[RG] Note that -uu doesn't undo config globs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.config/alacritty/alacritty.toml

@@ -9,15 +9,15 @@ TERM = "xterm-256color"
 size = 14
 
 [font.bold]
-family = "Fira Mono for Powerline"
+family = "FiraMono Nerd Font Mono"
 style = "Bold"
 
 [font.italic]
-family = "Fira Mono for Powerline"
+family = "FiraMono Nerd Font Mono"
 style = "Regular"
 
 [font.normal]
-family = "Fira Mono for Powerline"
+family = "FiraMono Nerd Font Mono"
 style = "Medium"
 
 [[keyboard.bindings]]
@@ -60,7 +60,7 @@ y = 0
 [[keyboard.bindings]]
 key = "Return"
 mods = "Shift"
-chars = "\u001B\r"
+chars = "\u001B[13;2u"
 
 [[keyboard.bindings]]
 key = "Slash"

.config/atuin/config.toml

@@ -0,0 +1,7 @@
+## Overrides only; all defaults: `atuin default-config`
+
+## brew/pacman handle updates; no version check against api.atuin.sh
+update_check = false
+
+## Enter puts the command on the prompt for editing (like fzf) instead of running it
+enter_accept = false

.config/ripgrep/config

@@ -0,0 +1,6 @@
+# Loaded via RIPGREP_CONFIG_PATH (zsh/.zshrc). Hidden dirs (.venv, .claude,
+# .codex) are skipped by default. -uu doesn't undo the globs: use --no-config.
+--smart-case
+--glob=!*venv/
+--glob=!node_modules/
+--glob=!__pycache__/

AGENTS.md

@@ -21,9 +21,9 @@ Practical rule: **edit the `.example` source, not the generated symlink target.*
 
 ## Component architecture
 
-- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
+- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed). [atuin](https://github.com/atuinsh/atuin) records history with cwd/exit code and owns Ctrl-R (over fzf); its config is `.config/atuin/config.toml` via `ATUIN_CONFIG_DIR`, data stays in `~/.atuin`.
 - **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
-- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
+- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper. On macOS, `.mac_config` binds `prefix+P` to `tmux/op_password_paste.zsh` (pastes a 1Password password into the pane, e.g. remote sudo; needs the `op` CLI with app integration).
 - **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
 - **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
 
@@ -33,5 +33,5 @@ Practical rule: **edit the `.example` source, not the generated symlink target.*
 
 ## Maintenance
 
-- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also updates Alacritty from its verified upstream release, then runs `claude --update` and `Codex --update`.
+- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also updates Alacritty from its verified upstream release and antidote plugins (not updated at shell start), tmux plugins (TPM) and nvim plugins (vim-plug, headless), cleaning plugins no longer in the config, then runs `claude --update` (+ marketplaces and user-scope plugins), `codex update` (+ Git plugin marketplaces), and `pi update` (incl. extensions) when installed, plus `skills update --global` (brew `skills`) for skills in `~/.agents/skills`. MCP servers need nothing: they're remote or launched via `npx …@latest`.
 - `brew_autoupdate` — runs scheduled brew and Alacritty auto-updates.

clone_and_link_mac.sh

@@ -9,12 +9,13 @@
 
 gln -Tsv $PWD/zsh $HOME/.zsh
 gln -Tsv ~/.zsh/.zshrc $HOME/.zshrc
+gln -Tsv ~/.zsh/.zprofile $HOME/.zprofile
 gln -Tsv $PWD/tmux $HOME/.tmux
 gln -Tsv ~/.tmux/.tmux.conf $HOME/.tmux.conf
 gln -Tsv $PWD/nvim $HOME/.config/nvim
 gln -Tsv $PWD/.config/alacritty $HOME/.config/alacritty
 gln -Tsv $PWD/zsh/.p10k.zsh_mac.example $PWD/zsh/.p10k.mac.zsh
-gln -Tsv $PWD/zsh/.mac_config.example $PWD/zsh/.mac_config
+gln -Tsv $PWD/zsh/.mac_config.zsh_mac.example $PWD/zsh/.mac_config.zsh
 gln -Tsv $PWD/zsh/.virtual_env_config.zsh_mac.example $PWD/zsh/.virtual_env_config.zsh
 gln -fsv $PWD/virtualenvwrapper/* $VIRTUALENVWRAPPER_HOOK_DIR
 gln -Tsv $PWD/update_mac.sh $HOME/update_mac.sh

gitconfig/attributes

@@ -0,0 +1,6 @@
+# hunk headers show the enclosing heading/section
+*.md diff=markdown
+gitconfig diff=ini
+*.gitconfig diff=ini
+*.ini diff=ini
+*.toml diff=ini

gitconfig/gitconfig

@@ -1,31 +1,33 @@
 # This is Git's per-user configuration file.
 [user]
 # Please adapt and uncomment the following lines:
-name = Fabian Ising
-email = github@murgi.de
+	name = Fabian Ising
+	email = github@murgi.de
 
