feat: add modular ONEScript launcher

.github/workflows/ci.yml

@@ -21,4 +21,4 @@ jobs:
         run: ./tests/test-scripts.sh
 
       - name: Run pinned ShellCheck
-        run: docker run --rm -v "$PWD:/mnt:ro" -w /mnt koalaman/shellcheck@sha256:2097951f02e735b613f4a34de20c40f937a6c8f18ecb170612c88c34517221fb scripts/*.sh tests/*.sh
+        run: docker run --rm -v "$PWD:/mnt:ro" -w /mnt koalaman/shellcheck@sha256:2097951f02e735b613f4a34de20c40f937a6c8f18ecb170612c88c34517221fb scripts/*.sh tests/*.sh onescript

README.md

@@ -1,18 +1,62 @@
 # ONEScripts
 
-Independent, reviewed Bash scripts for occasional Linux, VPS, cPanel, and system checks.
+Independent, reviewed Bash modules for occasional Linux, VPS, cPanel, and system checks, plus an optional master CLI for selecting and running the installed catalog.
 
-Each script is standalone: download only the check you need, verify its checksum, and run it with one copyable command. No shared library or repository clone is required on the target system.
+Every module remains standalone: download only the check you need, verify its checksum, and run it with one copyable command. Users who keep the complete catalog can use `onescript` as a non-interactive CLI or interactive terminal menu. The master executes modules; it does not duplicate their diagnostic logic.
 
 ## Safety contract
 
 - Active scripts are read-only checks. They do not install packages, restart services, delete mail, modify firewall rules, or rewrite configuration.
 - Scripts do not intentionally display credentials, message contents, machine identifiers, or unredacted public network addresses.
+- The master uses the checked-in `catalog.tsv` allowlist. It never sources modules, evaluates argument strings, downloads code, installs packages, or performs remediation.
+- Catalog paths are constrained to regular executable files under a real, non-linked `scripts/` directory; linked catalogs, module directories, and module files are rejected.
 - Remote commands download a version-tagged file, verify SHA-256, and execute only after verification succeeds.
 - Never use `curl -k`, `--insecure`, or an unverified `curl | bash` pipeline.
 - Run with root privileges only when a check needs complete service, process, or mail-queue visibility.
 
-## Script catalog
+## Master `onescript` CLI
+
+The master requires a complete verified checkout containing `onescript`, `catalog.tsv`, `SHA256SUMS`, and `scripts/`. Wave 0 is not part of the existing `v2.0.0` release; a version-pinned installation command will be added only when its release is approved and published.
+
+Verify the installed catalog:
+
+```bash
+./onescript doctor
+```
+
+List or inspect modules without opening a menu:
+
+```bash
+./onescript list
+```
+
+```bash
+./onescript info exim-queue-health
+```
+
+Run one module. Module arguments must follow `--` and are passed without shell evaluation:
+
+```bash
+./onescript run directory-sizes -- --all /var
+```
+
+Run several modules with their allowlisted safe defaults:
+
+```bash
+./onescript batch exim-queue-health cpanel-followup-triage
+```
+
+Open the interactive menu:
+
+```bash
+./onescript menu
+```
+
+Running `./onescript` without arguments also opens the menu when both input and output are terminals. Non-interactive automation must use an explicit command.
+
+`run` returns the selected module's status. `batch` preflights every selection, runs them in order, continues after module failures, and returns the first nonzero module status. Launcher usage errors return `2`; catalog, installation, and lookup failures return `1`.
+
+## Module catalog
 
 ### `vps-profile.sh`
 
@@ -54,42 +98,45 @@ One-line invocation:
 (tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/exim-queue-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/exim-queue-health.sh' && printf '%s  %s\n' 'cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22' "$tmp_dir/exim-queue-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/exim-queue-health.sh" && "$tmp_dir/exim-queue-health.sh")
 ```
 
-## Local use
+## Direct module use
 
 Clone the repository and run a script directly:
 
 ```bash
 git clone https://github.com/RomeoRaven/ONEScripts.git && cd ONEScripts && ./scripts/vps-profile.sh ./vps-profile.txt
 ```
 
-Every script supports `--help` and `--version`.
+Every module supports `--help` and `--version` and remains directly executable without the master.
 
 ## Validation
 
-Run the behavioral suite and checksum verification:
+Run the behavioral suites and verify the complete installed catalog:
 
 ```bash
-./tests/test-scripts.sh
+./tests/test-scripts.sh && ./onescript doctor
 ```
 
 Run ShellCheck:
 
 ```bash
-shellcheck scripts/*.sh tests/*.sh
+shellcheck scripts/*.sh tests/*.sh onescript
 ```
 
 GitHub Actions runs both checks for every push and pull request.
 
 ## Adding scripts
 
-A new active script must:
+A new active module must:
 
 1. Be standalone and read-only by default.
 2. Support `--help` and `--version`.
 3. Avoid credentials, private environment data, insecure TLS, and unverified remote execution.
 4. Include behavioral coverage where practical.
-5. Pass Bash parsing, ShellCheck, the repository test suite, and checksum verification.
-6. Include one version-pinned, checksum-bound invocation in this README.
+5. Add one valid `catalog.tsv` row with a stable ID, category, display name, description, requirements summary, path, and `yes|no` safe-default flag.
+6. Pass Bash parsing, ShellCheck, the repository test suite, launcher tests, and checksum verification.
+7. Add the module checksum to `SHA256SUMS` and include one version-pinned, checksum-bound invocation in this README.
+
+Ordinary module additions do not require launcher code changes. Use `menu_safe=no` when a module cannot run meaningfully or safely without explicit arguments; it remains available through direct execution and `onescript run`.
 
 Mutating or remediation scripts require an explicit design review, safe preview behavior, failure handling, and rollback evidence before inclusion.
 

SHA256SUMS

@@ -1,3 +1,5 @@
+877de32b38eaa36295cf16276e1073ddc306f9312663ee5291e5d44aed641c58  onescript
+705c2d2342e4a6180a917d3de20e734fb9d312d827aba98cf5eb94507e9fdb0e  catalog.tsv
 5bb1e14491437c42cf6d5169186a2545176dcbbf5ba4367d84aabf0e851f0a23  scripts/cpanel-followup-triage.sh
 156ea405829ec5c27ed7a462a23e2fe9752704467c93fbc652aef205d24ca65d  scripts/directory-sizes.sh
 cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22  scripts/exim-queue-health.sh

catalog.tsv

@@ -0,0 +1,5 @@
+# id	category	display_name	description	requirements	path	menu_safe
+vps-profile	system	VPS profile	Privacy-reduced VPS and cPanel profile	Bash 4+, standard Linux tools; optional cPanel utilities	scripts/vps-profile.sh	yes
+cpanel-followup-triage	cpanel	cPanel follow-up triage	Focused cPanel service, mail queue, and listener triage	Bash 4+, systemctl, ss; Exim utilities when available	scripts/cpanel-followup-triage.sh	yes
+directory-sizes	storage	Directory sizes	Immediate subdirectory disk usage, largest first	Bash 4+, find, du, sort	scripts/directory-sizes.sh	yes
+exim-queue-health	mail	Exim queue health	Privacy-safe Exim queue counts	Bash 4+, Exim; exiqgrep recommended	scripts/exim-queue-health.sh	yes