Add cdiff and safe scp alias

The check_tools_repo (git ls-remote | awk) and update_dotfiles (git fetch)
background jobs could stall on a network call and, being disowned (&!),
orphan into days-long processes holding unreaped git/awk children.

Bound both network probes with `timeout` (guarded, absent on macOS) and
disable ssh multiplexing so no daemonized mux master inherits our fds.
Also dedup the double update_dotfiles startup call.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore_global

@@ -24,3 +24,5 @@ __MACOSX/
 .disk_label*
 lost+found
 .nobackup
+
+**/.claude/settings.local.json

AGENTS.md

@@ -0,0 +1,37 @@
+# AGENTS.md
+
+This file provides guidance to AI Agents when working with code in this repository.
+
+This is a personal dotfiles repository targeting macOS (Apple Silicon + Intel) and Arch Linux. It is installed by symlinking config directories/files from the repo into `$HOME`, so files here are live configs — editing them changes the running system.
+
+## Installation & setup
+
+Setup is platform-specific and runs from the repo root:
+
+- **macOS:** `./setup_mac.sh` — brews dependencies, creates a `neovim` virtualenv, then calls `./clone_and_link_mac.sh`. Uses GNU coreutils' `gln` (not `ln`), so coreutils must be installed first.
+- **Arch:** `./setup_arch.sh` — pacman deps, then `./clone_and_link.sh` + `./copy_fonts_arch.sh`.
+- `clone_and_link*.sh` create the symlinks (`~/.zsh`, `~/.zshrc`, `~/.tmux`, `~/.tmux.conf`, `~/.config/nvim`, `~/.config/alacritty`, virtualenvwrapper hooks). `link_config.sh` is a simpler standalone variant.
+- `general_setup.sh` switches the login shell to zsh and triggers plugin installs.
+
+## Platform-specific config via `.example` templates
+
+The most important repo-wide convention: platform variants live as `.example` files and the active file is a symlink/copy produced at setup time. The setup scripts loop over files matching `zsh/.*_mac.example`, `tmux/.*_arch.example`, etc., and link/copy each to the name with the `_<platform>.example` suffix stripped.
+
+Practical rule: **edit the `.example` source, not the generated symlink target.** The unsuffixed active files are git-ignored (see each subdir's `.gitignore`). Templates that are copied (not symlinked) at setup — `nvim/scheme.vim.template` → `scheme.vim`, `.config/alacritty/schemes.yml.template` → `schemes.yml` — are also git-ignored once activated.
+
+## Component architecture
+
+- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
+- **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
+- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
+- **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
+- **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
+
+## Light/dark theme switching
+
+`.config/alacritty/color_switcher.py` toggles light/dark across the terminal **and** nvim in one shot: it rewrites the `import` line in `alacritty.toml` (`solarized_light.toml` ↔ `dark_mode.toml`) and the `background`/`colorscheme` lines in `~/.config/nvim/scheme.vim`. Keep the regex-matched line formats in those files intact when editing them by hand. `screenshot_mode.py` is a related toggle.
+
+## Maintenance
+
+- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also runs `claude --update` and `Codex --update`.
+- `brew_autoupdate` — sets up scheduled brew auto-updates.

