fixed spellcheck and minor issues for release

doc/CHANGELOG.md

@@ -13,209 +13,40 @@ Versions follow `MAJOR.MINOR.PATCH-REVISION_STAGE_N` (e.g. `3.99.1-4_rc_1`).
 
 ## [4.2.0] — 2026-10-13
 
+Full review of every module and of `profile.sh`: many bug fixes, comments and
+documentation updated.
+
 ### Added
 
-- `backtrace`, `locale_check` and `get_pkgmgr` answer `-h` / `--help`, and are
-  listed (with `error` and `set_colors`) in the README functions table and in
-  `help`.
-- `pkgi` (install) and `pkgr` (uninstall, with `-p`/`--purge` and `-d`/`--deps`)
-  commands for apt, dnf/yum, zypper, pacman, apk, portage, xbps and nix; both
-  accept `-y`/`--yes` and `-n`/`--dry-run` and use `sudo` (or `doas`) when needed.
-- `utaz -i` / `--ignore-case` and `-s` / `--case-sensitive` switches to match
-  archive extensions case-insensitively or not; the default is set by the new
-  `UTAZ_DEFAULT_IGNORE_CASE` key of the `[compress]` section (default `0`).
-- `SETTRACE_DEFAULT_ENABLED` key in the new `[debug]` configuration options
-  (default `0`): activates `settrace --on` at startup of interactive shells.
-- `utaz` supports bare `.zst` files and `.tzst` archives; `taz -q` is now
-  effective.
+- `pkgi` (install) and `pkgr` (uninstall; `-p`/`--purge`, `-d`/`--deps`).
+- `utaz -i`/`--ignore-case` and `-s`/`--case-sensitive`, default set by
+  `UTAZ_DEFAULT_IGNORE_CASE`; `.zst` and `.tzst` support.
+- `SETTRACE_DEFAULT_ENABLED` key (`[debug]` section).
+- `--help` for `backtrace`, `locale_check` and `get_pkgmgr`; support functions
+  added to the README table and to `help`.
 
 ### Changed
 
-- Internal helpers are now delivered apart from the modules, in the new
-  `helpers/` directory: `helpers/common.sh` (shared helpers, loaded by
-  `profile.sh` before the modules) and `helpers/<module>.sh` (private helpers
-  of `profile.d/<module>.sh`, loaded by the module itself when the file exists).
-  `_fun_is_uint` became the shared `_is_uint`.
+- Internal helpers moved to the new `helpers/` directory: `common.sh` (shared)
+  and `<module>.sh` (private to a module, loaded by the module itself).
+- Option parsing and trap restoration no longer use `xargs` or `eval`
+  (`_getopt_split`, `_trap_restore`).
+- `myextip` uses an HTTPS service (`ipinfo.io`) by default.
+- `showinfo` prefers `fastfetch` over `neofetch`.
 