 [includeIf "hasconfig:remote.*.url:https://github.com/**"]
-    path = ~/dotfiles/gitconfig/github.gitconfig
+	path = ~/dotfiles/gitconfig/github.gitconfig
 [includeIf "hasconfig:remote.*.url:git@github.com/**"]
-    path = ~/dotfiles/gitconfig/github.gitconfig
+	path = ~/dotfiles/gitconfig/github.gitconfig
 [includeIf "hasconfig:remote.*.url:https://git.fh-muenster.de/**"]
-    path = ~/dotfiles/gitconfig/fhms.gitconfig
+	path = ~/dotfiles/gitconfig/fhms.gitconfig
 [includeIf "hasconfig:remote.*.url:git@git.fh-muenster.de:*/**"]
-    path = ~/dotfiles/gitconfig/fhms.gitconfig
+	path = ~/dotfiles/gitconfig/fhms.gitconfig
 [includeIf "hasconfig:remote.*.url:ssh://git@git.fh-muenster.de:*/**"]
-    path = ~/dotfiles/gitconfig/fhms.gitconfig
+	path = ~/dotfiles/gitconfig/fhms.gitconfig
 [includeIf "hasconfig:remote.*.url:https://vcs.murgi.de/**"]
-    path = ~/dotfiles/gitconfig/murgi.gitconfig
+	path = ~/dotfiles/gitconfig/murgi.gitconfig
 [includeIf "hasconfig:remote.*.url:ssh://git@vcs.murgi.de:*/**"]
-    path = ~/dotfiles/gitconfig/murgi.gitconfig
+	path = ~/dotfiles/gitconfig/murgi.gitconfig
 [includeIf "hasconfig:remote.*.url:git@vcs.murgi.de:*/**"]
-    path = ~/dotfiles/gitconfig/murgi.gitconfig
+	path = ~/dotfiles/gitconfig/murgi.gitconfig
 [includeIf "hasconfig:remote.*.url:git@git-int.sit.fraunhofer.de:*/**"]
-    path = ~/dotfiles/gitconfig/sit.gitconfig
+	path = ~/dotfiles/gitconfig/sit.gitconfig
 [includeIf "hasconfig:remote.*.url:https://git-int.sit.fraunhofer.de/**"]
-    path = ~/dotfiles/gitconfig/sit.gitconfig
+	path = ~/dotfiles/gitconfig/sit.gitconfig
 [core]
 	excludesfile = ~/dotfiles/.gitignore_global
+	attributesfile = ~/dotfiles/gitconfig/attributes
+	pager = delta
 [submodule]
 	recurse = true
 [filter "lfs"]
@@ -37,3 +39,24 @@ email = github@murgi.de
 	autoStash = true
 [pull]
 	rebase = true
+[interactive]
+	diffFilter = delta --color-only
+[diff]
+	colorMoved = default
+[delta]
+	navigate = true
+	; plain look: +/- markers, line backgrounds (auto light/dark), no syntax colors
+	keep-plus-minus-markers = true
+	syntax-theme = none
+	file-style = bold
+	file-decoration-style = none
+	hunk-header-style = file syntax
+	hunk-header-decoration-style = none
+	tabs = 4
+	line-numbers = true
+	line-numbers-left-format = 
+	line-numbers-right-format = "{np:>4} "
+[diff "ini"]
+	xfuncname = "^\\[.*\\]"
+[alias]
+	wsdiff = -c pager.diff='less -R' -c color.diff.old='red reverse' -c color.diff.new='green reverse' diff --word-diff=color --word-diff-regex='[^[:space:]]+|[[:space:]]+'

nvim/ftplugin/markdown.vim

@@ -0,0 +1,66 @@
+" Table cell jumps without table mode ([| ]| {| }|)
+function! s:CellMaps()
+    nmap <buffer> [<Bar> <Plug>(table-mode-motion-left)
+    nmap <buffer> ]<Bar> <Plug>(table-mode-motion-right)
+    nmap <buffer> {<Bar> <Plug>(table-mode-motion-up)
+    nmap <buffer> }<Bar> <Plug>(table-mode-motion-down)
+endfunction
+call s:CellMaps()
+" Leaving table mode unmaps them, so restore
+augroup markdown_cell_maps
+    autocmd! * <buffer>
+    autocmd User TableModeDisabled if &filetype ==# 'markdown' | call s:CellMaps() | endif
+augroup END
+
+" <Leader>T{h,j,k,l} and <Leader><Arrow> jump one cell
+nmap <buffer> <Leader>Th <Plug>(table-mode-motion-left)
+nmap <buffer> <Leader>Tj <Plug>(table-mode-motion-down)
+nmap <buffer> <Leader>Tk <Plug>(table-mode-motion-up)
+nmap <buffer> <Leader>Tl <Plug>(table-mode-motion-right)
+nmap <buffer> <Leader><Left> <Plug>(table-mode-motion-left)
+nmap <buffer> <Leader><Down> <Plug>(table-mode-motion-down)
+nmap <buffer> <Leader><Up> <Plug>(table-mode-motion-up)
+nmap <buffer> <Leader><Right> <Plug>(table-mode-motion-right)
+
+" <Leader>x toggles a checkbox; adds one to plain lines and list items
+lua << EOF
+local function toggle(lnum)
+    local line = vim.fn.getline(lnum)
+    local indent, marker, state, rest = line:match('^(%s*)([-*+] )%[([ xX])%] ?(.*)$')
+    if not indent then
+        indent, marker, state, rest = line:match('^(%s*)(%d+[.)] )%[([ xX])%] ?(.*)$')
+    end
+    if indent then
+        state = state == ' ' and 'x' or ' '
+    else
+        indent, marker, rest = line:match('^(%s*)([-*+] )(.*)$')
+        if not indent then
+            indent, marker, rest = line:match('^(%s*)(%d+[.)] )(.*)$')
+        end
+        if not indent then
+            indent, rest = line:match('^(%s*)(.*)$')
+            marker = '- '
+        end
+        state = ' '
+    end
+    vim.fn.setline(lnum, indent .. marker .. '[' .. state .. '] ' .. rest)
+end
+vim.keymap.set('n', '<Leader>x', function() toggle(vim.fn.line('.')) end,
+    { buffer = true, desc = 'Toggle checkbox' })
+vim.keymap.set('x', '<Leader>x', function()
+    local a, b = vim.fn.line('v'), vim.fn.line('.')
+    for l = math.min(a, b), math.max(a, b) do toggle(l) end
+    vim.api.nvim_feedkeys(vim.keycode('<Esc>'), 'n', false)
+end, { buffer = true, desc = 'Toggle checkboxes' })
+
+-- Shift+arrows jump cells on table rows, keep their default elsewhere
+for key, dir in pairs({ Left = 'left', Down = 'down', Up = 'up', Right = 'right' }) do
+    vim.keymap.set('n', '<Plug>(md-S-' .. key .. ')', '<S-' .. key .. '>', { buffer = true })
+    vim.keymap.set('n', '<S-' .. key .. '>', function()
+        if vim.fn.getline('.'):match('^%s*|') then
+            return '<Plug>(table-mode-motion-' .. dir .. ')'
+        end
+        return '<Plug>(md-S-' .. key .. ')'
+    end, { buffer = true, expr = true, remap = true, desc = 'Table cell or default' })
+end
+EOF

