@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/scripts/git-hooks/pre-push

@@ -1,105 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# =============================================================================
-# pre-push hook
-#
-# 1. Refuses to push any commit that is not GPG/SSH-signed.
-# 2. Runs `scripts/qa/reliability-audit.sh --quick`. The audit is mandatory
-#    by default; explicit per-push bypass requires `DOTFILES_ALLOW_UNSKIPPED_PUSH=1`,
-#    and every bypass is logged to `~/.local/share/dotfiles/audit-bypass.log`.
-#
-# The legacy `DOTFILES_SKIP_PRE_PUSH_AUDIT=1` env var (opt-out) is rejected
-# with a migration message. The new variable is intentionally awkwardly
-# named so that setting it requires deliberate intent. See
-# `docs/security/AUDIT_BYPASS.md`.
-# =============================================================================
-
-set -euo pipefail
-
-repo_root="$(git rev-parse --show-toplevel)"
-
-# -----------------------------------------------------------------------------
-# Step 1 — signed-commit enforcement (unchanged)
-# -----------------------------------------------------------------------------
-while read -r local_ref local_sha remote_ref remote_sha; do
-  [ "$local_sha" = "0000000000000000000000000000000000000000" ] && continue
-
-  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
-    range="$local_sha"
-  elif git cat-file -e "${remote_sha}^{commit}" 2>/dev/null; then
-    range="$remote_sha..$local_sha"
-  else
-    # Remote tip is not in the local object store yet (push without prior fetch).
-    # Fall back to checking commits reachable from local tip.
-    range="$local_sha"
-  fi
-
-  for c in $(git rev-list "$range"); do
-    if ! git verify-commit "$c" >/dev/null 2>&1; then
-      echo "Blocked: unsigned commit $c" >&2
-      exit 1
-    fi
-  done
-done
-
-# -----------------------------------------------------------------------------
-# Step 2 — reject the legacy opt-out variable
-# -----------------------------------------------------------------------------
-if [ "${DOTFILES_SKIP_PRE_PUSH_AUDIT:-}" = "1" ]; then
-  cat >&2 <<'EOF'
-ERROR: DOTFILES_SKIP_PRE_PUSH_AUDIT is no longer honored.
-
-The pre-push audit was previously opt-out — setting one env var was enough
-to skip it. That made bypass invisible and routine. Effective with #871,
-the policy is fail-closed: the audit always runs unless you explicitly
-authorize a bypass for this single push.
-
-To bypass for one push:
-  DOTFILES_ALLOW_UNSKIPPED_PUSH=1 git push
-
-Every bypass is recorded to ~/.local/share/dotfiles/audit-bypass.log
-and surfaced by `dot doctor` if any are recent.
-
-See: docs/security/AUDIT_BYPASS.md
-EOF
-  exit 1
-fi
-
-# -----------------------------------------------------------------------------
-# Step 3 — run the audit (or log + skip if explicitly bypassed)
-# -----------------------------------------------------------------------------
-if [ "${DOTFILES_ALLOW_UNSKIPPED_PUSH:-}" = "1" ]; then
-  bypass_log_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles"
-  # The audit-bypass log lives under XDG_STATE_HOME (user state — never
-  # checked in, never deployed by chezmoi to other locations).
-  mkdir -p "$bypass_log_dir"
-  bypass_log="$bypass_log_dir/audit-bypass.log"
-
-  ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
-  remote="$(git remote get-url --push @{upstream} 2>/dev/null ||
-    git config --get remote.origin.url 2>/dev/null ||
-    echo unknown)"
-  reason="${DOTFILES_BYPASS_REASON:-no reason given}"
-
-  printf '%s\tbranch=%s\tremote=%s\treason=%s\n' \
-    "$ts" "$branch" "$remote" "$reason" >>"$bypass_log"
-
-  echo "WARN: pre-push audit bypassed (logged to $bypass_log)" >&2
-  exit 0
-fi
-
-bash "$repo_root/scripts/qa/reliability-audit.sh" --quick
-
-# Step 4 — version-string consistency. Catches the case where the
-# canonical version in .chezmoidata.toml advanced but a human-visible
-# surface (CLI banner, man page, README badge) wasn't bumped. The
-# script is cheap (~8 grep calls); failure tells the user exactly
-# which file drifted and offers --fix.
-bash "$repo_root/scripts/qa/check-version-consistency.sh" --quiet || {
-  echo "" >&2
-  echo "Pre-push blocked: version-string drift detected." >&2
-  echo "Run: scripts/qa/check-version-consistency.sh" >&2
-  echo "Then: scripts/qa/check-version-consistency.sh --fix    (optional auto-fix)" >&2
-  exit 1
-}

