@sebastienrousseau/dotfiles 0.2.520 → 0.2.521

package/scripts/diagnostics/verify.sh

@@ -1,108 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Dotfiles post-merge verification checks
-# Runs doctor + status + diff checks and exits non-zero on issues.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-
-ui_init
-ui_dot_banner "Diagnostics"
-ui_header "Dotfiles Verify"
-echo ""
-
-failures=0
-dot_bin=""
-RUN_SECURITY=0
-
-# Parse arguments
-for arg in "$@"; do
-  case "$arg" in
-    --security | -s) RUN_SECURITY=1 ;;
-  esac
-done
-
-resolve_dot_bin() {
-  if command -v dot >/dev/null 2>&1; then
-    command -v dot
-    return
-  fi
-  if [[ -x "$HOME/.local/bin/dot" ]]; then
-    printf "%s\n" "$HOME/.local/bin/dot"
-    return
-  fi
-  local src_dir=""
-  if [[ -n "${CHEZMOI_SOURCE_DIR:-}" && -d "${CHEZMOI_SOURCE_DIR}" ]]; then
-    src_dir="${CHEZMOI_SOURCE_DIR}"
-  elif [[ -d "$HOME/.dotfiles" ]]; then
-    src_dir="$HOME/.dotfiles"
-  elif [[ -d "$HOME/.local/share/chezmoi" ]]; then
-    src_dir="$HOME/.local/share/chezmoi"
-  fi
-  if [[ -n "$src_dir" && -x "$src_dir/bin/dot" ]]; then
-    printf "%s\n" "$src_dir/bin/dot"
-    return
-  fi
-  return 1
-}
-
-run_step() {
-  local label="$1"
-  shift
-
-  ui_info "Running" "$label"
-  set +e
-  "$@"
-  local ec=$?
-  set -e
-
-  if [[ $ec -eq 0 ]]; then
-    ui_ok "$label" "ok"
-  else
-    ui_err "$label" "failed (exit $ec)"
-    failures=$((failures + 1))
-  fi
-}
-
-if dot_bin="$(resolve_dot_bin)"; then
-  if [[ $RUN_SECURITY -eq 1 ]]; then
-    run_step "security-score" "$dot_bin" security-score
-  else
-    run_step "dot doctor" "$dot_bin" doctor
-    run_step "dot status" "$dot_bin" status
-  fi
-else
-  # shellcheck disable=SC1091
-  ui_err "dot binary" "not found in PATH, ~/.local/bin, or source tree"
-  failures=$((failures + 1))
-fi
-
-ui_info "Running" "chezmoi diff"
-set +e
-diff_output="$(chezmoi diff 2>&1)"
-diff_ec=$?
-set -e
-if [[ $diff_ec -eq 0 ]]; then
-  ui_ok "chezmoi diff" "clean"
-else
-  ui_warn "chezmoi diff" "drift detected"
-  if [[ -n "$diff_output" ]]; then
-    printf "%s\n" "$diff_output"
-  fi
-  failures=$((failures + 1))
-fi
-
-echo ""
-if [[ $failures -eq 0 ]]; then
-  ui_ok "Verification" "all checks passed"
-  exit 0
-fi
-
-ui_err "Verification" "$failures check(s) failed"
-ui_info "Hint" "Run 'dot heal' then re-run 'dot verify'"
-exit 1