nvim/init.vim

@@ -92,6 +92,12 @@ Plug 'pangloss/vim-javascript'
 " Tex
 Plug 'lervag/vimtex'
 
+" Markdown
+Plug 'nvim-tree/nvim-web-devicons'
+Plug 'MeanderingProgrammer/render-markdown.nvim'
+Plug 'dhruvasagar/vim-table-mode'
+Plug 'stevearc/conform.nvim'
+
 "Go
 Plug 'fatih/vim-go'
 
@@ -112,6 +118,10 @@ call plug#end()
 " Check for plugin updates after the editor is responsive.
 lua << EOF
 local function check_plugin_updates()
+    if vim.system == nil then
+        return -- needs nvim >= 0.10
+    end
+
     local plugins = {}
     for name, plugin in pairs(vim.g.plugs or {}) do
         if vim.fn.isdirectory(plugin.dir) == 1 then
@@ -498,5 +508,45 @@ try
 catch
     " Ignore non existing file
 endtry
+" Markdown
+if !exists('g:vscode')
+" Table mode under <Leader>T (<Leader>t is TextWrapToggle)
+let g:table_mode_corner = '|' " GFM-valid delimiter row
+let g:table_mode_map_prefix = '<Leader>T'
+let g:table_mode_tableize_d_map = '<Leader>Td'
+
+lua << EOF
+-- Only tables and checkboxes; everything else stays plain markdown
+local off = { enabled = false }
+require('render-markdown').setup({
+    -- gutter signs open the signcolumn after wrapped tables are sized -> overflow
+    sign = off,
+    heading = off, code = off, dash = off, bullet = off, quote = off, link = off,
+    html = off, latex = off, yaml = off, inline_highlight = off,
+    checkbox = { unchecked = { icon = '󰄱 ' }, checked = { icon = '󰱒 ' } },
+})
+vim.keymap.set('n', '<Leader>mr', '<cmd>RenderMarkdown toggle<CR>', { desc = 'Toggle render markdown' })
+
+-- Prettier aligns tables on save; :FormatToggle disables it per buffer
+require('conform').setup({
+    formatters_by_ft = { markdown = { 'prettier' } },
+    formatters = {
+        prettier = { prepend_args = { '--prose-wrap', 'preserve', '--print-width', '120' } },
+    },
+    -- async: Node startup can be slow, don't block :w
+    format_after_save = function(bufnr)
+        if vim.g.disable_autoformat or vim.b[bufnr].disable_autoformat then return end
+        return {}
+    end,
+})
+vim.api.nvim_create_user_command('FormatToggle', function()
+    vim.b.disable_autoformat = not vim.b.disable_autoformat
+    print('Format on save ' .. (vim.b.disable_autoformat and 'off' or 'on'))
+end, {})
+vim.keymap.set('n', '<Leader>F', function() require('conform').format({ async = true }) end,
+    { desc = 'Format document' })
+EOF
+endif
+
 let g:tex_flavor = "latex"
 autocmd FileType yaml setlocal ts=2 sts=2 sw=2 expandtab

setup_arch.sh

@@ -9,7 +9,7 @@ set -e
 
 sudo pacman --needed -Sy archlinux-keyring --noconfirm
 sudo pacman --needed -Syu --noconfirm
-sudo pacman --needed -Sy base-devel gnome neovim zsh tmux openssh alacritty powerline-fonts python-pip python-pynvim --noconfirm
+sudo pacman --needed -Sy base-devel gnome neovim zsh tmux openssh alacritty powerline-fonts otf-firamono-nerd prettier python-pip python-pynvim atuin ripgrep --noconfirm
 
 ./clone_and_link.sh
 ./copy_fonts_arch.sh

setup_mac.sh

@@ -6,7 +6,8 @@
 # Distributed under terms of the MIT license.
 #
 
-brew install neovim tmux coreutils cmake golang jq npm virtualenvwrapper
+brew install neovim tmux coreutils cmake golang jq npm prettier virtualenvwrapper fzf atuin git-delta ripgrep skills
+brew install --cask font-fira-mono-nerd-font 1password-cli
 ./install_alacritty_mac.sh
 BREW_PREFIX="$(brew --prefix)"
 source "$BREW_PREFIX/bin/virtualenvwrapper.sh"

tmux/.mac_config

@@ -1,4 +1,8 @@
 set-option -g default-shell /bin/zsh
+
+# prefix+P: paste a password from 1Password into the pane (e.g. remote sudo)
+# (via run-shell: display-popup does not expand formats in its command)
+bind P run-shell -b "tmux display-popup -c '#{client_name}' -E -w 80% -h 50% -T ' 1Password ' '$HOME/.tmux/op_password_paste.zsh #{pane_id} #{client_name}'"
 #bind -Tcopy-mode-vi y send -X copy-pipe "pbcopy" \; display-message "copied to system clipboard"
 #bind C-p run "tmux set-buffer \"$pbpaste\"; tmux paste-buffer"
 #bind C-y run "tmux save-buffer - | pbcopy"

tmux/.tmux.conf

@@ -26,6 +26,8 @@ bind -T off F12 \
 
 setw -g mode-keys vi
 set-option -g status-keys vi
+set -g extended-keys on
+set -g extended-keys-format csi-u
 