package/scripts/git-hooks/prepare-commit-msg

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Appends the EUXIS branding signature to every commit message.
-# Signature source: ~/.euxis/data/config/branding/signature.txt
-
-set -euo pipefail
-
-# R5: validate commit message file argument
-if [[ -z "${1:-}" || ! -f "${1:-}" ]]; then
-  exit 0 # No file provided — git will handle the error
-fi
-
-COMMIT_MSG_FILE="$1"
-COMMIT_SOURCE="${2:-}"
-
-# Skip merge commits, amends with existing signature, and squash
-case "$COMMIT_SOURCE" in
-  merge | squash) exit 0 ;;
-esac
-
-SIGNATURE_FILE="$HOME/.euxis/data/config/branding/signature.txt"
-
-# Only append if the signature file exists and message doesn't already have it
-if [[ -f "$SIGNATURE_FILE" ]]; then
-  signature=$(cat "$SIGNATURE_FILE")
-  if ! grep -qF "THE ARCHITECT" "$COMMIT_MSG_FILE" 2>/dev/null; then
-    printf '\n%s\n' "$signature" >>"$COMMIT_MSG_FILE"
-  fi
-fi

package/scripts/lib/secrets_provider.sh

@@ -1,185 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Provider-agnostic secrets bridge for dotfiles.
-
-set -euo pipefail
-
-DOT_SECRETS_HOME="${DOT_SECRETS_HOME:-$HOME/.config/dotfiles/secrets}"
-DOT_SECRETS_STORE_DIR="${DOT_SECRETS_STORE_DIR:-$DOT_SECRETS_HOME/store}"
-DOT_SECRETS_INDEX_FILE="${DOT_SECRETS_INDEX_FILE:-$DOT_SECRETS_HOME/index.txt}"
-DOT_SECRETS_AGE_KEY="${DOT_SECRETS_AGE_KEY:-$HOME/.config/chezmoi/key.txt}"
-DOT_SECRETS_SERVICE_PREFIX="${DOT_SECRETS_SERVICE_PREFIX:-dotfiles.secret}"
-
-dot_secrets_ensure_layout() {
-  mkdir -p "$DOT_SECRETS_STORE_DIR"
-  touch "$DOT_SECRETS_INDEX_FILE"
-  chmod 700 "$DOT_SECRETS_HOME" 2>/dev/null || true
-  chmod 700 "$DOT_SECRETS_STORE_DIR" 2>/dev/null || true
-  chmod 600 "$DOT_SECRETS_INDEX_FILE" 2>/dev/null || true
-}
-
-dot_secrets_provider() {
-  local provider="${DOTFILES_SECRETS_PROVIDER:-auto}"
-  if [[ "$provider" != "auto" ]]; then
-    printf "%s\n" "$provider"
-    return 0
-  fi
-
-  if [[ "${OSTYPE:-}" == darwin* ]] && command -v security >/dev/null 2>&1; then
-    printf "macos-keychain\n"
-    return 0
-  fi
-  if command -v pass >/dev/null 2>&1; then
-    printf "pass\n"
-    return 0
-  fi
-  if command -v age >/dev/null 2>&1 && [[ -f "$DOT_SECRETS_AGE_KEY" ]]; then
-    printf "plain-enc\n"
-    return 0
-  fi
-  printf "none\n"
-}
-
-dot_secrets_index_add() {
-  local key="${1:-}"
-  [[ -n "$key" ]] || return 1
-  dot_secrets_ensure_layout
-  if ! grep -qxF "$key" "$DOT_SECRETS_INDEX_FILE" 2>/dev/null; then
-    printf "%s\n" "$key" >>"$DOT_SECRETS_INDEX_FILE"
-  fi
-}
-
-dot_secrets_index_list() {
-  dot_secrets_ensure_layout
-  awk 'NF > 0' "$DOT_SECRETS_INDEX_FILE" | sort -u
-}
-
-dot_secrets_store_macos() {
-  local key="$1"
-  local value="$2"
-  local service="${DOT_SECRETS_SERVICE_PREFIX}.${key}"
-  security add-generic-password -U -a "${USER:-dotfiles}" -s "$service" -w "$value" >/dev/null
-}
-
-dot_secrets_get_macos() {
-  local key="$1"
-  local service="${DOT_SECRETS_SERVICE_PREFIX}.${key}"
-  security find-generic-password -a "${USER:-dotfiles}" -s "$service" -w 2>/dev/null || return 1
-}
-
-dot_secrets_store_pass() {
-  local key="$1" value="$2"
-  printf "%s\n" "$value" | pass insert -m -f "dotfiles/${key}" >/dev/null
-}
-
-dot_secrets_get_pass() {
-  local key="$1"
