@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/scripts/ops/setup.sh

@@ -1,138 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Interactive setup for dotfiles preferences
-# Usage: dot setup
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-
-ui_init
-
-CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/chezmoi"
-CONFIG_FILE="$CONFIG_DIR/chezmoi.toml"
-BACKUP_FILE="$CONFIG_DIR/chezmoi.toml.bak.$(date +%Y%m%d_%H%M%S)"
-mkdir -p "$CONFIG_DIR"
-
-choose() {
-  local prompt="$1"
-  shift
-  if command -v gum >/dev/null 2>&1; then
-    gum choose --cursor.foreground=212 --selected.foreground=212 --header "$prompt" "$@"
-  else
-    echo "$prompt"
-    select opt in "$@"; do
-      echo "$opt"
-      return
-    done
-  fi
-}
-
-confirm() {
-  local prompt="$1"
-  if command -v gum >/dev/null 2>&1; then
-    gum confirm "$prompt"
-  else
-    read -r -p "$prompt [y/N]: " ans
-    [[ "$ans" =~ ^[Yy]$ ]]
-  fi
-}
-
-ui_header "Dotfiles Setup"
-
-profile=$(choose "Select profile" laptop desktop server minimal)
-
-feature_zsh=true
-feature_nvim=true
-feature_tmux=true
-feature_gui=true
-feature_secrets=true
-
-confirm "Enable Zsh config?" || feature_zsh=false
-confirm "Enable Neovim config?" || feature_nvim=false
-confirm "Enable tmux config?" || feature_tmux=false
-confirm "Enable GUI extras (fonts/themes)?" || feature_gui=false
-confirm "Enable secrets integration?" || feature_secrets=false
-
-alias_profile=$(choose "Alias profile" standard minimal)
-strict_mode=false
-confirm "Enable strict alias governance?" && strict_mode=true
-
-secrets_provider=$(choose "Secrets provider" auto sops onepassword bitwarden)
-
-theme_choices=(
-  macos-ai-dark macos-ai-light
-  macos-bigsur-dark macos-bigsur-light
-  macos-blue-dark macos-blue-light
-  macos-blush-dark macos-blush-light
-  macos-citrus-dark macos-citrus-light
-  macos-green-dark macos-green-light
-  macos-gridgreen-dark macos-gridgreen-light
-  macos-heatmap-dark macos-heatmap-light
-  macos-indigo-dark macos-indigo-light
-  macos-miami-dark macos-miami-light
-  macos-mojave-dark macos-mojave-light
-  macos-monterey-dark macos-monterey-light
-  macos-nova-dark macos-nova-light
-  macos-orange-dark macos-orange-light
-  macos-pink-dark macos-pink-light
-  macos-purple-dark macos-purple-light
-  macos-sequoia-dark macos-sequoia-light
-  macos-silver-dark macos-silver-light
-  macos-sonoma-dark macos-sonoma-light
-  macos-tahoe-dark macos-tahoe-light
-  macos-valentine-dark macos-valentine-light
-  macos-ventura-dark macos-ventura-light
-  macos-wave-dark macos-wave-light
-  macos-yellow-dark macos-yellow-light
-)
-theme=$(choose "Theme" "${theme_choices[@]}")
-
-if [[ -f "$CONFIG_FILE" ]]; then
-  cp "$CONFIG_FILE" "$BACKUP_FILE"
-  ui_info "Backup" "$BACKUP_FILE"
-fi
-
-cat >"$CONFIG_FILE" <<TOML
-[data]
-profile = "$profile"
-theme = "$theme"
-
-[data.features]
-zsh = ${feature_zsh}
-nvim = ${feature_nvim}
-tmux = ${feature_tmux}
-gui = ${feature_gui}
-secrets = ${feature_secrets}
-
-[data.aliases]
-profile = "$alias_profile"
-
-[data.aliases.policy]
-strict_mode = ${strict_mode}
-
-[data.aliases.buckets]
-system = true
-svn = true
-
-[data.secrets]
-
-[data.secrets.policy]
-provider = "$secrets_provider"
-auto_load = true
-TOML
-
-ui_ok "Config" "Updated $CONFIG_FILE"
-
-if confirm "Apply dotfiles now?"; then
-  if command -v chezmoi >/dev/null 2>&1; then
-    chezmoi apply
-    ui_ok "Apply" "Complete"
-  else
-    ui_warn "chezmoi" "Not installed"
-  fi
-fi

package/scripts/ops/teleport.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Script: teleport.sh
-# Description: Deploys dotfiles to a remote host ephemerally.