 # Splits keep the source pane's cwd AND its active Python venv. #{@venv} is set
 # per-pane by the shell (see .virtual_env_config.zsh); we go through run-shell
@@ -41,6 +43,16 @@ bind - run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then t
 # its global env carries one), regardless of what the source pane had.
 bind c new-window -e VIRTUAL_ENV=
 
+# ssh panes: the shell sets #{@ssh_host} to the alias (see
+# zsh/lib/interactive.zsh). Label them with the remote's title if it is a bare
+# user@host (as our server zsh pins it), else with the alias; in the window
+# name and, only in windows with an ssh pane, in the pane border.
+set -g @ssh_label '#{?#{m/r:^[^@: ]+@[^@: ]+$,#{pane_title}},#{pane_title},#{@ssh_host}}'
+set -g automatic-rename-format '#{?#{@ssh_host},#{=40:#{E:@ssh_label}},#{?pane_in_mode,[tmux],#{pane_current_command}}#{?pane_dead,[dead],}}'
+set -g pane-border-format '#{?#{@ssh_host},#[bold] #{=60:#{E:@ssh_label}} #[default],}'
+set-hook -g window-layout-changed \
+  'if -F "#{P:#{@ssh_host}}" "set -w pane-border-status top" "set -wu pane-border-status"'
+
 # Switch windows
 bind-key -n M-Left select-window -t -1
 bind-key -n M-Right select-window -t +1

tmux/op_password_paste.zsh

@@ -0,0 +1,92 @@
+#!/bin/zsh
+# Paste a password from 1Password into a tmux pane, e.g. at a remote sudo
+# prompt. Run in a popup (see .mac_config):
+#   op_password_paste.zsh <pane_id> [client_name]
+emulate -L zsh
+setopt extended_glob pipe_fail no_unset
+
+pane=${1:?usage: op_password_paste.zsh <pane_id> [client_name]}
+client=${2:-}
+# -l: messages may contain item titles, which must not be expanded as formats
+die() {
+    print -ru2 -- "1Password: $*"
+    tmux display-message -l ${client:+-c} $client "1Password: $*"
+    # keep the popup (and op's error output) visible until a key is pressed
+    [[ -t 0 ]] && read -sk1 "?Press any key to close."
+    exit 1
+}
+
+(( $+commands[op] )) || die "op CLI missing (brew install --cask 1password-cli)"
+
+# Guard: a paste outside a password prompt echoes the secret (and may run it).
+# The cursor line must end in a prompt like "[sudo] password for x:".
+cursor_line() {
+    local pos=$(tmux display-message -p -t $pane '#{cursor_x},#{cursor_y}')
+    print -r -- "$pos $(tmux capture-pane -p -t $pane -S ${pos#*,} -E ${pos#*,})"
+}
+prompt=$(cursor_line)
+if [[ ${prompt#* } != *(#i)(password|passphrase|passwort|kennwort)*:[[:space:]]# ]]; then
+    print -r -- "No password prompt at the cursor:"
+    print -r -- "  ${${prompt#* }:-<empty line>}"
+    read -q "?Paste anyway? [y/N] " || exit 0
+    print
+fi
+
+# Destination of an ssh running in the pane, used as the initial fzf query.
+ssh_host() {
+    local -a words=(${(z)1})
+    local w i
+    [[ ${words[1]:t} == ssh ]] || return 1
+    for (( i = 2; i <= $#words; i++ )); do
+        w=${words[i]}
+        if [[ $w == -- ]]; then
+            w=${words[i+1]:-}
+            break
+        elif [[ $w == -?* ]]; then
+            # option letters taking an argument; the last letter may take the next word
+            [[ $w == -[^BbcDEeFIiJLlmOoPpQRSWw]#[BbcDEeFIiJLlmOoPpQRSWw] ]] && (( i++ ))
+        else
+            break
+        fi
+    done
+    w=${${${w#ssh://}#*@}%%/*}
+    w=${w%:[0-9]##}
+    [[ -n $w ]] && print -r -- $w
+}
+
+host=
+tty=$(tmux display-message -p -t $pane '#{pane_tty}')
+for args in ${(f)"$(ps -o args= -t ${tty#/dev/} 2>/dev/null)"}; do
+    host=$(ssh_host $args) && break
+done
+
+# All signed-in accounts; the desktop app integration asks for Touch ID.
+accounts=(${(f)"$(op account list --format json | jq -r '.[].account_uuid')"}) ||
+    die "op account list failed"
+(( $#accounts )) || die "no 1Password account (enable CLI integration in the app)"
+rows=$(for acc in $accounts; do
+    op item list --account $acc --categories Login,Password,Server --format json |
+        jq -r --arg acc $acc '.[] | [$acc, .vault.id, .id, .title,
+            (.additional_information // ""), .vault.name,
+            ([.urls[]?.href] | join(" "))] | @tsv' || exit 1
+done) || die "op item list failed for an account"
+[[ -n $rows ]] || die "no Login/Password/Server items found"
+
+# The prefill comes from the local ssh; after another hop it names the wrong host.
+choice=$(print -r -- $rows | fzf --delimiter='\t' --with-nth=4.. --reverse \
+    --query=$host --prompt='password> ' \
+    --header="paste into $pane${host:+ (local ssh: $host)}") || exit 0
+fields=("${(@ps:\t:)choice}")
+
+pw=$(op read --account $fields[1] "op://$fields[2]/$fields[3]/password") ||
+    die "no 'password' field in ${fields[4]}"
+
+# Named buffer, deleted by paste-buffer -d; no clipboard (no load-buffer -w).
+buf=op-password-$$
+trap 'tmux delete-buffer -b $buf 2>/dev/null' EXIT
+print -rn -- $pw | tmux load-buffer -b $buf -
+pw=
+# Picking and Touch ID take a while: refuse if the prompt moved meanwhile
+# (sudo timeout, dropped connection).
+[[ "$(cursor_line)" == "$prompt" ]] || die "pane changed since the check, not pasted"
+tmux paste-buffer -d -b $buf -t $pane

update_mac.sh

@@ -63,17 +63,59 @@ function update_others {
     echo "Update other stuff"
     echo "----------"
 