-  pass show "dotfiles/${key}" 2>/dev/null | head -n1
-}
-
-dot_secrets_store_plain_enc() {
-  local key="$1" value="$2"
-  local tmp_rec file
-  [[ -f "$DOT_SECRETS_AGE_KEY" ]] || {
-    echo "age key not found: $DOT_SECRETS_AGE_KEY" >&2
-    return 1
-  }
-  command -v age >/dev/null 2>&1 || {
-    echo "age not installed" >&2
-    return 1
-  }
-  command -v age-keygen >/dev/null 2>&1 || {
-    echo "age-keygen not installed" >&2
-    return 1
-  }
-  dot_secrets_ensure_layout
-  tmp_rec="$(umask 077 && mktemp)"
-  file="$DOT_SECRETS_STORE_DIR/${key}.age"
-  trap 'rm -f "$tmp_rec"' RETURN
-  age-keygen -y "$DOT_SECRETS_AGE_KEY" >"$tmp_rec"
-  printf "%s" "$value" | age -R "$tmp_rec" -o "$file"
-  chmod 600 "$file" 2>/dev/null || true
-}
-
-dot_secrets_get_plain_enc() {
-  local key="$1"
-  local file="$DOT_SECRETS_STORE_DIR/${key}.age"
-  [[ -f "$DOT_SECRETS_AGE_KEY" ]] || return 1
-  [[ -f "$file" ]] || return 1
-  age -d -i "$DOT_SECRETS_AGE_KEY" "$file" 2>/dev/null || return 1
-}
-
-dot_secrets_set() {
-  local key="${1:-}" value="${2:-}" provider
-  [[ -n "$key" ]] || return 1
-  provider="$(dot_secrets_provider)"
-  case "$provider" in
-    macos-keychain) dot_secrets_store_macos "$key" "$value" ;;
-    pass) dot_secrets_store_pass "$key" "$value" ;;
-    plain-enc) dot_secrets_store_plain_enc "$key" "$value" ;;
-    *)
-      echo "No supported secrets provider detected." >&2
-      return 1
-      ;;
-  esac
-  dot_secrets_index_add "$key"
-}
-
-dot_secrets_get() {
-  local key="${1:-}" provider value rc=0
-  [[ -n "$key" ]] || {
-    printf 'dot_secrets_get: empty key\n' >&2
-    return 1
-  }
-  provider="$(dot_secrets_provider)"
-  case "$provider" in
-    macos-keychain) value="$(dot_secrets_get_macos "$key")" || rc=$? ;;
-    pass) value="$(dot_secrets_get_pass "$key")" || rc=$? ;;
-    plain-enc) value="$(dot_secrets_get_plain_enc "$key")" || rc=$? ;;
-    none)
-      # No usable provider on this host — silent miss is wrong;
-      # callers need to know whether to fall back.
-      printf 'dot_secrets_get: no provider configured for key=%s\n' "$key" >&2
-      return 2
-      ;;
-    *)
-      printf 'dot_secrets_get: unknown provider %q\n' "$provider" >&2
-      return 1
-      ;;
-  esac
-  if [[ "$rc" -ne 0 ]]; then
-    printf 'dot_secrets_get: provider %q failed (rc=%d) for key=%s\n' \
-      "$provider" "$rc" "$key" >&2
-    return "$rc"
-  fi
-  if [[ -z "$value" ]]; then
-    # An empty return from a successful provider call usually means
-    # "key not found" — distinguish from "provider crashed" so the
-    # caller's fallback can be different.
-    printf 'dot_secrets_get: provider %q returned empty for key=%s (not found?)\n' \
-      "$provider" "$key" >&2
-    return 3
-  fi
-  printf '%s' "$value"
-}
-
-dot_secrets_bucket_keys() {
-  local data_file="${1:-}" bucket="${2:-}"
-  [[ -f "$data_file" ]] || return 1
-  [[ -n "$bucket" ]] || return 1
-  awk -v b="$bucket" '
-    $0 ~ "^[[:space:]]*" b "[[:space:]]*=" {
-      line=$0
-      gsub(/^.*\[/, "", line)
-      gsub(/\].*$/, "", line)
-      gsub(/"/, "", line)
-      n=split(line, arr, ",")
-      for (i=1; i<=n; i++) {
-        gsub(/^[[:space:]]+|[[:space:]]+$/, "", arr[i])
-        if (arr[i] != "") print arr[i]
-      }
-      exit
-    }
-  ' "$data_file"
-}

