Fix delzip

Keep the server entrypoint focused on server policy while moving update checks, Antidote loading, interactive defaults, and prompt sourcing into reusable modules.

.config/alacritty/alacritty.toml

@@ -0,0 +1,68 @@
+[general]
+import = ["~/.config/alacritty/solarized_light.toml"]
+live_config_reload = true
+
+[env]
+TERM = "xterm-256color"
+
+[font]
+size = 14
+
+[font.bold]
+family = "Fira Mono for Powerline"
+style = "Bold"
+
+[font.italic]
+family = "Fira Mono for Powerline"
+style = "Regular"
+
+[font.normal]
+family = "Fira Mono for Powerline"
+style = "Medium"
+
+[[keyboard.bindings]]
+key = "F"
+mods = "Control"
+
+[keyboard.bindings.command]
+args = ["-c", "python3 ~/.config/alacritty/color_switcher.py"]
+program = "zsh"
+
+[[keyboard.bindings]]
+key = "T"
+mods = "Command"
+
+[keyboard.bindings.command]
+args = ["-e", "zsh"]
+program = "alacritty"
+
+[scrolling]
+history = 0
+
+[selection]
+save_to_clipboard = true
+
+[terminal]
+osc52 = "OnlyCopy"
+
+[terminal.shell]
+args = ["-c", "$HOME/.tmux/tmux_attach.sh"]
+program = "/bin/zsh"
+
+[window]
+dynamic_title = true
+option_as_alt = "None"
+
+[window.padding]
+x = 2
+y = 0
+
+[[keyboard.bindings]]
+key = "Return"
+mods = "Shift"
+chars = "\u001B\r"
+
+[[keyboard.bindings]]
+key = "Slash"
+mods = "Control"
+chars = "\u001F"

.config/alacritty/alacritty.yml

@@ -1,43 +0,0 @@
-import:
-  - ~/.config/alacritty/schemes.yml
-
-env:
-  TERM: xterm-256color
-font:
-  # The size to use.
-  size: 12
-  # The normal (roman) font face to use.
-  normal:
-    family: "MesloLGS NF"
-    # Style can be specified to pick a specific face.
-    style: Regular
-  bold:
-    family: "MesloLGS NF"
-    # Style can be specified to pick a specific face.
-    style: Bold
-  bold:
-    family: "MesloLGS NF"
-    # Style can be specified to pick a specific face.
-    style: Bold
-
-window:
-  dynamic_title: true
-  padding:
-    x: 0
-    y: 0
-
-scrolling:
-  history: 0
-
-shell:
-  program: zsh
-  args:
-    - "-c"
-    - "$HOME/.tmux/tmux_attach.sh"
-
-alt_send_esc: false
-live_config_reload: true
-
-key_bindings:
-  - { key: F, mods: Control, command: {program: "zsh", args: ["-c","python3 ~/.config/alacritty/color_switcher.py"]} } 
-  - { key: T, mods: Command, command: {program: "alacritty", args: ["-e","zsh"]} } # Spawn alacritty without tmux

.config/alacritty/color_switcher.py

@@ -2,14 +2,15 @@
 
 import os
 import re
+import sys
 
-
-CONFIG_FILE_NAME = "schemes.yml"
+ALACRITTY_CONFIG_FILE_NAME = "alacritty.toml"
 CONFIG_FILE_DIR = os.path.expanduser("~/.config/alacritty/")
-CONFIG_FILE_PATH = os.path.join(CONFIG_FILE_DIR, CONFIG_FILE_NAME)
+ALACRITTY_CONFIG_FILE_PATH = os.path.join(CONFIG_FILE_DIR, ALACRITTY_CONFIG_FILE_NAME)
 
-COLOR_SCHEME_LINE_SEARCH = "colors: \*(\S+)"
-COLOR_SCHEME_LINE_TEMPLATE = "colors: *{}\n"
+COLOR_SCHEME_LINE_SEARCH = r'import = \[.*\]'
+ALACRITTY_LIGHT_THEME="solarized_light.toml"
+ALACRITTY_DARK_THEME="dark_mode.toml"
 