-    echo "-- ALACRITTY"
-    "$SCRIPT_DIR/install_alacritty_mac.sh" || echo "Alacritty update failed." >&2
-
     if [ -x "$(command -v claude)" ]; then
         echo "-- CLAUDE"
         claude --update
+        echo "-- CLAUDE PLUGINS"
+        claude plugin marketplace update
+        # No pipe into the loop: update must keep the terminal as stdin for its
+        # confirm prompt (bun's kqueue rejects a `< /dev/tty` redirect)
+        plugins=$(claude plugin list --json \
+            | python3 -c 'import json, sys; print(*(p["id"] for p in json.load(sys.stdin) if p["scope"] == "user"))')
+        for plugin in $plugins; do
+            claude plugin update --scope user "$plugin"
+        done
     fi
 
     if [ -x "$(command -v codex)" ]; then
         echo "-- CODEX"
         codex update
+        echo "-- CODEX PLUGINS"
+        codex plugin marketplace upgrade
+    fi
+
+    # Skills installed via the skills CLI (shared by Claude, Codex, ...)
+    if [ -f "$HOME/.agents/.skill-lock.json" ] && [ -x "$(command -v skills)" ]; then
+        echo "-- SKILLS"
+        skills update --global --yes
+    fi
+
+    if [ -x "$(command -v pi)" ]; then
+        echo "-- PI Agent"
+        pi update
+        pi update --extensions
+    fi
+
+    echo "-- ALACRITTY"
+    "$SCRIPT_DIR/install_alacritty_mac.sh" || echo "Alacritty update failed." >&2
+
+    if [ -f "$HOME/.antidote/antidote.zsh" ]; then
+        echo "-- ANTIDOTE"
+        zsh "$HOME/.antidote/antidote.zsh" update
+    fi
+
+    if [ -x "$HOME/.tmux/plugins/tpm/bin/update_plugins" ]; then
+        echo "-- TMUX PLUGINS"
+        "$HOME/.tmux/plugins/tpm/bin/clean_plugins"
+        "$HOME/.tmux/plugins/tpm/bin/update_plugins" all
+    fi
+
+    if [ -x "$(command -v nvim)" ]; then
+        echo "-- NVIM PLUGINS"
+        # Headless vim-plug only logs to its buffer; print it
+        nvim --headless -c 'PlugClean!' -c 'PlugUpgrade' -c 'PlugUpdate --sync' \
+            -c 'lua io.write("\n", table.concat(vim.api.nvim_buf_get_lines(0, 0, -1, false), "\n"), "\n")' \
+            -c 'qa'
     fi
 }
 

zsh/.mac_config.zsh_mac.example

@@ -1,7 +1,10 @@
 export LC_ALL=en_US.UTF-8
 export LANG=en_US.UTF-8
-export JAVA_HOME=`/usr/libexec/java_home`
-defaults write .GlobalPreferences AppleLocale en_DE
+# deps: system/user JDK dirs, which change when a JDK is added or removed
+_zsh_cached java_home /Library/Java/JavaVirtualMachines ~/Library/Java/JavaVirtualMachines \
+    -- /usr/libexec/java_home && read -r JAVA_HOME < $REPLY && export JAVA_HOME
+# macOS resets this on updates (and at random); background it, it's slow
+defaults write .GlobalPreferences AppleLocale en_DE &!
 
 # Set path to work with pycharm ...
 # [[ "$PATH" =~ /usr/local/bin ]] || export PATH=$PATH:/usr/local/bin
@@ -27,7 +30,7 @@ alias tailscale=/Applications/Tailscale.app/Contents/MacOS/Tailscale
 #alias virt-manager="LD_PRELOAD=/opt/homebrew/Cellar/glib/2.86.0/lib virt-manager"
 #alias virt-manager="LD_PRELOAD=/opt/homebrew/Cellar/glib/2.86.0/lib $HOME/python-envs/virt-manager/bin/python3 $HOME/stuff/virt-manager/virt-manager"
 
-HOMEBREW_COMMAND_NOT_FOUND_HANDLER="$(brew --repository)/Library/Homebrew/command-not-found/handler.sh"
+HOMEBREW_COMMAND_NOT_FOUND_HANDLER="${HOMEBREW_REPOSITORY:-$(brew --repository)}/Library/Homebrew/command-not-found/handler.sh"
 if [ -f "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER" ]; then
   source "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER";
 fi

zsh/.p10k.zsh_mac.example

@@ -71,7 +71,7 @@
     phpenv                  # php version from phpenv (https://github.com/phpenv/phpenv)
     scalaenv                # scala version from scalaenv (https://github.com/scalaenv/scalaenv)
     haskell_stack           # haskell version from stack (https://haskellstack.org/)
-    kubecontext             # current kubernetes context (https://kubernetes.io/)
+    # kubecontext           # off: runs kubectl on each shell's first prompt, even when hidden
     terraform               # terraform workspace (https://www.terraform.io)
     # terraform_version     # terraform version (https://www.terraform.io)
     aws                     # aws profile (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html)

zsh/.virtual_env_config.zsh_mac.example

@@ -8,11 +8,11 @@ fi
 export WORKON_HOME=~/python-envs
 export VIRTUALENVWRAPPER_VIRTUALENV=$PREFIX/bin/virtualenv
 mkdir -p $WORKON_HOME
-source $PREFIX/bin/virtualenvwrapper.sh
+source $PREFIX/bin/virtualenvwrapper_lazy.sh
 
 # NOTE: an inherited VIRTUAL_ENV is *not* re-activated here — that happens at the
 # very end of .zshrc so activate captures the fully-built PATH (see the comment
-# there). Sourcing virtualenvwrapper.sh above only defines workon/deactivate/etc.
+# there). virtualenvwrapper initializes when a command such as workon is used.
 