-# Usage: ./teleport.sh user@hostname
-
-set -euo pipefail
-
-TARGET="${1:-}"
-
-if [[ -z "$TARGET" ]]; then
-  echo "Usage: dot teleport user@host"
-  exit 1
-fi
-
-# Validate SSH target: must be user@host format, no shell metacharacters
-if [[ ! "$TARGET" =~ ^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+$ ]]; then
-  echo "Invalid SSH target: $TARGET" >&2
-  echo "Expected format: user@hostname (alphanumeric, dots, hyphens, underscores only)" >&2
-  exit 1
-fi
-
-echo " Teleporting dotfiles to ${TARGET}..."
-
-# 1. Archive the current state
-# 2. Pipe to SSH
-# 3. Extract in remote home directory with safety flags
-#    --no-same-owner: don't try to preserve owner (non-root)
-#    --strip-components=0: don't strip path components
-chezmoi archive | ssh "$TARGET" 'tar xz -C "$HOME" --no-same-owner'
-
-echo " Teleport successful!"
-echo "   Note: Changes are applied to files, but shell may need restart or sourcing."

package/scripts/qa/check-version-consistency.sh

@@ -1,124 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-#
-# Verify that every "live" version reference matches the canonical
-# version in .chezmoidata.toml. The intent is to catch drift between
-# the source-of-truth and the human-visible surfaces (CLI banner, man
-# page, badge URL, etc.) BEFORE it ships.
-#
-# Historical references (CHANGELOG entries, audit-doc closed-cycle
-# tables, roadmap docs that mention previous versions) are NOT
-# checked — they are intentionally pinned to the version they
-# describe.
-#
-# Usage:
-#   scripts/qa/check-version-consistency.sh           # verify
-#   scripts/qa/check-version-consistency.sh --fix     # auto-fix
-#   scripts/qa/check-version-consistency.sh --quiet   # rc-only
-#
-# Exit codes:
-#   0  every live reference matches
-#   1  drift detected (with diff printed unless --quiet)
-#   2  bad usage / missing canonical version
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT"
-
-# ── Parse flags ─────────────────────────────────────────────────────────
-fix=0
-quiet=0
-for arg in "$@"; do
-  case "$arg" in
-    --fix) fix=1 ;;
-    --quiet | -q) quiet=1 ;;
-    -h | --help)
-      sed -n '2,21p' "$0"
-      exit 0
-      ;;
-    *)
-      echo "unknown flag: $arg" >&2
-      exit 2
-      ;;
-  esac
-done
-
-_log() { ((quiet)) || printf '%s\n' "$*"; }
-_err() { printf 'check-version-consistency: %s\n' "$*" >&2; }
-
-# ── Canonical version ──────────────────────────────────────────────────
-canonical="$(grep -E '^dotfiles_version[[:space:]]*=' defaults/.chezmoidata.toml |
-  head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
-
-if [[ -z "$canonical" ]]; then
-  _err 'failed to read dotfiles_version from defaults/.chezmoidata.toml'
-  exit 2
-fi
-_log "canonical: $canonical (defaults/.chezmoidata.toml)"
-
-# ── Per-file expected-substring map ────────────────────────────────────
-# Each entry: PATH|MATCH_PATTERN|EXPECTED_STRING
-# MATCH_PATTERN is a fixed substring to grep for on the file to
-# locate the version-bearing line; we then verify it contains the
-# expected substring rendered with $canonical. version-sync.sh
-# already handles many files (it reads package.json as source);
-# this list captures the surfaces version-sync.sh historically
-# missed — bento.sh banner, man-page header, dispatcher header.
