trim()
-        Set-Variable -Name $name -Value $value
-    }
-    if ($claudeBody -cne $agentsBody) {
-        Write-Verbose 'AGENTS.md content differs from the canonical CLAUDE.md body'
-        return $false
-    }
-    Write-Verbose 'AGENTS.md content matches the canonical CLAUDE.md body'
-    return $true
-}
-
-function Invoke-DotChezmoi {
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory)]
-        [ValidateSet('apply', 'diff', 'update', 'add', 'remove', 'init')]
-        [string]$Operation,
-        [Parameter(ValueFromRemainingArguments = $true)]
-        [string[]]$Arguments = @()
-    )
-    Invoke-DotNativeCommand -Name 'chezmoi' -Arguments (@($Operation) + $Arguments)
-}
-
-function Get-DotStatus {
-    [CmdletBinding()]
-    param([switch]$AsObject)
-    Assert-DotCommand -Name 'chezmoi'
-    $output = @(& chezmoi status 2>&1)
-    if ($LASTEXITCODE -ne 0) {
-        throw "chezmoi status exited with status $LASTEXITCODE`: $($output -join [Environment]::NewLine)"
-    }
-    $state = if ($output.Count -eq 0) { 'clean' } else { 'drifted' }
-    if ($AsObject) {
-        return [pscustomobject]@{ State = $state; Changes = $output; Native = $true }
-    }
-    Write-DotBanner -Section 'Status'
-    if ($state -eq 'clean') { Write-Host '[OK] Clean - no local drift detected' }
-    else { $output | Write-Output }
-}
-
-function Get-DotSourcePath {
-    [CmdletBinding()]
-    param()
-    Assert-DotCommand -Name 'chezmoi'
-    $path = (& chezmoi source-path 2>&1 | Out-String).Trim()
-    if ($LASTEXITCODE -ne 0 -or -not $path) { throw 'chezmoi source-path failed' }
-    return $path
-}
-
-function Invoke-DotDoctor {
-    [CmdletBinding()]
-    param([switch]$AsObject)
-    $checks = @(
-        [pscustomobject]@{ Name = 'PowerShell 7.4+'; Ok = ($PSVersionTable.PSVersion -ge [version]'7.4') }
-        [pscustomobject]@{ Name = 'chezmoi'; Ok = [bool](Get-Command chezmoi -ErrorAction SilentlyContinue) }
-        [pscustomobject]@{ Name = 'git'; Ok = [bool](Get-Command git -ErrorAction SilentlyContinue) }
-        [pscustomobject]@{ Name = 'repository data'; Ok = (Test-Path $script:DataFile) }
-        [pscustomobject]@{ Name = 'PowerShell module'; Ok = (Test-Path (Join-Path $PSScriptRoot 'Dot.psm1')) }
-    )
-    if ($AsObject) { return $checks }
-    Write-DotBanner -Section 'Doctor'
-    foreach ($check in $checks) {
-        $prefix = if ($check.Ok) { '[OK]' } else { '[FAIL]' }
-        Write-Host "$prefix $($check.Name)"
-    }
-    return -not ($checks.Ok -contains $false)
-}
-
-function Get-DotEnvironment {
-    [CmdletBinding()]
-    param([switch]$AsJson)
-    Assert-DotCommand -Name 'mise'
-    $arguments = if ($AsJson) { @('ls', '--json') } else { @('ls') }
-    Invoke-DotNativeCommand -Name 'mise' -Arguments $arguments
-}
-
-function Get-DotAgents {
-    [CmdletBinding()]
-    param()
-    $targets = [ordered]@{
-        'agents-md' = 'AGENTS.md'; 'cursor' = '.cursor/rules/dotfiles.mdc'
-        'codex' = '.codex/config.toml'; 'windsurf' = '.windsurf/rules.md'
-        'zed' = '.zed/agent-config.toml'; 'roo' = '.roo/rules.md'
-        'cline' = '.clinerules'; 'aider' = '.aider.conf.yml'
-        'continue' = '.continuerc.json'; 'jules' = '.jules/system.md'
-        'agy' = '.agy/AGY.md'
-    }
-    foreach ($entry in $targets.GetEnumerator()) {
-        $path = Join-Path $script:RepoRoot $entry.Value
-        [pscustomobject]@{ Harness = $entry.Key; Path = $path; Rendered = (Test-Path $path) }
-    }
-}
-
-function Get-DotFleetStatus {
-    [CmdletBinding()]
-    param([switch]$AsJson)
-    $status = Get-DotStatus -AsObject
-    $record = [pscustomobject]@{
-        NodeId = [Environment]::MachineName
-        Namespace = 'default'
-        Version = Get-DotfilesVersionFromData
-        OS = [System.Runtime.InteropServices.RuntimeInformation]::OSDescription
-        Architecture = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString()
-        Drift = $status.State
-    }
-    if ($AsJson) { return $record | ConvertTo-Json -Compress }
-    return $record
-}
-
-Export-ModuleMember -Function Get-DotVersion, Invoke-DotHelp, Test-DotAgentsSync, `
-    Invoke-DotChezmoi, Get-DotStatus, Get-DotSourcePath, Invoke-DotDoctor, `
-    Get-DotEnvironment, Get-DotAgents, Get-DotFleetStatus