 # Mirror the current venv into a per-pane tmux option so that splitting a pane
 # can carry it into the new pane (.tmux.conf reads #{@venv} with `-e`). Per-pane

zsh/.zprofile

@@ -0,0 +1,7 @@
+# Login shells that skip .zshrc (e.g. `su - user -c cmd`) still need brew on PATH.
+# Interactive shells rebuild PATH order later in .zshrc.
+if [[ -x /opt/homebrew/bin/brew ]]; then
+    eval "$(/opt/homebrew/bin/brew shellenv)"
+elif [[ -x /usr/local/bin/brew ]]; then
+    eval "$(/usr/local/bin/brew shellenv)"
+fi

zsh/.zsh_plugins.txt

@@ -1,5 +1,4 @@
-# Load OMZ plugins
-ohmyzsh/ohmyzsh
+# Load OMZ lib and plugins; not oh-my-zsh.sh itself (own compinit, theme, update check)
 ohmyzsh/ohmyzsh path:lib
 ohmyzsh/ohmyzsh path:plugins/git
 ohmyzsh/ohmyzsh path:plugins/golang

zsh/.zshrc

@@ -1,12 +1,48 @@
-# Powerlevel10k instant prompt and machine-local layers must remain first.
+# First, so an interrupted startup (Ctrl-C) doesn't keep /etc/zshrc's
+# SAVEHIST=1000 and truncate the history file on exit
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY
+
+source "${ZDOTDIR:-$HOME}/.zsh/lib/startup.zsh"
+[[ -d ${ZDOTDIR:-$HOME}/.cache/zsh ]] || mkdir -p ${ZDOTDIR:-$HOME}/.cache/zsh
+
+# May ask for the key passphrase (once per boot), so it precedes instant prompt.
+_in_coding_agent="$CLAUDECODE$CODEX_SESSION_ID$PI_CODING_AGENT"
+if [[ -f ~/.ssh/sudo_key && -z $_in_coding_agent ]] &&
+    _zsh_cached sudo_key.fp ~/.ssh/sudo_key -- ssh-keygen -lf ~/.ssh/sudo_key; then
+    read -r _ _sudo_fp _ < $REPLY
+    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
+    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q "$_sudo_fp" ||
+        SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
+    # agent forwarded by coding agents (see ~/.ssh/config): every signature,
+    # i.e. every remote sudo, needs confirmation via askpass
+    [[ -e /tmp/sudo-agent-confirm.sock ]] ||
+        SSH_ASKPASS=~/.ssh/askpass-agent-confirm.sh SSH_ASKPASS_REQUIRE=force \
+            ssh-agent -a /tmp/sudo-agent-confirm.sock &>/dev/null
+    SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -l | grep -q "$_sudo_fp" ||
+        SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -c ~/.ssh/sudo_key
+    unset _sudo_fp
+fi
+_zst_mark sudo-agent
+
+# Powerlevel10k instant prompt; nothing below may need console input.
+if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+    source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+fi
+_zst_mark instant-prompt
+
+# Machine-local layers.
 [[ -f ~/.zsh/.powerline_config ]] && source ~/.zsh/.powerline_config
 [[ -f ~/.zsh/.user_config ]] && source ~/.zsh/.user_config
 [[ -f ~/.zsh/.virtual_env_config.zsh ]] && source ~/.zsh/.virtual_env_config.zsh
 [[ -f ~/.zsh/.local_config ]] && source ~/.zsh/.local_config
 [[ -f ~/.zsh/.env.local ]] && source ~/.zsh/.env.local
+_zst_mark layers
 
 source "${ZDOTDIR:-$HOME}/.zsh/lib/updates.zsh"
 export LC_OSC52=1
+_zst_mark updates
 
 # Completions for tools installed under ~/.local (e.g. tools-repo's safe*
 # wrappers). Must precede antidote, whose completion plugin runs compinit.
@@ -15,30 +51,56 @@ fpath=("$HOME/.local/share/zsh/site-functions" $fpath)
 plugins_txt=${ZDOTDIR:-$HOME}/.zsh/.zsh_plugins.txt
 static_file=${ZDOTDIR:-$HOME}/.cache/zsh/.zsh_plugins.zsh
 source "${ZDOTDIR:-$HOME}/.zsh/lib/antidote.zsh"
+_zst_mark antidote
 source "${ZDOTDIR:-$HOME}/.zsh/lib/interactive.zsh"
 
 bindkey '^w' kill-region
 bindkey -v
 VI_MODE_SET_CURSOR=true
+# fzf keys (Ctrl-R/Ctrl-T/Alt-C, **<Tab>); after bindkey -v so vi keymaps get them
+(( $+commands[fzf] )) && _zsh_cached fzf.zsh ${commands[fzf]:A} -- fzf --zsh &&
+    source $REPLY
+_zst_mark fzf
+
+# atuin: history with cwd/exit code; after fzf so its Ctrl-R wins. Keeps up-arrow
+# and ? (no Atuin AI).
+if (( $+commands[atuin] )); then
+    export ATUIN_CONFIG_DIR=~/dotfiles/.config/atuin
+    _zsh_cached atuin.zsh ${commands[atuin]:A} $ATUIN_CONFIG_DIR/config.toml \
+        -- atuin init zsh --disable-up-arrow --disable-ai && source $REPLY
+    # no `atuin search` spawn per keystroke (autosuggest runs synchronously)
+    ZSH_AUTOSUGGEST_STRATEGY=(${ZSH_AUTOSUGGEST_STRATEGY:#atuin})
+fi
+_zst_mark atuin
+
+export RIPGREP_CONFIG_PATH=~/dotfiles/.config/ripgrep/config
 