-specs=(
-  "package.json|\"version\"|\"version\": \"${canonical}\""
-  "bin/dot|^VERSION=|VERSION=\"${canonical}\""
-  "bin/dot|^# Dotfiles CLI Entry Point - v|# Dotfiles CLI Entry Point - v${canonical}"
-  "share/man/man1/dot.1|^.TH DOT 1|dotfiles v${canonical}"
-  "lib/dot/bento.sh|D O T F I L E S|[v${canonical}]"
-  "README.md|img.shields.io/badge/Version|Version-v${canonical}-blue"
-  "CLAUDE.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
-  "AGENTS.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
-)
-
-drift=0
-for spec in "${specs[@]}"; do
-  IFS='|' read -r path pattern expected <<<"$spec"
-  if [[ ! -f "$path" ]]; then
-    _err "MISSING: $path (declared in spec list)"
-    drift=$((drift + 1))
-    continue
-  fi
-  line="$(grep -E "$pattern" "$path" | head -1 || true)"
-  if [[ -z "$line" ]]; then
-    _err "PATTERN NOT FOUND: '$pattern' in $path"
-    drift=$((drift + 1))
-    continue
-  fi
-  if [[ "$line" != *"$expected"* ]]; then
-    _err "DRIFT in $path"
-    _err "  found:    $line"
-    _err "  expected: contains '$expected'"
-    drift=$((drift + 1))
-    if ((fix)); then
-      # Auto-fix: only safe when the file contains a previous v0.X.YYY
-      # we can sed-replace. Skip otherwise.
-      old="$(printf '%s' "$line" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
-      if [[ -n "$old" ]] && [[ "$old" != "v${canonical}" ]]; then
-        sed -i.bak "s|${old}|v${canonical}|g" "$path" && rm -f "$path.bak"
-        _log "  fixed:  $path  ($old → v${canonical})"
-      fi
-    fi
-  fi
-done
-
-if ((drift > 0)); then
-  if ((fix)); then
-    _log ""
-    _log "Auto-fixed where safe. Re-run without --fix to verify."
-  else
-    _log ""
-    _log "Tip: rerun with --fix to auto-correct (only safe substitutions)."
-    _log "     For non-trivial drift, edit the file manually then re-run."
-  fi
-  exit 1
-fi
-
-_log "all $((${#specs[@]})) live version surfaces match $canonical"
-exit 0

package/scripts/qa/coverage-baseline.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-include_module_coverage=0
-
-usage() {
-  cat <<'EOF'
-Coverage Baseline
-
-Usage:
-  coverage-baseline.sh [--with-module-coverage]
-
-Options:
-  --with-module-coverage  Run tests/framework/module_coverage.sh and include the result
-  -h, --help              Show this help
-EOF
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --with-module-coverage)
-      include_module_coverage=1
-      ;;
-    -h | --help)
-      usage
-      exit 0
-      ;;
-    *)
-      printf 'Unknown option: %s\n' "$1" >&2
-      usage >&2
-      exit 1
-      ;;
-  esac
-  shift
-done
-
-unit_tests="$(find "$REPO_ROOT/tests/unit" -name 'test_*.sh' | wc -l | tr -d ' ')"
-integration_tests="$(find "$REPO_ROOT/tests/integration" -name 'test_*.sh' | wc -l | tr -d ' ')"
-total_tests="$(find "$REPO_ROOT/tests" -path '*/framework/*' -prune -o -name 'test_*.sh' -print | wc -l | tr -d ' ')"
-named_tests="$(rg -o '\btest_start\b' "$REPO_ROOT/tests/unit" "$REPO_ROOT/tests/integration" -g 'test_*.sh' | wc -l | tr -d ' ')"
-docs_files="$(find "$REPO_ROOT/docs" -type f \( -name '*.md' -o -name '*.md.tmpl' \) | wc -l | tr -d ' ')"
-shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/defaults/dot_local/bin" "$REPO_ROOT/defaults/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
-
-printf 'Coverage Baseline\n'
-printf 'Repository: %s\n' "$REPO_ROOT"
-printf 'Documentation files: %s\n' "$docs_files"
-printf 'Executable shell surfaces: %s\n' "$shell_surfaces"
-printf 'Unit test files: %s\n' "$unit_tests"
-printf 'Integration test files: %s\n' "$integration_tests"
-printf 'Total test files: %s\n' "$total_tests"
-printf 'Named tests: %s\n' "$named_tests"