package/scripts/ops/ai-setup.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Universal AI Toolchain Setup & Authentication.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../lib/dot/ui.sh"
-
-ui_header "Universal AI Toolchain Setup"
-
-setup_tool() {
-  local name="$1"
-  local cmd="$2"
-  shift 2
-  # Remaining args are the auth command — passed as an array to avoid eval.
-  local -a auth_argv=("$@")
-
-  ui_section "Setting up $name"
-  if command -v "$cmd" >/dev/null 2>&1; then
-    if [[ ! -t 0 && "${auth_argv[*]}" != *"--version"* ]]; then
-      ui_info "$name" "non-interactive shell; skipping login. Run '${auth_argv[*]}' in a terminal."
-      return 0
-    fi
-    ui_info "Tool found, initiating authentication..."
-    "${auth_argv[@]}" || ui_warn "$name" "Setup/Auth skipped or failed."
-  else
-    ui_err "$name" "Binary not found. Run 'dot apply' or install via mise first."
-  fi
-}
-
-# 1. Claude
-setup_tool "Claude CLI" "claude" claude --version # Claude handles auth via web flow or env
-
-# 2. Antigravity CLI
-setup_tool "Antigravity CLI" "agy" agy --version
-
-# 3. Codex
-setup_tool "Codex CLI" "codex" codex --version
-
-# 4. Copilot
-setup_tool "Copilot CLI" "copilot" copilot --version
-
-# 5. Goose
-setup_tool "Goose" "goose" goose --version
-
-# 6. Kiro
-setup_tool "Kiro CLI" "kiro-cli" kiro-cli login
-
-# 7. Kimi
-setup_tool "Kimi CLI" "kimi" kimi --version
-
-# 8. Aider
-setup_tool "Aider" "aider" aider --version
-
-# 9. Autohand Code
-setup_tool "Autohand Code" "autohand" autohand --version
-
-# 10. Mistral Vibe
-setup_tool "Mistral Vibe" "vibe" vibe --version
-
-# 11. Qwen Code
-setup_tool "Qwen Code" "qwen" qwen --version
-
-# 12. ZAI
-setup_tool "ZAI" "zai" zai --version
-
-ui_header "AI Setup Complete"
-ui_info "All tools are ready. Use 'dot ai' to check status."