 [[ -f ~/.zsh/.mac_config.zsh ]] && source ~/.zsh/.mac_config.zsh
-if (( $+commands[go] )); then
-    export GOPATH="$(go env GOPATH 2>/dev/null)"
-    [[ -n "$GOPATH" ]] && path+=("$GOPATH/bin")
+_zst_mark mac-config
+# deps: go binary and `go env -w` files (macOS, Linux)
+if (( $+commands[go] )) && _zsh_cached gopath ${commands[go]:A} \
+    "$HOME/Library/Application Support/go/env" "${XDG_CONFIG_HOME:-$HOME/.config}/go/env" \
+    -- env -u GOPATH go env GOPATH; then
+    [[ -n $GOPATH ]] || read -r GOPATH < $REPLY
+    export GOPATH
+    path+=("$GOPATH/bin")
 fi
+_zst_mark go
 
 # Use safe wrappers after ~/.local/bin has been added to PATH.
-(( $+commands[safecp] )) && alias cp=safecp
-(( $+commands[safemv] )) && alias mv=safemv
-(( $+commands[safescp] )) && alias scp=safescp
-
-if [[ -f ~/.ssh/sudo_key ]]; then
-    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
-    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l |
-        grep -q "$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')" ||
-        SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
+# Agent shells: </dev/null makes the prompt decline (exit 1) instead of blocking.
+if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]]; then
+    _safe_redir=' </dev/null'
 fi
-export SUDO_ASKPASS=$(command -v ssh-askpass)
+(( $+commands[safecp] )) && alias cp="safecp${_safe_redir:-}"
+(( $+commands[safemv] )) && alias mv="safemv${_safe_redir:-}"
+(( $+commands[safeln] )) && alias ln="safeln${_safe_redir:-}"
+(( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
+unset _safe_redir
+
+# no GUI password dialog for sudo from agent shells; a non-interactive sudo just fails
+[[ -z $_in_coding_agent ]] && export SUDO_ASKPASS=${commands[ssh-askpass]}
+unset _in_coding_agent
 
 if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
     p10k_config=~/dotfiles/zsh/.p10k.mac.zsh
@@ -46,26 +108,17 @@ else
     p10k_config=~/dotfiles/zsh/.p10k.zsh
 fi
 source "${ZDOTDIR:-$HOME}/.zsh/lib/prompt.zsh"
+_zst_mark prompt
 
 alias screenshot_mode='powerlevel10k_plugin_unload; export PS1="$ "; python3 ~/.config/alacritty/screenshot_mode.py on'
 alias screenshot_mode_off='prompt_powerlevel9k_setup; python3 ~/.config/alacritty/screenshot_mode.py off'
-antidote update &>/dev/null &|
 
 [[ -d "$HOME/.lmstudio/bin" ]] && path+=("$HOME/.lmstudio/bin")
 [[ -d "$HOME/.runai/bin" ]] && path+=("$HOME/.runai/bin")
 runai_bin="$HOME/.runai/bin/runai"
-runai_completion=${ZDOTDIR:-$HOME}/.cache/zsh/runai-completion.zsh
-if [[ -x "$runai_bin" ]]; then
-    if [[ ! -s "$runai_completion" || "$runai_bin" -nt "$runai_completion" ]]; then
-        runai_completion_tmp="$runai_completion.$$.tmp"
-        if "$runai_bin" --quiet completion zsh >| "$runai_completion_tmp"; then
-            command mv -f "$runai_completion_tmp" "$runai_completion"
-        else
-            command rm -f "$runai_completion_tmp"
-        fi
-    fi
-    [[ -s "$runai_completion" ]] && source "$runai_completion"
-fi
+[[ -x "$runai_bin" ]] &&
+    _zsh_cached runai-completion.zsh "$runai_bin" -- "$runai_bin" --quiet completion zsh &&
+    source $REPLY
 
 # Keep this last: activate must snapshot the fully built PATH for deactivate.
 typeset -U path PATH
@@ -75,3 +128,6 @@ if [[ -n "$VIRTUAL_ENV" && -f "$VIRTUAL_ENV/bin/activate" ]]; then
         source "$VIRTUAL_ENV/bin/activate"
     fi
 fi
+_zst_mark rest
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd _zst_report

zsh/lib/antidote.zsh

@@ -4,9 +4,27 @@ if [[ ! -e ${ZDOTDIR:-$HOME}/.antidote ]]; then
     git clone https://github.com/mattmc3/antidote.git "${ZDOTDIR:-$HOME}/.antidote"
 fi
 