 ### Fixed
 
-- `locale_check` without argument failed under `set -u`.
-- Copyright years: `processes.sh` (2013-2022) updated, the license block added
-  to the two bash-completion scripts.
-- `taz`: a plain file with the `tar` format could be deleted instead of being
-  archived; existing `<item>.tar` files are no longer overwritten; trailing
-  slashes, `.`/`..` and names starting with `-` are handled; the `gzip`
-  fallback (no `pigz`) works again.
-- `utaz`: single top-level directory flattening, `--no-dir` target location,
-  `foo.tar.gz` host directory name and `.tar.lz` extraction.
-- `conf_save`: no longer replaces a symlinked configuration file by a regular
-  one, keeps the file permissions, rejects multi-line values, and inserts a new
-  key before the trailing comments/banner of its section instead of under the
-  next section's banner; leading blanks before a `[section]` are recognised.
-- `conf_dump -a`: a commented default is no longer listed when the key is set
-  later in the same section; `NO_COLOR` is honoured; names with newlines or
-  backslashes in arguments are handled.
-- `term_set`: `COLORTERM=truecolor` no longer short-circuits every other probe
-  (it selected `xterm-direct` even inside tmux/screen or VTE terminals);
-  multiplexers (tmux, screen) are now checked before emulator hints, since they
-  inherit the emulator's variables.
-- `debug.sh`: the trace is now written to stderr (it used to pollute captured
-  `$(...)` output) and includes the exit status; `backtrace` and `error` are
-  exported like `settrace`; `settrace` tells its own trap from a foreign one
-  (`--status`, and `--off` no longer removes a foreign trap without `--force`);
-  `--on` when already active is only a warning; `getopt` errors name the command.
-- All modules: counters updated with `((x++))`-style commands (which return a
-  non-zero status when the value was 0) now use plain assignments, so they no
-  longer trigger the ERR trace or break `set -e`.
-- `disp`: a message hidden by `QUIET`/`DEBUG` no longer returns a non-zero
-  status; no reset escape sequence under `NO_COLOR`; debug messages go to
-  stderr; works under `set -u`; faster wrapping.
-- `mdcat`: tables inside fenced code blocks are shown as code; code spans and
-  `\_`-style escapes are protected from emphasis/link parsing; `NO_COLOR` is
-  honoured in tables and headings; fewer subprocesses when rendering tables;
-  newlines in arguments no longer break option parsing.
-- `filefct.sh`: `findzero` with `fd` listed (and `--delete` removed) one-byte
-  files; `findzero --delete` could remove symlinks to empty files; `rmspc`
-  overwrote existing files, passed a wrong replacement character to
-  subdirectories with `-r -c X`, followed symlinked directories and mishandled
-  `&` as replacement; `expandlist` split names containing spaces, ignored `\n` in
-  its separator and reset the caller's `nullglob`; `file_stats` histogram was
-  unordered, `--min` was exclusive and invalid sizes silently gave no result;
-  `findbig` accepted an invalid configured limit; names starting with `-` are
-  handled; `finddead` and `findzero` no longer return 1 when the last entry
-  was skipped.
-- `fun.sh`: the configured delays and language of `busy`, `fake_compile` and
-  `hack` are now validated (a non-numeric value was evaluated as an
-  arithmetic expression, and an invalid language looped without sleeping);
-  Ctrl-C no longer leaves the background job running, nor does a shell without
-  job control; a missing terminal is reported; the positional pattern of
-  `busy` documented in its usage now works; `grep`/`read` no longer mangle
-  patterns starting with `-` or lines with leading blanks; `awk` is no longer
-  forked for each pause.
-- `git.sh`: `gprune --deep` never deleted anything (`<branch>@{upstream}` fails
-  once the remote branch is gone; it now reads the configured upstream ref);
-  `gprune` returned 1 on success and could not be told which branches are
-  protected (`GIT_MAIN_BRANCH` is now honoured); `greset` stashed the local
-  changes before checking that the target exists, ignored untracked files
-  outside the current directory and cleaned only below it; `gsync` could fetch
-  a different remote than the one it rebased on; `gacp`/`gsync` handle remote
-  and branch names containing slashes, and refuse a detached HEAD; `ggraph`
-  rejects a limit of 0; internal helpers are exported with the commands.
-- `help`: `help <command>` no longer runs arbitrary external programs with