-
-if [ "$include_module_coverage" -eq 1 ]; then
-  printf '\n'
-  (cd "$REPO_ROOT" && bash ./tests/framework/module_coverage.sh)
-fi

package/scripts/qa/docs-coverage.sh

@@ -1,112 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-DOT_CLI="$REPO_ROOT/bin/dot"
-UTILS_DOC="$REPO_ROOT/docs/reference/UTILS.md"
-AI_DOC="$REPO_ROOT/docs/AI.md"
-SCRIPTS_DOC="$REPO_ROOT/docs/reference/SCRIPTS.md"
-ARCH_DOC="$REPO_ROOT/docs/architecture/ARCHITECTURE.md"
-FUNCTION_GROUPS_JSON="$REPO_ROOT/defaults/.chezmoitemplates/functions/groups.json"
-MIN_DOCS_COVERAGE="${MIN_DOCS_COVERAGE:-100}"
-
-TOTAL_CHECKS=0
-COVERED_CHECKS=0
-
-record_doc_check() {
-  local label="$1"
-  local needle="$2"
-  local file="$3"
-
-  TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
-  if grep -Fq "$needle" "$file"; then
-    COVERED_CHECKS=$((COVERED_CHECKS + 1))
-  else
-    printf 'Missing documentation: %s\n' "$label" >&2
-  fi
-}
-
-extract_public_commands() {
-  awk '
-    /_dot_help_specs\(\)/ { in_func=1; next }
-    in_func && /cat <<'\''EOF'\''/ { in_block=1; next }
-    in_block && /^EOF$/ { exit }
-    in_block && /\|/ {
-      split($0, parts, /\|/)
-      print parts[2]
-    }
-  ' "$DOT_CLI"
-}
-
-check_dot_command_docs() {
-  local command=""
-
-  while IFS= read -r command; do
-    [ -n "$command" ] || continue
-    record_doc_check "dot $command in UTILS.md" "\`dot $command" "$UTILS_DOC"
-  done < <(extract_public_commands)
-}
-
-check_ai_provider_docs() {
-  local provider=""
-
-  for provider in cl copilot kimi agy kiro sgpt ollama opencode aider; do
-    record_doc_check "dot $provider in AI.md" "\`dot $provider\`" "$AI_DOC"
-  done
-}
-
-check_utility_docs() {
-  local utility=""
-
-  for utility in \
-    ai-update ai_core antigravity b64 bm cb dot dot-ai dot-bootstrap dot-launch-or-focus \
-    dot-load-benchmark dot-load-benchmark-pty dot-theme-sync dtags epoch extract gbd gd \
-    git-ai-commit git-ai-diff gl hash hashsum hex jsonv jwt kill-port lorem monitor myip \
-    notify open pw rec-start rec-stop regex start-niri tmux-sessionizer tour up update uuid \
-    win yamlv; do
-    record_doc_check "$utility in SCRIPTS.md" "\`$utility\`" "$SCRIPTS_DOC"
-  done
-}
-
-check_function_group_docs() {
-  local group=""
-
-  for group in $(
-    FUNCTION_GROUPS_JSON="$FUNCTION_GROUPS_JSON" python3 - <<'PY'
-import json
-import os
-from pathlib import Path
-path = Path(os.environ["FUNCTION_GROUPS_JSON"])
-for key in json.loads(path.read_text()).keys():
-    print(key)
-PY
-  ); do
-    record_doc_check "function group $group in ARCHITECTURE.md" "\`$group\`" "$ARCH_DOC"
-  done
-}
-
-report_coverage() {
-  local pct
-  pct="$(awk -v c="$COVERED_CHECKS" -v t="$TOTAL_CHECKS" 'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
-
-  printf 'Docs coverage: %s/%s (%s%%)\n' "$COVERED_CHECKS" "$TOTAL_CHECKS" "$pct"
-  printf 'Threshold: %s%%\n' "$MIN_DOCS_COVERAGE"
-
-  awk -v p="$pct" -v min="$MIN_DOCS_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'
-}
-
-main() {
-  check_dot_command_docs
-  check_ai_provider_docs
-  check_utility_docs
-  check_function_group_docs
-  report_coverage
-
-  printf 'PASS: public dot commands, utility entrypoints, AI providers, and function groups are documented at or above the required threshold\n'
-}
-
-main "$@"

package/scripts/qa/examples-coverage.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# =============================================================================
-# examples-coverage.sh — enforce that every core feature domain ships a
-# runnable example under examples/. Mirrors scripts/qa/docs-coverage.sh:
-# it is a *coverage contract*, not a linter. Threshold defaults to 100%.