+# OMZ lib/plugins without oh-my-zsh.sh, which would set these up
+ZSH_CACHE_DIR=${ZDOTDIR:-$HOME}/.cache/zsh/omz
+[[ -d $ZSH_CACHE_DIR/completions ]] || mkdir -p "$ZSH_CACHE_DIR/completions"
+fpath=("$ZSH_CACHE_DIR/completions" $fpath)
+# ssh-agent plugin keys its env file on this; HOST changes with VPN rDNS
+SHORT_HOST=${HOST/.*/}
+if [[ $OSTYPE == darwin* ]] && _zsh_cached short_host \
+    /Library/Preferences/SystemConfiguration/preferences.plist -- scutil --get LocalHostName; then
+    read -r SHORT_HOST < $REPLY
+fi
+# OMZ calls compdef before compinit (last plugin) has run: queue, replay below
+typeset -ga _compdef_queue
+compdef() { _compdef_queue+=("${(j: :)${(@q)@}}") }
+
 zstyle ':completion:*:ssh:*' hosts off
 zstyle ':completion:*:scp:*' hosts off
 zstyle ':completion:*:commands' rehash 1
 
 source "${ZDOTDIR:-$HOME}/.antidote/antidote.zsh"
 antidote load "$plugins_txt" "$static_file"
+if (( ${+_comps} )); then
+    for _c in $_compdef_queue; do eval "compdef $_c"; done
+    unset _c _compdef_queue
+fi

zsh/lib/interactive.zsh

@@ -108,3 +108,53 @@ pastefinish() {
 zstyle :bracketed-paste-magic paste-init pasteinit
 zstyle :bracketed-paste-magic paste-finish pastefinish
 ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)
+
+# Mirror the ssh destination into a per-pane tmux option; .tmux.conf labels ssh
+# panes with it or the remote's user@host title.
+_ssh_host_tmux() {
+    local -a set=(set -p -t $TMUX_PANE @ssh_host "$1")
+    [[ -n $1 ]] || set=(set -pu -t $TMUX_PANE @ssh_host)
+    tmux $set \; if -F -t $TMUX_PANE '#{P:#{@ssh_host}}' \
+        "set -w -t $TMUX_PANE pane-border-status top" \
+        "set -wu -t $TMUX_PANE pane-border-status" 2>/dev/null
+}
+_ssh_host_preexec() {
+    [[ -n $TMUX ]] || return
+    local -a w=(${(z)3})  # $2 is size-limited
+    while [[ $w[1] == *=* || $w[1] == (command|exec|noglob|nocorrect) ]]; do shift w; done
+    [[ ${w[1]:t} == ssh ]] || return
+    shift w
+    local host opt
+    while (( $#w )); do
+        case ${(Q)w[1]} in
+            --) host=${(Q)w[2]}; break ;;
+            -?*)
+                # option cluster; stop at the first flag that takes an argument
+                opt=${(Q)w[1]#-}; shift w
+                while [[ -n $opt ]]; do
+                    if [[ $opt[1] == [BbcDEeFIiJLlmOoPpRSWw] ]]; then
+                        [[ -n ${opt:1} ]] || shift w
+                        break
+                    fi
+                    opt=${opt:1}
+                done ;;
+            *) host=${(Q)w[1]}; break ;;
+        esac
+    done
+    [[ $host == ssh://* ]] && host=${${host#ssh://}%:<->}
+    host=${host##*@}
+    [[ -n $host ]] || return
+    _ssh_host_tmux $host
+    _ssh_host_set=1
+    # title the pane with the alias until the remote sets one; runs after
+    # OMZ's preexec, so this replaces its "ssh ..." title
+    print -rn -- $'\e]2;'"$host"$'\e\\'
+}
+_ssh_host_precmd() {
+    (( ${_ssh_host_set:-0} )) || return
+    _ssh_host_tmux ''
+    _ssh_host_set=0
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook preexec _ssh_host_preexec
+add-zsh-hook precmd _ssh_host_precmd

zsh/lib/startup.zsh

@@ -0,0 +1,53 @@
+# Startup helpers: output caching and slow-start logging.
+
+zmodload zsh/datetime
+zmodload -F zsh/stat b:zstat
+
+# Cache a command's output; regenerate when a dependency's resolved path or
+# mtime changes (brew upgrades swap Cellar paths but keep old mtimes).
+# Usage: _zsh_cached <name> [dep...] -- <cmd...>; sets REPLY to the cache file.
+_zsh_cached() {
+    local file=${ZDOTDIR:-$HOME}/.cache/zsh/$1 stamp old
+    local -a mt
+    shift
+    while [[ $# -gt 0 && $1 != -- ]]; do
+        mt=(); zstat -A mt +mtime -- $1 2>/dev/null
+        stamp+="${1:A}@${mt[1]:-none};"
+        shift
+    done
+    shift
+    [[ -r $file.stamp ]] && read -r old < $file.stamp
+    if [[ ! -s $file || $old != $stamp ]]; then
+        local tmp=$file.$$.tmp
+        if "$@" >| $tmp 2>/dev/null && [[ -s $tmp ]]; then
+            command mv -f $tmp $file
+            print -r -- $stamp >| $file.stamp
+        else
+            command rm -f $tmp
+            [[ -s $file ]] || return 1
+        fi
+    fi
+    REPLY=$file
+}
+
+# Slow-start log: per-step ms, written only if startup (until the first prompt)
+# exceeds ZSH_STARTUP_LOG_MS. Diagnostic for cold starts; remove once resolved.
+typeset -gF _zst_t0=$EPOCHREALTIME _zst_last=$EPOCHREALTIME
+typeset -ga _zst_steps
+_zst_mark() {
+    local ms
+    printf -v ms '%s=%.0f' $1 $(( (EPOCHREALTIME - _zst_last) * 1000 ))
+    _zst_steps+=($ms)
+    _zst_last=$EPOCHREALTIME
+}
+_zst_report() {
+    add-zsh-hook -d precmd _zst_report
+    _zst_mark precmd
+    local total=$(( (EPOCHREALTIME - _zst_t0) * 1000 ))
+    (( total >= ${ZSH_STARTUP_LOG_MS:-1000} )) || return 0
+    local ts login=0
+    strftime -s ts '%Y-%m-%dT%H:%M:%S' $EPOCHSECONDS
+    [[ -o login ]] && login=1
+    printf '%s total=%.0f tmux=%d login=%d | %s\n' $ts $total ${+TMUX} $login "$_zst_steps" \
+        >> ${ZDOTDIR:-$HOME}/.cache/zsh/startup-slow.log
+}