CLAUDE.md

@@ -1,37 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-This is a personal dotfiles repository targeting macOS (Apple Silicon + Intel) and Arch Linux. It is installed by symlinking config directories/files from the repo into `$HOME`, so files here are live configs — editing them changes the running system.
-
-## Installation & setup
-
-Setup is platform-specific and runs from the repo root:
-
-- **macOS:** `./setup_mac.sh` — brews dependencies, creates a `neovim` virtualenv, then calls `./clone_and_link_mac.sh`. Uses GNU coreutils' `gln` (not `ln`), so coreutils must be installed first.
-- **Arch:** `./setup_arch.sh` — pacman deps, then `./clone_and_link.sh` + `./copy_fonts_arch.sh`.
-- `clone_and_link*.sh` create the symlinks (`~/.zsh`, `~/.zshrc`, `~/.tmux`, `~/.tmux.conf`, `~/.config/nvim`, `~/.config/alacritty`, virtualenvwrapper hooks). `link_config.sh` is a simpler standalone variant.
-- `general_setup.sh` switches the login shell to zsh and triggers plugin installs.
-
-## Platform-specific config via `.example` templates
-
-The most important repo-wide convention: platform variants live as `.example` files and the active file is a symlink/copy produced at setup time. The setup scripts loop over files matching `zsh/.*_mac.example`, `tmux/.*_arch.example`, etc., and link/copy each to the name with the `_<platform>.example` suffix stripped.
-
-Practical rule: **edit the `.example` source, not the generated symlink target.** The unsuffixed active files are git-ignored (see each subdir's `.gitignore`). Templates that are copied (not symlinked) at setup — `nvim/scheme.vim.template` → `scheme.vim`, `.config/alacritty/schemes.yml.template` → `schemes.yml` — are also git-ignored once activated.
-
-## Component architecture
-
-- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
-- **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
-- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
-- **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
-- **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
-
-## Light/dark theme switching
-
-`.config/alacritty/color_switcher.py` toggles light/dark across the terminal **and** nvim in one shot: it rewrites the `import` line in `alacritty.toml` (`solarized_light.toml` ↔ `dark_mode.toml`) and the `background`/`colorscheme` lines in `~/.config/nvim/scheme.vim`. Keep the regex-matched line formats in those files intact when editing them by hand. `screenshot_mode.py` is a related toggle.
-
-## Maintenance
-
-- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also runs `claude --update`.
-- `brew_autoupdate` — sets up scheduled brew auto-updates.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

nvim/ftplugin/tex.vim

@@ -1,4 +1,4 @@
-set formatoptions+=1rnmBa
+setlocal formatoptions+=1rnmBj
 
 " Reformat lines (getting the spacing correct) {{{
 fun! TeX_fmt()

tmux/.tmux.conf

@@ -27,8 +27,19 @@ bind -T off F12 \
 setw -g mode-keys vi
 set-option -g status-keys vi
 
-bind | split-window -h -c '#{pane_current_path}'
-bind - split-window -v -c '#{pane_current_path}'
+# Splits keep the source pane's cwd AND its active Python venv. #{@venv} is set
+# per-pane by the shell (see .virtual_env_config.zsh); we go through run-shell
+# because tmux expands FORMATS in a run-shell command but NOT in split-window's
+# own -e value. The new pane inherits VIRTUAL_ENV and .zshrc re-activates it;
+# when the source pane has no venv we omit -e so no empty var leaks in. New
+# *windows* deliberately don't inherit it.
+bind | run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -h -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -h -c "$d"; fi'
+bind - run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -v -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -v -c "$d"; fi'
+
+# New windows always start in the base environment: -e clears any inherited
+# VIRTUAL_ENV (e.g. if the tmux server was first started from inside a venv, so
+# its global env carries one), regardless of what the source pane had.
+bind c new-window -e VIRTUAL_ENV=
 
 # Switch windows
 bind-key -n M-Left select-window -t -1

update_mac.sh

@@ -59,6 +59,11 @@ function update_others {
         echo "-- CLAUDE"
         claude --update
     fi
+
+    if [ -x "$(command -v codex)" ]; then
+        echo "-- CODEX"
+        codex update
+    fi
 }
 
 if [[ $* == *--help* ]]; then

zsh/.mac_config.zsh_mac.example

@@ -30,3 +30,9 @@ fi
 export DYLD_FALLBACK_LIBRARY_PATH="$HOMEBREW_PREFIX/lib:${DYLD_FALLBACK_LIBRARY_PATH}"
 export GI_TYPELIB_PATH="$HOMEBREW_PREFIX/lib/girepository-1.0:${GI_TYPELIB_PATH}"
 export PKG_CONFIG_PATH="$HOMEBREW_PREFIX/lib/pkgconfig:$HOMEBREW_PREFIX/share/pkgconfig:${PKG_CONFIG_PATH}"
+alias claude="workon claude; claude; deactivate"
+alias python="python3"
+
+# Tahoe 26 WindowServer bug: windows stay interactive but can't be moved by
+# mouse or API until the window-management daemon is restarted (no logout).
+alias unstick-windows="killall WindowManager"