package/scripts/fonts/install-nerd-fonts.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/verified-download.sh disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/verified-download.sh"
-
-ui_init
-ui_header "Nerd Fonts"
-
-DEFAULT_FONTS="JetBrainsMono FiraCode Iosevka"
-FONT_LIST="${*:-$DEFAULT_FONTS}"
-FONT_VERSION="v3.4.0"
-FONT_BASE_URL="https://github.com/ryanoasis/nerd-fonts/releases/download/${FONT_VERSION}"
-FONT_CHECKSUM_URL="${FONT_BASE_URL}/SHA-256.txt"
-
-install_linux() (
-  local font_name="$1"
-  local target_dir="$HOME/.local/share/fonts/${font_name}NerdFont"
-  mkdir -p "$target_dir"
-  local tmp_dir
-  tmp_dir="$(umask 077 && mktemp -d)"
-  trap 'rm -rf "$tmp_dir"' EXIT
-  local asset="${font_name}.zip"
-  local url="${FONT_BASE_URL}/${asset}"
-  ui_info "Downloading" "$font_name Nerd Font"
-  download_verified_asset "$url" "$FONT_CHECKSUM_URL" "$asset" "$tmp_dir/$asset" 104857600
-  if ! unzip -o "$tmp_dir/$asset" -d "$target_dir" >/dev/null; then
-    ui_err "Unzip failed" "$asset" >&2
-    return 1
-  fi
-  if command -v fc-cache >/dev/null; then
-    fc-cache -f "$target_dir"
-  fi
-  ui_ok "Installed" "$target_dir"
-)
-
-install_macos() {
-  font_name="$1"
-  if command -v brew >/dev/null; then
-    brew tap homebrew/cask-fonts >/dev/null 2>&1 || true
-    cask_name="$(printf "%s" "$font_name" | tr '[:upper:]' '[:lower:]')"
-    case "$cask_name" in
-      jetbrainsmono) cask_name="jetbrains-mono" ;;
-      firacode) cask_name="fira-code" ;;
-      iosevka) cask_name="iosevka" ;;
-    esac
-    brew install --cask "font-${cask_name}-nerd-font" || true
-  else
-    ui_err "Homebrew" "not found. Install font manually."
-    exit 1
-  fi
-}
-
-case "$(uname -s)" in
-  Linux)
-    for font in $FONT_LIST; do
-      install_linux "$font"
-    done
-    ;;
-  Darwin)
-    for font in $FONT_LIST; do
-      install_macos "$font"
-    done
-    ;;
-  *)
-    ui_err "Unsupported OS" "font install"
-    exit 1
-    ;;
-esac

package/scripts/fonts/patch-fonts.sh

@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-if [[ $# -lt 1 ]]; then
-  echo "Usage: patch-fonts.sh <font-file> [output-dir]" >&2
-  exit 1
-fi
-
-font_file="$1"
-out_dir="${2:-$PWD/patched-fonts}"
-
-if [[ ! -f "$font_file" ]]; then
-  echo "Font not found: $font_file" >&2
-  exit 1
-fi
-
-if ! command -v fontforge >/dev/null; then
-  echo "fontforge not found. Install it first (brew install fontforge / apt install fontforge)." >&2
-  exit 1
-fi
-
-patcher="${NERD_FONTS_PATCHER:-$HOME/.local/share/nerd-fonts/font-patcher}"
-
-if [[ ! -x "$patcher" ]]; then
-  echo "Nerd Fonts patcher not found: $patcher" >&2
-  echo "Set NERD_FONTS_PATCHER to the font-patcher path or clone nerd-fonts." >&2
-  exit 1
-fi
-
-mkdir -p "$out_dir"
-
-fontforge -script "$patcher" --complete --outputdir "$out_dir" "$font_file"
-
-echo "Patched font written to: $out_dir"

package/scripts/git-hooks/install.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-install -m 0755 "${repo_root}/scripts/git-hooks/pre-commit" "${repo_root}/.git/hooks/pre-commit"
-install -m 0755 "${repo_root}/scripts/git-hooks/pre-push" "${repo_root}/.git/hooks/pre-push"
-install -m 0755 "${repo_root}/scripts/git-hooks/prepare-commit-msg" "${repo_root}/.git/hooks/prepare-commit-msg"
-echo "Installed pre-commit hook at ${repo_root}/.git/hooks/pre-commit"
-echo "Installed pre-push hook at ${repo_root}/.git/hooks/pre-push"
-echo "Installed prepare-commit-msg hook at ${repo_root}/.git/hooks/prepare-commit-msg"