-#
-# A feature domain is "covered" when examples/example-<domain>.sh exists.
-# Keep REQUIRED_AREAS in lockstep with the feature surface — adding a major
-# user-facing capability (a new `dot` subsystem) means adding its example.
-# =============================================================================
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-EXAMPLES_DIR="$REPO_ROOT/examples"
-DOT_CLI="$REPO_ROOT/bin/dot"
-MIN_EXAMPLES_COVERAGE="${MIN_EXAMPLES_COVERAGE:-100}"
-
-# Public commands/subcommands, extracted from bin/dot's _dot_help_specs — the
-# same source scripts/qa/docs-coverage.sh uses, so docs and examples stay in
-# lockstep at the command granularity.
-extract_public_commands() {
-  awk -F'|' '
-    /_dot_help_specs\(\)/ { in_func=1; next }
-    in_func && /cat <<'\''EOF'\''/ { in_block=1; next }
-    in_block && /^EOF$/ { exit }
-    in_block && NF>=2 { print $2 }
-  ' "$DOT_CLI"
-}
-
-# Core feature domains that must each have examples/example-<area>.sh.
-REQUIRED_AREAS=(
-  ai-patterns
-  cli-utilities
-  coverage-gate
-  diagnostics
-  dot-commands
-  functions
-  fleet
-  git-hooks
-  install-uninstall
-  ops
-  platform-contract
-  qa
-  secrets
-  security
-  test-suite
-  testing-framework
-  theme
-)
-
-total=0
-covered=0
-missing=()
-
-# --- Check 1: every feature domain has a dedicated example file. ---
-for area in "${REQUIRED_AREAS[@]}"; do
-  total=$((total + 1))
-  if [ -f "$EXAMPLES_DIR/example-$area.sh" ]; then
-    covered=$((covered + 1))
-  else
-    missing+=("domain:$area")
-  fi
-done
-
-# --- Check 2: every public command/subcommand is referenced in an example. ---
-while IFS= read -r cmd; do
-  [ -n "$cmd" ] || continue
-  total=$((total + 1))
-  # "dot <cmd>" followed by a non-identifier char (or EOL) — avoids matching
-  # `dot ai` against `dot ai-query`, and matches printf '...\n'-terminated refs.
-  if grep -rqE "dot ${cmd}([^A-Za-z0-9_-]|\$)" "$EXAMPLES_DIR" 2>/dev/null; then
-    covered=$((covered + 1))
-  else
-    missing+=("cmd:$cmd")
-  fi
-done < <(extract_public_commands | sort -u)
-
-pct="$(awk -v c="$covered" -v t="$total" \
-  'BEGIN{if(t==0){print "0.00"}else{printf "%.2f", (100*c/t)}}')"
-printf 'Examples coverage: %s/%s (%s%%)\n' "$covered" "$total" "$pct"
-printf 'Threshold: %s%%\n' "$MIN_EXAMPLES_COVERAGE"
-if [ "${#missing[@]}" -gt 0 ]; then
-  printf 'Missing coverage for: %s\n' "${missing[*]}" >&2
-fi
-
-if awk -v p="$pct" -v min="$MIN_EXAMPLES_COVERAGE" 'BEGIN{exit !(p+0 >= min+0)}'; then
-  printf 'PASS: every feature domain and every public command has an example.\n'
-  exit 0
-fi
-printf 'FAIL: examples coverage %s%% is below the %s%% threshold.\n' "$pct" "$MIN_EXAMPLES_COVERAGE" >&2
-exit 1

package/scripts/qa/powershell-contract.ps1

@@ -1,95 +0,0 @@
-# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-#
-# PowerShell parity contract — smoke test for the dotfiles PowerShell
-# profile. Run by the windows-latest CI job (#860). Asserts that:
-#
-#   1. The profile parses + loads without throwing.