zsh/.virtual_env_config.zsh_mac.example

@@ -10,6 +10,20 @@ export VIRTUALENVWRAPPER_VIRTUALENV=$PREFIX/bin/virtualenv
 mkdir -p $WORKON_HOME
 source $PREFIX/bin/virtualenvwrapper.sh
 
-if [ -n "$VIRTUAL_ENV" ] && [[ -f "$VIRTUAL_ENV/bin/activate" ]]; then
-      source $VIRTUAL_ENV/bin/activate;
+# NOTE: an inherited VIRTUAL_ENV is *not* re-activated here — that happens at the
+# very end of .zshrc so activate captures the fully-built PATH (see the comment
+# there). Sourcing virtualenvwrapper.sh above only defines workon/deactivate/etc.
+
+# Mirror the current venv into a per-pane tmux option so that splitting a pane
+# can carry it into the new pane (.tmux.conf reads #{@venv} with `-e`). Per-pane
+# (not session) state is what lets two panes hold different venvs and lets new
+# *windows* start clean. Only fork tmux when the value actually changes.
+_venv_track_precmd() {
+    [[ -n $TMUX ]] || return
+    if [[ "${VIRTUAL_ENV:-}" != "${_LAST_TRACKED_VENV-unset}" ]]; then
+        tmux set -p @venv "${VIRTUAL_ENV:-}" 2>/dev/null
+        _LAST_TRACKED_VENV="${VIRTUAL_ENV:-}"
     fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd _venv_track_precmd

zsh/.zshrc

@@ -12,7 +12,13 @@
 # Per-branch, so `server` on each device fast-forwards to origin/server.
 update_dotfiles() {
     local repo="$HOME/dotfiles"
-    git -C "$repo" fetch --quiet 2>/dev/null || return
+    # Bound the network call so a stalled fetch can't wedge this backgrounded
+    # (&!) job into a days-long orphan holding unreaped children. `timeout` is
+    # absent on macOS, so only use it when present. Disable ssh multiplexing so
+    # no daemonized mux master can inherit and keep our fds open past git's exit.
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 15)
+    GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+        $TO git -C "$repo" fetch --quiet </dev/null 2>/dev/null || return
     git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return    # no upstream
     git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return # already current
     git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null \
@@ -20,6 +26,38 @@ update_dotfiles() {
 }
 
 update_dotfiles &!
+
+# On shell start, check the security tools repo for upstream updates and print a
+# one-line notice if the checkout is behind. Notify only (never auto-pull). This
+# stays read-only so it works even when the repo lives in root-owned /opt/tools:
+#   - `safe.directory=*` sidesteps git's "dubious ownership" refusal on a repo
+#     owned by root, which would otherwise fail every git command.
+#   - `ls-remote` queries the remote without writing into .git (a normal user
+#     can't write a root-owned .git, so `fetch` would fail there).
+# Uses the first candidate that is a git checkout; covers global and per-user layouts.
+check_tools_repo() {
+    local repo branch remote mergeref remote_sha local_sha cmd
+    # See update_dotfiles: bound the network probe (timeout, absent on macOS) and
+    # disable ssh multiplexing so a stalled ls-remote can't orphan this &! job.
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 10)
+    for repo in /opt/tools "$HOME/tools" "$HOME/tools/tools-repo"; do
+        local -a g=(git -c 'safe.directory=*' -C "$repo")
+        $g rev-parse --is-inside-work-tree >/dev/null 2>&1 || continue
+        branch=$($g symbolic-ref --short HEAD 2>/dev/null) || return
+        remote=$($g config "branch.$branch.remote" 2>/dev/null) || return         # no upstream
+        mergeref=$($g config "branch.$branch.merge" 2>/dev/null) || return
+        remote_sha=$(GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+            $TO $g ls-remote "$remote" "$mergeref" </dev/null 2>/dev/null | awk '{print $1}')
+        local_sha=$($g rev-parse HEAD 2>/dev/null)
+        [[ -n "$remote_sha" && -n "$local_sha" ]] || return                       # remote unreachable
+        [[ "$remote_sha" == "$local_sha" ]] && return                             # already current
+        $g merge-base --is-ancestor "$remote_sha" HEAD 2>/dev/null && return       # remote is an ancestor: ahead/equal (also true if we lack the object -> falls through to "behind")
+        [[ -w "$repo/.git" ]] && cmd="git -C $repo pull" || cmd="sudo git -C $repo pull"
+        print -u2 "⬆ tools: updates available in $repo — run: $cmd"
+        return
+    done
+}
+check_tools_repo &!
 export LC_OSC52=1
 