-  `--help` (profile functions only); `NO_COLOR` is honoured; `kt`, `pinfo` and
-  `help` itself are listed, and the list is in alphabetical order again.
-- `pinfo`: GPUs were listed once per display connector (nine "GPUs" on a
-  single-GPU laptop); the `/proc/bus/pci` fallback could never match; free
-  memory is estimated on kernels without `MemAvailable`; `/usr/lib/os-release`
-  is used as a fallback; `NO_COLOR` is honoured; internal variables and the
-  helper no longer leak into the shell. `showinfo` no longer needs the
-  `hostname` binary.
-- `showinfo`: `fastfetch` is now preferred over the unmaintained `neofetch`.
-- `lang.sh`: `setlocale` (and the `SET_LOCALE` shortcuts) had no effect after
-  `setc`, because `LC_ALL` stayed set; `setc` and the shortcuts changed the
-  locale when called with `--help` (and thus through `help <command>`);
-  `setlocale fr_FR` could pick a non-UTF-8 charset; shortcut functions are built
-  without evaluating the raw configuration value, and an alias cannot replace
-  `setlocale` or `setc`.
-- `myextip`: now uses the HTTPS `https://ipinfo.io/json` API by default, since
-  the free ip-api.com tier is HTTP only (HTTPS answers 403); ipwho.is and the
-  ip-api.com format are still understood, a Timezone line and the postal code
-  are shown, an unexpected answer is reported instead of printing `jq` errors,
-  and a non-HTTPS URL gives a warning.
-- `net.sh`: `dwl` always returned 0 (the cleanup after the transfer masked
-  curl's status), so no caller ever saw a failed download; HTTP errors (404,
-  403, ...) are now failures instead of saved error pages; `urlencode`
-  mis-encoded accents under `LC_ALL` and now uses `%20` for spaces; `isipv4`
-  leaked a variable.
-- `packages.sh`: `pkgf ls` now looks the command up in the `PATH`; `pkgs`
-  accepts patterns starting with `-`; `suse` is recognised in `ID_LIKE`.
-- `processes.sh`: `ku -9 user` / `kt -KILL pid` were rejected by option parsing
-  although documented (kill-style signals are now extracted before `getopt`);
-  `ku` accepts numeric user IDs (killall only takes names), checks all users
-  before killing, returns a failure status when a kill fails, and refuses
-  root and the current user; `kt` no longer re-parses its options for each
-  child, validates the PID and refuses the current shell; `ppn` matched PIDs
-  and names such as `kde-bash` (now exact); `ppg`/`gpid` fallbacks no longer
-  match their own `awk`; `PPU_DEFAULT_FORMAT` documented with its real value.
-- `prompt.sh` (security): a git branch, conda environment or virtualenv named
-  like `x$(command)` was **executed** each time the prompt was drawn, because the
-  names were copied into `PS1`; the context segment is now referenced as a
-  variable and never re-expanded.
-- `prompt.sh`: the exit status shown in the prompt was always `0` (the nested
-  function definitions at the top of `set_prompt` reset `$?`; they are now
-  defined once at load time); `PROMPT_COLOR_*` overrides of the `[prompt]`
-  section never beat the theme and `$ColorName` values were emptied by
-  `parse_conf` in a fresh login shell (now resolved, validated, and re-applied
-  after `set_theme`); `set_theme --preview` left the previewed colours behind
-  when none were set before, and a switch to a partial theme kept the previous
-  theme's colours; the prompt no longer forks `date` twice per command
-  (`$EPOCHREALTIME`) and runs one `git status` instead of three git commands,
-  without taking the index lock.
-- `pwd.sh` (security): `genpwd` drew its characters from `$RANDOM` (15 bits,
-  predictable seed); it now uses `$SRANDOM` or `/dev/urandom` with unbiased
-  selection and shuffle. Its info message goes to stderr, so `pw=$(genpwd)`
-  captures only the password; the `GENPWD_DEFAULT_*` values are validated
-  (they were evaluated as arithmetic expressions); `pwdscore` classifies
-  characters with locale-proof classes; README default of
-  `GENPWD_DEFAULT_OCCURS` corrected.
-- `rain.sh`: the terminal was left with the last drop colour active, the cursor
-  parked over the frozen last frame and the user's `INT`/`TERM`/`WINCH` traps
-  deleted and `stty` forced to `echo`: the screen is now cleared and the traps
-  and terminal settings restored; a resize now clears the screen and drops
-  (drops placed for the old size lingered); a drop vanished for one frame each
-  time another one left the screen; each frame is written with one `printf`