package/scripts/ops/bundle.sh

@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Create an offline bundle of the dotfiles environment for air-gapped systems.
-
-set -euo pipefail
-
-_cleanup_files=()
-trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../lib/dot/ui.sh"
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../lib/dot/log.sh"
-export DOT_COMMAND="bundle"
-
-usage() {
-  cat <<'EOF'
-Usage: bundle.sh [output-dir]
-
-Create an offline dotfiles bundle as a .tar.zst archive.
-EOF
-}
-
-case "${1:-}" in
-  --help | -h)
-    usage
-    exit 0
-    ;;
-  -*)
-    printf 'Unknown option: %s\n' "$1" >&2
-    usage >&2
-    exit 2
-    ;;
-esac
-
-# Concurrency guard
-LOCK_DIR="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}"
-if [[ ! -d "$LOCK_DIR" || ! -w "$LOCK_DIR" ]]; then
-  LOCK_DIR="${TMPDIR:-/tmp}"
-fi
-LOCK_FILE="$LOCK_DIR/dotfiles-bundle.lock"
-if command -v flock >/dev/null 2>&1; then
-  exec 9>"$LOCK_FILE"
-  if ! flock -n 9; then
-    ui_warn "Already running" "Another bundle instance is active"
-    exit 0
-  fi
-fi
-
-OUTPUT_DIR="${1:-$HOME/Downloads}"
-TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
-BUNDLE_FILE="$OUTPUT_DIR/dotfiles_offline_bundle_$TIMESTAMP.tar.zst"
-
-dot_log info "bundle_start"
-ui_header "Creating Offline Bundle (Zero-Network Mode)"
-
-# Ensure target directory exists
-mkdir -p "$OUTPUT_DIR"
-
-ui_info "Gathering artifacts..."
-# We use zstd for much faster compression of binary artifacts compared to gzip/xz
-if ! command -v tar >/dev/null || ! command -v zstd >/dev/null; then
-  ui_err "tar and zstd are required for bundling."
-  exit 1
-fi
-
-# Define paths to bundle
-declare -a paths_to_bundle=(
-  "$HOME/.dotfiles"
-  "$HOME/.config/chezmoi"
-  "$HOME/.local/share/mise"
-)
-
-# Optional: Add nix store if present and requested
-if [[ -d "/nix/store" ]] && [[ "${DOTFILES_BUNDLE_NIX:-0}" == "1" ]]; then
-  ui_warn "Including Nix store. This will be very large."
-  paths_to_bundle+=("/nix/store" "/nix/var/nix" "$HOME/.nix-profile")
-fi
-
-# Filter only existing paths
-declare -a valid_paths=()
-for p in "${paths_to_bundle[@]}"; do
-  if [[ -e "$p" ]]; then
-    valid_paths+=("$p")
-    ui_bullet "Adding: $p"
-  fi
-done
-
-ui_info "Compressing artifacts (this may take a while)..."
-# Use absolute paths and store them relative to / to preserve structure
-tar --zstd -cf "$BUNDLE_FILE" -P "${valid_paths[@]}" 2>/dev/null || {
-  ui_err "Failed to create bundle."
-  exit 1
-}
-
-bundle_size=$(stat -c '%s' "$BUNDLE_FILE" 2>/dev/null || stat -f '%z' "$BUNDLE_FILE" 2>/dev/null || echo 0)
-dot_log info "bundle_end" "file=$BUNDLE_FILE"
-dot_metric "bundle_size" "$bundle_size" "bytes"
-ui_ok "Bundle created" "$BUNDLE_FILE"
-ui_info "To restore on an offline machine:"
-ui_bullet "tar --zstd -xf $BUNDLE_FILE -P"
-ui_bullet "cd ~/.dotfiles && ./install.sh --force"

package/scripts/ops/chaos.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Chaos Engineering: Randomly corrupt config files to test self-healing (dot heal)
-# USE WITH CAUTION: This intentionally breaks your environment.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-ui_init
-
-if [[ "${1:-}" != "--force" ]]; then
-  ui_err "WARNING" "This script will intentionally break your dotfiles configuration."
-  ui_info "Purpose" "Tests 'dot heal' auto-repair capabilities."
-  echo ""
-  ui_info "To run, execute" "${0} --force"
-  exit 1
-fi
-
-ui_warn "Initiating Chaos Engineering Sequence..."
-
-# Target files for corruption/deletion
-TARGETS=(
-  "$HOME/.config/starship.toml"
-  "$HOME/.zshrc"
-  "$HOME/.config/alacritty/alacritty.toml"
-)
-
-# 1. Configuration Deletion
-for target in "${TARGETS[@]}"; do
-  if [[ -f "$target" ]] || [[ -L "$target" ]]; then
-    ui_err "Destroying" "$target"
-    rm -f "$target"
-  fi
-done
-
-# 2. Symlink Corruption
-ui_err "Creating" "broken symlinks..."
-ln -sf /tmp/nonexistent_file_xyz "$HOME/.config/broken_symlink_test"
-
-# 3. Path Mutation
-ui_err "Corrupting" "PATH..."
-export PATH="/bin"
-
-echo ""
-ui_ok "Chaos injected" "State is drifted and broken."
-ui_info "Recover" "dot heal"