package/scripts/diagnostics/verify_state.sh

@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-# MIT License
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# See LICENSE file for details.
-
-# Script: verify_state.sh
-# Description: Final verification of the dotfiles environment state.
-
-set -euo pipefail
-
-echo " Starting Final Environment Verification..."
-
-Errors=0
-ALIASES_CONFIG="$HOME/.config/shell/aliases.sh"
-AliasesConfigReported=0
-
-check_file() {
-  if [[ ! -f "$1" ]]; then
-    echo " Missing file: $1"
-    Errors=$((Errors + 1))
-  else
-    echo " Found file: $1"
-  fi
-}
-
-check_alias_in_config() {
-  if [[ ! -f "$ALIASES_CONFIG" ]]; then
-    if [[ "$AliasesConfigReported" -eq 0 ]]; then
-      echo " Missing aliases config: $ALIASES_CONFIG"
-      Errors=$((Errors + 1))
-      AliasesConfigReported=1
-    fi
-  elif ! grep -q "$1" "$ALIASES_CONFIG"; then
-    echo " Missing alias definition '$1' in built config"
-    Errors=$((Errors + 1))
-  else
-    echo " Verified alias: $1"
-  fi
-}
-
-# 1. Verify Docs
-# Post-Phase-4b (v0.2.503): chezmoi source is under the subdir
-# named in .chezmoiroot (typically "defaults/"). Paths without the
-# prefix silently return "missing" from any CWD other than
-# ~/.dotfiles/defaults/.
-check_file "defaults/.chezmoitemplates/aliases/security/README.md"
-check_file "defaults/.chezmoitemplates/aliases/legal/README.md"
-
-# 2. Verify Scripts
-check_file "scripts/security/lock-configs.sh"
-check_file "scripts/tools/detect-collisions.py"
-check_file "tests/test-aliases.sh"
-
-# 3. Verify Generated Config Content (Key Features)
-# Security
-check_alias_in_config "lock-configs"
-check_alias_in_config "unlock-configs"
-check_alias_in_config "enable-signing"
-# Legal
-check_alias_in_config "scan-licenses"
-check_alias_in_config "add-headers"
-
-# 4. Verify Workflows
-check_file ".github/workflows/security-release.yml"
-
-if [[ $Errors -eq 0 ]]; then
-  echo " Verification Passed! All systems nominal."
-  exit 0
-else
-  echo "️  Verification Failed with $Errors errors."
-  exit 1
-fi

package/scripts/diagnostics/version-locks.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Version Locks Summary
-# Usage: dot locks
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-
-ui_init
-
-resolve_source_dir() {
-  if [[ -n "${CHEZMOI_SOURCE_DIR:-}" && -d "$CHEZMOI_SOURCE_DIR" ]]; then
-    printf "%s\n" "$CHEZMOI_SOURCE_DIR"
-    return
-  fi
-  if [[ -d "$HOME/.dotfiles" ]]; then
-    printf "%s\n" "$HOME/.dotfiles"
-    return
-  fi
-  if [[ -d "$HOME/.local/share/chezmoi" ]]; then
-    printf "%s\n" "$HOME/.local/share/chezmoi"
-    return
-  fi
-  return 1
-}
-
-src_dir=$(resolve_source_dir)
-
-# resolve_source_dir returns the repo root, but since the defaults/ reorg the
-# deployable tree lives under the .chezmoiroot subdir (defaults/). Descend
-# into it so paths like dot_config/... resolve. (Without this the mise lookup
-# below silently reported "config not found" on every run.)
-cm_src="$src_dir"
-if [[ -f "$src_dir/.chezmoiroot" ]]; then
-  _cm_root="$(tr -d '[:space:]' <"$src_dir/.chezmoiroot")"
-  [[ -n "$_cm_root" && -d "$src_dir/$_cm_root" ]] && cm_src="$src_dir/$_cm_root"
-fi
-
-ui_header "Version Locks"
-
-ui_section "mise toolchain"
-mise_config="$cm_src/dot_config/mise/conf.d/00-dotfiles.toml"
-if [[ -f "$mise_config" ]]; then
-  awk -F= '
-    /^\[tools\]/ {in_tools=1; next}
-    /^\[/ {in_tools=0}
-    in_tools && NF {
-      gsub(/"/, "", $0)
-      tool=$1
-      gsub(/[[:space:]]+/, "", tool)
-      ver=$2
-      gsub(/^[[:space:]]+|[[:space:]]+$/, "", ver)
-      if (tool != "") {
-        printf "%s\t%s\n", tool, ver
-      }
-    }
-  ' "$mise_config" | while IFS=$'\t' read -r tool ver; do
-    [[ -n "$tool" ]] && ui_kv "$tool" "$ver"
-  done
-else
-  ui_warn "mise" "config not found"
-fi
-
-ui_section "Node/Python pins"
-# Chezmoi-tracked files (dot_*) live under $cm_src (defaults/) post-
-# Phase-4b, NOT at repo root. Using $src_dir here silently rendered
-# an empty section on every workstation.
-if [[ -f "$cm_src/dot_node-version" ]]; then
-  ui_kv "node" "$(cat "$cm_src/dot_node-version")"
-fi
-if [[ -f "$cm_src/dot_noderc.tmpl" ]]; then
-  ui_kv "noderc" "$(sed -n '1p' "$cm_src/dot_noderc.tmpl")"
-fi
-
-ui_section "Package manager locks"
-if [[ -f "$cm_src/dot_config/shell/Brewfile" ]]; then
-  ui_kv "brew" "Brewfile present"
-fi
-if [[ -f "$cm_src/dot_config/shell/Brewfile.cli" ]]; then
-  ui_kv "brew-cli" "Brewfile.cli present"
-fi
-# package.json (if any) is a repo-root artefact — use $src_dir.
-if [[ -f "$src_dir/package.json" ]]; then
-  ui_kv "node" "package.json version pinned"
-fi
-
-ui_section "Notes"
-ui_info "Policy" "Prefer LTS and explicit pins for core runtimes"
-ui_info "Update" "Edit ~/.config/mise/config.toml to adjust pins"