-#   2. Core function shims (`dot`, `ll`, `la`, `cat`) are defined.
-#   3. PSScriptAnalyzer reports no errors against the profile (warnings
-#      surface but don't fail the gate; tighten later).
-#
-# Exit codes:
-#   0  contract intact.
-#   1  any check failed; details printed to host.
-
-$ErrorActionPreference = 'Stop'
-$Failures = New-Object System.Collections.Generic.List[string]
-
-$RepoRoot = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
-$ProfileSrc = Join-Path $RepoRoot 'defaults/dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
-
-if (-not (Test-Path $ProfileSrc)) {
-    Write-Output "FAIL: profile source not found at $ProfileSrc"
-    exit 1
-}
-
-# Step 1 — chezmoi-render the template into a real .ps1 we can dot-source.
-# In CI, chezmoi is on PATH (installed by setup-chezmoi composite).
-$Rendered = Join-Path $env:TEMP 'Microsoft.PowerShell_profile.ps1'
-if (Get-Command chezmoi -ErrorAction SilentlyContinue) {
-    & chezmoi execute-template --init --promptString version=0.2.501 `
-        --in $ProfileSrc | Set-Content -Path $Rendered -NoNewline
-} else {
-    # Fallback: strip chezmoi template syntax with a simple regex so the
-    # contract still runs locally without chezmoi installed.
-    (Get-Content $ProfileSrc -Raw) -replace '\{\{[^}]+\}\}', '0.0.0-fallback' |
-        Set-Content -Path $Rendered -NoNewline
-}
-
-if (-not (Test-Path $Rendered)) {
-    $Failures.Add("profile template did not render to $Rendered")
-}
-
-# Step 2 — dot-source the rendered profile and verify it didn't throw.
-$loadOk = $false
-try {
-    . $Rendered
-    $loadOk = $true
-    Write-Output "OK: profile dot-sourced"
-} catch {
-    Write-Output "FAIL: profile threw during load: $_"
-    $Failures.Add("profile load: $_")
-}
-
-# Step 3 — verify required function shims are defined.
-$RequiredFunctions = @('dot', 'd', 'll', 'la', 'cat')
-foreach ($fn in $RequiredFunctions) {
-    if (Get-Command $fn -CommandType Function -ErrorAction SilentlyContinue) {
-        Write-Output "OK: function $fn defined"
-    } else {
-        Write-Output "FAIL: function $fn not defined"
-        $Failures.Add("missing function: $fn")
-    }
-}
-
-# Step 4 — PSScriptAnalyzer (static analysis). Pre-installed on the
-# windows-latest GitHub-hosted runner; install on demand if missing.
-if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
-    Write-Output "Installing PSScriptAnalyzer..."
-    Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser -ErrorAction SilentlyContinue | Out-Null
-}
-
-if (Get-Module -ListAvailable -Name PSScriptAnalyzer) {
-    Import-Module PSScriptAnalyzer -Force
-    $Findings = Invoke-ScriptAnalyzer -Path $Rendered -Severity 'Error' -ErrorAction SilentlyContinue
-    if ($Findings) {
-        foreach ($f in $Findings) {
-            Write-Output "FAIL: PSScriptAnalyzer error: $($f.RuleName) at line $($f.Line): $($f.Message)"
-            $Failures.Add("PSScriptAnalyzer error: $($f.RuleName)")
-        }
-    } else {
-        Write-Output "OK: PSScriptAnalyzer clean (Error severity)"
-    }
-} else {
-    Write-Output "WARN: PSScriptAnalyzer not available — static analysis skipped"
-}
-
-Write-Output ""
-if ($Failures.Count -eq 0) {
-    Write-Output "PowerShell contract: PASS"
-    exit 0
-} else {
-    Write-Output "PowerShell contract: FAIL ($($Failures.Count) issue(s))"
-    foreach ($f in $Failures) { Write-Output "  - $f" }
-    exit 1
-}