 # Load Antidote
@@ -63,13 +101,14 @@ bindkey "^w" kill-region
 bindkey -v
 VI_MODE_SET_CURSOR=true
 
-alias vim=nvim
+(( $+commands[nvim] )) && alias vim=nvim
 alias sudo='sudo '
-export EDITOR='nvim'
-export VISUAL='nvim'
+(( $+commands[nvim] )) && export EDITOR='nvim'
+(( $+commands[nvim] )) && export VISUAL='nvim'
 
 alias ls="ls --color=always"
 alias cgrep="grep --color=always"
+alias cdiff="git diff --color-words --no-index"
 
 delzip() {
    unzip -Z -1 "$@" |  xargs -I{} rm -rf {}
@@ -83,6 +122,11 @@ if `which go &>/dev/null`; then
     export GOPATH=$(go env GOPATH)
 fi
 
+# Use safecp/safemv from the tools-repo when available (after ~/.local/bin is on PATH)
+(( $+commands[safecp] )) && alias cp=safecp
+(( $+commands[safemv] )) && alias mv=safemv
+(( $+commands[safescp] )) && alias scp=safescp
+
 if [[ -f ~/.ssh/sudo_key ]]; then 
     [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &> /dev/null
     SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q `ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}'` || SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
@@ -132,3 +176,28 @@ zstyle :bracketed-paste-magic paste-finish pastefinish
 
 # https://github.com/zsh-users/zsh-autosuggestions/issues/351
 ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)
+export PATH=$PATH:/Users/ising/.runai/bin
+source <(/Users/ising/.runai/bin/runai --quiet completion zsh)
+
+# Re-activate an inherited virtualenv — MUST be the last PATH-affecting line.
+#
+# When VIRTUAL_ENV is present in the environment (a tmux pane split carries it
+# in via `-e VIRTUAL_ENV=...`, see .tmux.conf) we source the venv's activate
+# script here rather than in .virtual_env_config.zsh. activate snapshots the
+# current PATH into _OLD_VIRTUAL_PATH and restores it on `deactivate`; if we
+# activated earlier (before .mac_config.zsh, go, runai below all prepend to
+# PATH) that snapshot would be incomplete and `deactivate` would strip
+# ~/.local/bin & friends — dropping claude and co. off PATH. Keeping this last
+# guarantees the snapshot is the fully-built PATH.
+#
+# ANY new PATH mutation must go ABOVE this block.
+#
+# A new tmux window clears the var to empty (`bind c ... -e VIRTUAL_ENV=`) to
+# force the base environment; drop that empty value so nothing sees a bogus venv.
+[ -z "${VIRTUAL_ENV:-}" ] && unset VIRTUAL_ENV
+if [ -n "$VIRTUAL_ENV" ] && [ -f "$VIRTUAL_ENV/bin/activate" ]; then
+    # Guard against double-activation on a manual `source ~/.zshrc`.
+    if [[ ":$PATH:" != *":$VIRTUAL_ENV/bin:"* ]]; then
+        source "$VIRTUAL_ENV/bin/activate"
+    fi
+fi