package/scripts/diagnostics/workstation-attestation.sh

@@ -1,212 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-## Workstation attestation export.
-##
-## Produces a machine-readable evidence record for the current dotfiles
-## workstation state: version, platform, signing, MCP posture, and agent mode.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-# Export so child processes (the mcp-doctor subprocess below) inherit it
-# without the env-prefix dance that confuses shellcheck (SC2097/SC2098).
-export REPO_ROOT
-
-# shellcheck source=../../lib/dot/ui.sh
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-# shellcheck source=../../lib/dot/utils.sh
-source "$SCRIPT_DIR/../../lib/dot/utils.sh"
-
-JSON_MODE=0
-WRITE_PATH=""
-FLEET_STORE=""
-FLEET_ID=""
-VERIFY=0
-VERIFY_MAX_AGE=""
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --json | -j)
-      JSON_MODE=1
-      shift
-      ;;
-    --verify | -V)
-      VERIFY=1
-      shift
-      ;;
-    --max-age | -a)
-      VERIFY_MAX_AGE="${2:-}"
-      VERIFY=1
-      shift 2
-      ;;
-    --write | -w)
-      WRITE_PATH="${2:-}"
-      shift 2
-      ;;
-    --fleet-store | -F)
-      FLEET_STORE="${2:-}"
-      shift 2
-      ;;
-    --fleet-id | -I)
-      FLEET_ID="${2:-}"
-      shift 2
-      ;;
-    *)
-      shift
-      ;;
-  esac
-done
-
-command -v jq >/dev/null 2>&1 || {
-  echo "jq is required for workstation attestation." >&2
-  exit 1
-}
-
-ui_init
-
-if [[ -z "$FLEET_STORE" && -n "${DOTFILES_FLEET_STORE:-}" ]]; then
-  FLEET_STORE="$DOTFILES_FLEET_STORE"
-fi
-
-attestation_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/attestations"
-if [[ -n "$WRITE_PATH" ]]; then
-  mkdir -p "$(dirname "$WRITE_PATH")"
-elif [[ "$JSON_MODE" -ne 1 && -z "$FLEET_STORE" ]]; then
-  mkdir -p "$attestation_dir"
-  WRITE_PATH="$attestation_dir/workstation-attestation.json"
-fi
-
-dot_version="$(dotfiles_version)"
-platform_id="$(dot_platform_id)"
-host_os="$(dot_host_os)"
-arch="$(uname -m)"
-hostname_value="$(hostname 2>/dev/null || true)"
-agent_profile_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-profiles.json"
-agent_card_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-card.json"
-agent_state_file="${AGENT_STATE_FILE:-$HOME/.config/dotfiles/agent-mode.env}"
-policy_bundles_file="$REPO_ROOT/defaults/dot_config/dotfiles/policy-bundles.json"
-model_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/model-registry.json"
-prompt_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/prompt-registry.json"
-mcp_policy_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-policy.json"
-mcp_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-registry.json"
-signing_format="$(git config --global gpg.format 2>/dev/null || echo ssh)"
-signing_key="$(git config --global user.signingkey 2>/dev/null || true)"
-allowed_signers="$(git config --global gpg.ssh.allowedSignersFile 2>/dev/null || echo "$HOME/.config/git/allowed_signers")"
-merge_verify="$(git config --global --bool merge.verifySignatures 2>/dev/null || echo false)"
-
-if [[ -f "$agent_state_file" ]]; then
-  current_profile="$(sed -n 's/^DOT_AGENT_PROFILE=//p' "$agent_state_file" | tail -n 1)"
-else
-  current_profile=""
-fi
-if [[ -z "$current_profile" ]] && [[ -f "$agent_profile_file" ]]; then
-  current_profile="$(jq -r '.defaultProfile // "ask"' "$agent_profile_file")"
-fi
-
-MCP_CONFIG="$REPO_ROOT/defaults/dot_config/claude/mcp_servers.json"
-export MCP_CONFIG
-mcp_summary="$(bash "$REPO_ROOT/scripts/diagnostics/mcp-doctor.sh" --strict --json)"
-
-attestation_json="$(
