fix: audit fixes

.claude/skills/add-dotfiles-tooling/SKILL.md

@@ -133,7 +133,7 @@ mytool() { command mytool "$@"; }  # @doc Brief description | mytool <usage>
   Run it before declaring a tool done.
 
 There is deliberately no install-script template. `install/` ranges from 3 lines
-(`extras/deno.sh`, a `curl | sh`) to 252 (`cli-tools.sh`), and the install method differs per tool —
+(`install/extras/deno.sh`, a `curl | sh`) to 252 (`cli-tools.sh`), and the install method differs per tool —
 apt, cargo, GitHub release, language version manager. Copy whichever existing script
 matches the method you need; `lazygit.sh` is the closest thing to a canonical
 GitHub-release example.

scripts/bench-shell.sh

@@ -3,6 +3,13 @@ set -euo pipefail
 
 ## @just 74 Verification | Benchmark interactive shell startup time
 
+readonly VERSION="1.0.0"
+
+if [[ "${1:-}" == "--version" ]]; then
+    echo "bench-shell ${VERSION}"
+    exit 0
+fi
+
 readonly ITERATIONS="${1:-10}"
 readonly WARMUP=2
 readonly REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

scripts/check-tool-wiring.sh

@@ -4,6 +4,7 @@
 ## Verify a tool is fully wired into this dotfiles repo.
 ##
 ## Usage: check-tool-wiring.sh <tool> [--apt-package <pkg>] [--no-stub]
+##        check-tool-wiring.sh --version
 ##
 ## --apt-package  when the apt package name differs (fd-find -> fd)
 ## --no-stub      for language runtimes and action-only just recipes that
@@ -19,6 +20,7 @@
 
 set -euo pipefail
 
+readonly VERSION="1.0.0"
 readonly EXIT_FAILED_CHECKS=1
 readonly EXIT_USAGE=2
 
@@ -53,6 +55,10 @@ require_stub=true
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
+    --version)
+        echo "check-tool-wiring ${VERSION}"
+        exit 0
+        ;;
     --apt-package)
         [[ $# -ge 2 ]] || usage
         apt_package="$2"

scripts/dotfiles_audit.sh

@@ -2,7 +2,14 @@
 # shellcheck disable=SC1090,SC1091
 # Audits the state of all dotfiles system dependencies.
 # Read-only — does not install or modify anything.
-# Usage: ./scripts/dotfiles_audit.sh
+# Usage: ./scripts/dotfiles_audit.sh [--version]
+
+readonly VERSION="1.0.0"
+
+if [[ "${1:-}" == "--version" ]]; then
+    echo "dotfiles_audit ${VERSION}"
+    exit 0
+fi
 
 PASS="✅"
 FAIL="❌"

scripts/test_script_version.py

@@ -0,0 +1,39 @@
+"""Human-run scripts answer --version without doing their real work.
+
+HOME points at an empty temp dir, so a script that ignores the flag and runs
+anyway shows up as extra output or a non-zero exit.
+"""
+
+import os
+import re
+import subprocess
+from pathlib import Path
+
+import pytest
+
+SCRIPTS = Path(__file__).parent
+
+
+@pytest.mark.parametrize(
+    'script',
+    ['bench-shell.sh', 'check-tool-wiring.sh', 'dotfiles_audit.sh'],
+)
+def test_version_prints_one_line_and_exits_zero(
+    tmp_path: Path,
+    script: str,
+) -> None:
+    result = subprocess.run(  # noqa: S603
+        ['bash', str(SCRIPTS / script), '--version'],  # noqa: S607
+        capture_output=True,
+        text=True,
+        env={**os.environ, 'HOME': str(tmp_path)},
+        stdin=subprocess.DEVNULL,
+        timeout=10,
+        check=False,
+    )
+
+    assert result.returncode == 0, result.stderr
+    assert re.fullmatch(
+        rf'{re.escape(script.removesuffix(".sh"))} \d+\.\d+\.\d+\n',
+        result.stdout,
+    )