fix(module): run the Dotfiles helper surface under StrictMode

[Gerrrt]

What

Set Set-StrictMode -Version Latest inside Dotfiles.psm1, so the non-interactive helper surface (core/05-lib.ps1 + the *.Helpers.ps1 files it re-exports) runs strict — an unbound variable, a missing property, or a bad array index now errors instead of silently returning $null.

Why this placement (and not the interactive profile)

The static-analysis audit flagged that the PowerShell surface never sets StrictMode. The subtlety is where it's safe:

• Not profile.ps1 or the core/os fragments — those are dot-sourced into the interactive session, so StrictMode there would change everyday shell behaviour (referencing an unset $var interactively would start throwing). The audit rated that "defensible as-is," and per-fragment try/catch already isolates load failures.
• Yes the Dotfiles module — Set-StrictMode inside a .psm1 is module-scoped. Even under Import-Module -Global (how profile.ps1 loads it), it hardens the module's own functions without touching the interactive session. That's exactly the "module surface" the audit pointed at.

Validation (the part that was missing)

A hardening you can't test isn't worth much. The Serve / Doctor / Help / WslBridge suites already exercise the surface via Import-Module Dotfiles.psd1, so they now run those helpers under the module's StrictMode automatically. Lib.Tests.ps1 dot-sources core/05-lib.ps1 directly, so it now sets StrictMode in its BeforeAll to cover the remaining pure helpers. CI's Pester run (Invoke-Validation.ps1) therefore validates the whole surface under strict mode — if any helper has a latent unbound-var/property/index bug, the suite fails here rather than in a real session.

Changes

• powershell/Dotfiles/Dotfiles.psm1 — Set-StrictMode -Version Latest (module-scoped).
• tests/Lib.Tests.ps1 — StrictMode in BeforeAll so the directly-dot-sourced helpers are covered.
• CHANGELOG.md — [Unreleased] → Fixed entry.

Note

I authored this without a local PowerShell/Pester runner, so I'm relying on this repo's CI Pester suite as the validation gate. If it surfaces a latent StrictMode violation in a helper, that's the guard doing its job — I'll follow up with the fix.

🤖 Generated with Claude Code

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR hardens the repository’s non-interactive PowerShell helper surface by enabling Set-StrictMode -Version Latest at the Dotfiles module scope, and adjusts test coverage so CI validates those helpers under StrictMode.

Changes:

• Enable module-scoped StrictMode in powershell/Dotfiles/Dotfiles.psm1 so helper functions error on common latent issues (unbound vars / missing properties) instead of returning $null.
• Update tests/Lib.Tests.ps1 to run the dot-sourced helper library under StrictMode as well.
• Document the behavior change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
powershell/Dotfiles/Dotfiles.psm1	Sets module-scoped StrictMode before dot-sourcing helper surfaces.
tests/Lib.Tests.ps1	Adjusts StrictMode setup for helper tests to align with module behavior.
CHANGELOG.md	Adds an Unreleased “Fixed” entry documenting the StrictMode hardening.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.