-  instead of one per character (output is byte-identical, a lot faster);
-  colour and charset names are case-insensitive (`RAIN_DEFAULT_COLOR=Green`, as
-  documented, fell back to white), an unknown colour is an error instead of a
-  silent white, a null speed no longer spins the CPU, a non-terminal stdin or
-  stdout is refused instead of looping, and the usage mentions `q` to quit;
-  README defaults of the `[rain]` keys corrected.
-- `ssh.sh`: `rmhost` with a wildcard that matched nothing tried to remove an
-  empty host name; it removed only the first IP of a name (all addresses are
-  now handled); `[host]:port` arguments were taken for glob patterns; each
-  match was removed from every file with warnings for the others (now per
-  file); with `--all-users`, `ssh-keygen` left other users' files owned by
-  root (owner and mode are restored) and a shared home directory was
-  processed twice; `@cert-authority` lines are never touched. `ssr` ignored an
-  empty `SSH_DEFAULT_OPT` (documented as "no option") and now rejects an
-  option given in place of the server.
-- `updates.sh`: the published version file, read from the network, was displayed
-  without checking (escape sequences could reach the terminal at every
-  startup): it is now validated, and compared as a version (an installed
-  development version was reported as outdated); in quiet mode errors are really
-  silent; `profile_upgrade --switch-to-git` left the user's `profile.conf` and
-  custom themes in the backup directory (they are now copied to the new
-  clone); `git pull` could create merge commits or conflict markers in the
-  installed scripts (now `--ff-only`); the branch name is validated; archives
-  with absolute or `..` paths are refused and extracted without their owners;
-  modules removed upstream and still loaded are reported; git operations no
-  longer change the shell's directory stack.
-- All modules: the option parsing no longer uses `xargs`, which broke on
-  arguments or file names containing a newline, nor `eval`: a new
-  `helpers/common.sh` provides `_getopt_split` (and `_trap_restore`), pure bash
-  helpers; the `nullglob` and trap restorations no longer use `eval` either.
-- `profile.sh`: the shell check used `$SHELL` (the login shell: unset under cron
-  or systemd, unrelated to the running shell) and made the profile refuse to
-  load; it now tests `BASH_VERSION`; options are only handled when the file is
-  executed (a script with its own arguments that sources the profile no longer
-  gets `--install` run, or "Unknown option" and a profile that does not load);
-  `PROMPT_COMMAND` is no longer replaced (VTE, direnv, `history -a`, ... keep
-  working; `set_prompt` runs last and the exit status is saved first);
-  `INTERACTIVE`, exported to the environment, made non-interactive child shells
-  run the whole interactive start-up; `pathappend` moved existing entries to the
-  end of `PATH` (demoting `~/.local/bin` set by Debian's `~/.profile`) and root's
-  `/sbin:/usr/sbin` was added as one unmatchable entry on each load; a symlinked
-  `profile.sh` was not followed; inline comments in `profile.conf`
-  (`KEY = value  # note`, as the README shows) became part of the value, and a
-  line that is not `key = value` created a bogus key; the caller's `nullglob`
-  setting was reset; `--install` added a second line when the profile was
-  already sourced in another form, and did not escape special characters in the
-  path; loop variables leaked.
-- `lang.sh`: no more "Overriding existing function" warning for locale shortcuts
-  inherited from a parent shell. `compress.sh`: `mapfile -d` (bash 4.4) replaced,
-  the profile supports bash 4.3.
-- `compress.sh`: option flags and loop variables no longer leak into the
-  interactive shell.
+- Security: prompt injection through git branch / environment names, `genpwd`
+  weak random source, unsafe handling of values read from the network or from
+  the configuration.
+- Many functional bugs in `taz`/`utaz`, `conf_save`/`conf_dump`, `term_set`,
+  `disp`/`mdcat`, `findzero`, `gprune`, `setlocale`, `dwl`, `ku`/`kt`, `pkgf`,
+  `rmhost`, `rain`/`matrix`, `profile_upgrade` and the prompt exit status.
+- `profile.sh`: shell check, option handling when sourced, `PATH` and
+  `PROMPT_COMMAND` handling, configuration parsing.
+- Debug traces go to stderr; `((x++))` patterns no longer fail under `set -e`.
+- Copyright years and license headers; the whole project is now `shellcheck`
+  clean (`.shellcheckrc` added).
 
 ---