package/scripts/git-hooks/pre-commit

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-
-if [[ -x "${repo_root}/scripts/diagnostics/secret-governance.sh" ]]; then
-  "${repo_root}/scripts/diagnostics/secret-governance.sh"
-fi
-
-if [[ -x "${repo_root}/scripts/git-hooks/pre-commit-audit.sh" ]]; then
-  "${repo_root}/scripts/git-hooks/pre-commit-audit.sh"
-fi

package/scripts/git-hooks/pre-commit-audit.sh

@@ -1,146 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Dotfiles Pre-Commit Sentinel (Audit Hook)
-# Prevents secrets, hardcoded paths, and shell hygiene violations.
-
-set -euo pipefail
-
-_cleanup_files=()
-trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
-
-# ANSI Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[0;33m'
-BOLD='\033[1m'
-NC='\033[0m'
-
-printf '%b\\n' "${BOLD}🕵️  Running Pre-Commit Audit...${NC}"
-
-# Get list of staged files
-STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-
-if [[ -z "$STAGED_FILES" ]]; then
-  printf '%b\\n' "${GREEN}✓ No files staged. Skipping.${NC}"
-  exit 0
-fi
-
-FAILED=0
-
-# --- 🔐 1. Secret Scanning ---
-echo -n "   🔍 Scanning for secrets... "
-# Refined patterns: require assignment-like syntax to reduce false positives on documentation
-# Exclude assignments to values containing common placeholder strings or within template expressions
-SENSITIVE_PATTERNS="(GITHUB_TOKEN|API_KEY|SECRET|password|private_key|AKIA[0-9A-Z]{16})[[:space:]]*[:=]"
-# Exclusions list for legitimate variable checks or documentation
-SECRET_EXCLUDES="test_|assertions.sh|.pre-commit|README|CHANGELOG|FEATURES.md|docs/|install/lib/|.chezmoitemplates/|mcp-doctor.sh|\.github/workflows/"
-# Also exclude .tmpl files from secret scanning as they contain many false positive markers
-if echo "$STAGED_FILES" | grep -v "\.tmpl" | xargs grep -EiE "$SENSITIVE_PATTERNS" /dev/null | grep -vE "$SECRET_EXCLUDES" | grep -viE "dummy|placeholder|example|test|sk-placeholder|\\{\\{" >/dev/null 2>&1; then
-  printf '%b\\n' "${RED}FAILED${NC}"
-  printf '%b\\n' "      ${YELLOW}⚠ Potential secret detected in staged files:${NC}"
-  echo "$STAGED_FILES" | grep -v "\.tmpl" | xargs grep -EiE "$SENSITIVE_PATTERNS" /dev/null | grep -vE "$SECRET_EXCLUDES" | grep -viE "dummy|placeholder|example|test|sk-placeholder|\\{\\{" | sed 's/^/      /'
-  FAILED=1
-else
-  printf '%b\\n' "${GREEN}PASSED${NC}"
-fi
-
-# --- 👻 2. Ghost Path Linter ---
-echo -n "   👻 Checking for hardcoded paths... "
-# Exclude test files, documentation, the hook itself, Nix files, and template backups
-GHOST_EXCLUDES="test_|assertions.sh|pre-commit|INTEROP.md|WSL2_NIX_TROUBLESHOOTING.md|\.nix|\.backup|\.github/workflows/"
-if echo "$STAGED_FILES" | xargs grep -rIE '"/home/(linuxbrew)?[^$]|/Users/[^$]' /dev/null | grep -v "linuxbrew" | grep -vE "$GHOST_EXCLUDES" >/dev/null 2>&1; then
-  printf '%b\\n' "${RED}FAILED${NC}"
-  printf '%b\\n' "      ${YELLOW}⚠ Literal home paths detected (use \$HOME or ~ instead):${NC}"
-  echo "$STAGED_FILES" | xargs grep -rIE '"/home/(linuxbrew)?[^$]|/Users/[^$]' /dev/null | grep -v "linuxbrew" | grep -vE "$GHOST_EXCLUDES" | sed 's/^/      /'
-  FAILED=1
-else
-  printf '%b\\n' "${GREEN}PASSED${NC}"
-fi
-
-# --- 🐚 3. ShellCheck Hygiene ---
-if command -v shellcheck >/dev/null 2>&1; then
-  echo -n "   🐚 Running ShellCheck... "
-  # ONLY run on actual .sh files, NOT .tmpl files (Go templates break shellcheck)