-  jq -n \
-    --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    --arg repo_root "$REPO_ROOT" \
-    --arg version "$dot_version" \
-    --arg platform "$platform_id" \
-    --arg host_os "$host_os" \
-    --arg arch "$arch" \
-    --arg hostname "$hostname_value" \
-    --arg signing_format "$signing_format" \
-    --arg signing_key "$signing_key" \
-    --arg allowed_signers "$allowed_signers" \
-    --argjson merge_verify "$([[ "$merge_verify" == "true" ]] && echo true || echo false)" \
-    --arg current_profile "$current_profile" \
-    --argjson mcp "$mcp_summary" \
-    --slurpfile agent_profiles "$agent_profile_file" \
-    --slurpfile agent_card "$agent_card_file" \
-    --slurpfile policy_bundles "$policy_bundles_file" \
-    --slurpfile model_registry "$model_registry_file" \
-    --slurpfile prompt_registry "$prompt_registry_file" \
-    --slurpfile mcp_policy "$mcp_policy_file" \
-    --slurpfile mcp_registry "$mcp_registry_file" \
-    '{
-      generated_at: $generated_at,
-      repo_root: $repo_root,
-      dotfiles_version: $version,
-      platform: {
-        runtime: $platform,
-        host_os: $host_os,
-        architecture: $arch,
-        hostname: $hostname
-      },
-      git_signing: {
-        format: $signing_format,
-        signing_key: $signing_key,
-        allowed_signers_file: $allowed_signers,
-        merge_verify_signatures: $merge_verify
-      },
-      agent: {
-        current_profile: $current_profile,
-        profiles: $agent_profiles[0],
-        card: $agent_card[0]
-      },
-      governance: {
-        policy_bundles: $policy_bundles[0],
-        model_registry: $model_registry[0],
-        prompt_registry: $prompt_registry[0]
-      },
-      mcp: {
-        doctor: $mcp,
-        policy: $mcp_policy[0],
-        registry: $mcp_registry[0]
-      }
-    }'
-)"
-
-if [[ -n "$WRITE_PATH" ]]; then
-  printf '%s\n' "$attestation_json" >"$WRITE_PATH"
-fi
-
-if [[ -n "$FLEET_STORE" ]]; then
-  fleet_root="${FLEET_STORE%/}"
-  fleet_id="${FLEET_ID:-${DOTFILES_FLEET_ID:-default}}"
-  fleet_host="${hostname_value:-unknown-host}"
-  fleet_dir="$fleet_root/$fleet_id/$fleet_host"
-  fleet_file="$fleet_dir/workstation-attestation.json"
-  fleet_timestamp_file="$fleet_dir/workstation-attestation-$(date -u +%Y%m%dT%H%M%SZ).json"
-  mkdir -p "$fleet_dir"
-  printf '%s\n' "$attestation_json" >"$fleet_file"
-  printf '%s\n' "$attestation_json" >"$fleet_timestamp_file"
-fi
-
-# Hand the evidence to the WebAssembly verifier rather than printing it.
-# The module has no access to this machine beyond the bytes on its stdin, so
-# the verdict does not depend on the tools the machine under review happens
-# to have installed.
-if [[ "$VERIFY" -eq 1 ]]; then
-  verify_args=(--verify)
-  [[ "$JSON_MODE" -eq 1 ]] && verify_args+=(--json)
-  [[ -n "$VERIFY_MAX_AGE" ]] && verify_args+=(--max-age "$VERIFY_MAX_AGE")
-  verify_status=0
-  printf '%s\n' "$attestation_json" |
-    bash "$SCRIPT_DIR/attest-verify.sh" "${verify_args[@]}" || verify_status=$?
-  exit "$verify_status"
-fi
-
-if [[ "$JSON_MODE" -eq 1 ]]; then
-  printf '%s\n' "$attestation_json"
-else
-  ui_dot_banner "Diagnostics"
-  ui_header "Workstation Attestation"
-  ui_ok "Version" "$dot_version"
-  ui_ok "Platform" "$platform_id / $host_os / $arch"
-  ui_ok "Agent profile" "$current_profile"
-  ui_ok "MCP status" "$(printf '%s' "$mcp_summary" | jq -r '.status')"
-  ui_ok "Output" "$WRITE_PATH"
-  if [[ -n "$FLEET_STORE" ]]; then
-    ui_ok "Fleet store" "$fleet_root/$fleet_id/$fleet_host"
-  fi
-fi