-  # Also exclude files that contain Zsh-specific syntax that might trigger false positives in sh mode
-  SHELL_FILES=$(echo "$STAGED_FILES" | grep -E '\.sh$' | grep -v "\.tmpl" || true)
-  if [[ -n "$SHELL_FILES" ]]; then
-    if ! echo "$SHELL_FILES" | xargs shellcheck -x --severity=error -e SC1091,SC2296,SC2142 >/dev/null 2>&1; then
-      printf '%b\\n' "${RED}FAILED${NC}"
-      printf '%b\\n' "      ${YELLOW}⚠ Shell syntax errors detected:${NC}"
-      echo "$SHELL_FILES" | xargs shellcheck -x --severity=error -e SC1091,SC2296,SC2142 | sed 's/^/      /'
-      FAILED=1
-    else
-      printf '%b\\n' "${GREEN}PASSED${NC}"
-    fi
-  else
-    printf '%b\\n' "${YELLOW}SKIPPED${NC} (no .sh files)"
-  fi
-fi
-# --- 🧹 4. Formatting Audit ---
-echo -n "   🧹 Checking formatting... "
-# Find files with trailing whitespace, excluding SVGs and other formats where it might be intentional or harmless
-OFFENDING_WHITESPACE=$(echo "$STAGED_FILES" | grep -vE '\.(svg|md)$' | xargs grep -l '[[:space:]]$' /dev/null || true)
-# Use defused patterns to avoid self-detection
-MERGE_START="^<<<<<<< "
-MERGE_END="^>>>>>>> "
-MERGE_DIV="^=======$"
-if [[ -n "$OFFENDING_WHITESPACE" ]]; then
-  printf '%b\\n' "${RED}FAILED${NC}"
-  printf '%b\\n' "      ${YELLOW}⚠ Trailing whitespace found in staged files:${NC}"
-  echo "      ${OFFENDING_WHITESPACE//$'\n'/$'\n'      }"
-  FAILED=1
-elif echo "$STAGED_FILES" | xargs grep -lE "$MERGE_START|$MERGE_END|$MERGE_DIV" /dev/null >/dev/null 2>&1; then
-  printf '%b\\n' "${RED}FAILED${NC}"
-  printf '%b\\n' "      ${YELLOW}⚠ Unresolved merge markers found in staged files:${NC}"
-  echo "$STAGED_FILES" | xargs grep -lE "$MERGE_START|$MERGE_END|$MERGE_DIV" /dev/null | sed 's/^/      /'
-  FAILED=1
-else
-  printf '%b\\n' "${GREEN}PASSED${NC}"
-fi
-
-# --- 🏛️ 5. Signature Guard ---
-if echo "$STAGED_FILES" | grep -q "^README.md$"; then
-  echo -n "   🏛️  Checking README signature... "
-  EXPECTED_ARCHITECT='**THE ARCHITECT** ᛫ [Sebastien Rousseau](https://sebastienrousseau.com)'
-  EXPECTED_ENGINE='**THE ENGINE** ᛞ [EUXIS](https://euxis.co) ᛫ Enterprise Unified Execution Intelligence System'
-  README_CONTENT=$(git show :README.md 2>/dev/null || cat README.md)
-  if echo "$README_CONTENT" | grep -qF "$EXPECTED_ARCHITECT" && echo "$README_CONTENT" | grep -qF "$EXPECTED_ENGINE"; then
-    printf '%b\\n' "${GREEN}PASSED${NC}"
-  else
-    # Auto-add the signature footer before ## License (or at EOF)
-    tmp_footer=$(mktemp)
-    _cleanup_files+=("$tmp_footer")
-    if grep -qF '## License' README.md; then
-      awk -v arch="$EXPECTED_ARCHITECT" -v eng="$EXPECTED_ENGINE" '
-        /^## License/ {
-          print "---"
-          print ""
-          print arch
-          print eng
-          print ""
-          print "---"
-          print ""
-        }
-        { print }
-      ' README.md >"$tmp_footer" && mv "$tmp_footer" README.md
-    else
-      {
-        printf '\n---\n\n%s\n%s\n\n---\n' "$EXPECTED_ARCHITECT" "$EXPECTED_ENGINE"
-      } >>README.md
-    fi
-    rm -f "$tmp_footer"
-    git add README.md
-    printf '%b\\n' "${GREEN}FIXED${NC} (auto-added)"
-  fi
-fi
-
-echo ""
-if [[ $FAILED -eq 1 ]]; then
-  printf '%b\\n' "${RED}${BOLD}❌ Audit failed.${NC} Please fix the issues above before committing."
-  printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
-  exit 1
-else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.519 standards maintained."
-  exit 0
-fi