 NVIM_CONFIG_FILE_DIR = os.path.expanduser("~/.config/nvim/")
 NVIM_CONFIG_FILE_NAME = "scheme.vim"
@@ -18,30 +19,37 @@ NVIM_CONFIG_FILE_PATH = os.path.join(NVIM_CONFIG_FILE_DIR, NVIM_CONFIG_FILE_NAME
 NVIM_COLOR_SCHEME_LINE_SEARCH = "set background=(\S+)\ncolorscheme (\S+)"
 NVIM_COLOR_SCHEME_LINE_TEMPLATE = "set background={}\ncolorscheme {}"
 
-def change_alacritty_theme():
-    with open(CONFIG_FILE_PATH, "r") as config_file:
-        config_file.seek(0)
-        lines = config_file.readlines()
+def change_alacritty_theme(light_mode=None):
+    with open(ALACRITTY_CONFIG_FILE_PATH, "r") as scheme_file:
+        scheme_file.seek(0)
+        lines = scheme_file.readlines()
 
     colors_line_index = -1
     for i, line in enumerate(lines):
         match = re.search(COLOR_SCHEME_LINE_SEARCH, line)
         if match is not None:
-            current_color_scheme = match.group(1)
             colors_line_index = i
+            color_line = lines[i]
+            break
     
-
-    if current_color_scheme == "dark_mode":
-        new_scheme = "solarized_light"
+    if light_mode is None:
+        if ALACRITTY_DARK_THEME in color_line:
+            color_line = color_line.replace(ALACRITTY_DARK_THEME, ALACRITTY_LIGHT_THEME)
+            new_scheme = "light"
+        else:
+            color_line = color_line.replace(ALACRITTY_LIGHT_THEME, ALACRITTY_DARK_THEME)
+            new_scheme = "dark"
+    elif light_mode == True:
+        new_scheme = "light"
+        color_line = color_line.replace(ALACRITTY_DARK_THEME, ALACRITTY_LIGHT_THEME)
     else:
-        new_scheme = "dark_mode"
-
-    lines[colors_line_index] = COLOR_SCHEME_LINE_TEMPLATE.format(
-        new_scheme)
-
-    with open(CONFIG_FILE_PATH, "w") as config_file:
+        color_line = color_line.replace(ALACRITTY_LIGHT_THEME, ALACRITTY_DARK_THEME)
+        new_scheme = "dark"
+    lines[colors_line_index] = color_line
+    with open(ALACRITTY_CONFIG_FILE_PATH, "w") as scheme_file:
         for line in lines:
-            config_file.write(line)
+            scheme_file.write(line)
+
     return new_scheme
 
 def change_vim_theme(light_mode=False):
@@ -57,10 +65,13 @@ def change_vim_theme(light_mode=False):
         config = config_file.write(res)
     
 
-def main():
-    new_theme = change_alacritty_theme()
-    change_vim_theme(new_theme == "solarized_light")
+def main(light_mode=None):
+    new_theme = change_alacritty_theme(light_mode)
+    change_vim_theme(new_theme == "light")
     
 
 if __name__=="__main__":
-    main()
+    if len(sys.argv) == 2:
+        main(sys.argv == "light")
+    else:
+        main()

.config/alacritty/dark_mode.toml

@@ -0,0 +1,23 @@
+[colors.bright]
+black = "0x555753"
+blue = "0x729fcf"
+cyan = "0x34e2e2"
+green = "0x8ae234"
+magenta = "0xad7fa8"
+red = "0xef2929"
+white = "0xeeeeec"
+yellow = "0xfce94f"
+
+[colors.normal]
+black = "0x2e3436"
+blue = "0x3465a4"
+cyan = "0x06989a"
+green = "0x4e9a06"
+magenta = "0x75507b"
+red = "0xcc0000"
+white = "0xd3d7cf"
+yellow = "0xc4a000"
+
+[colors.primary]
+background = "0x323232"
+foreground = "0xeeeeec"

.config/alacritty/screenshot_mode.py

@@ -0,0 +1,41 @@
+#! /usr/bin/env python3
+# vim:fenc=utf-8
+#
+# Copyright © 2023 ising <ising@mac-nurmi>
+#
+# Distributed under terms of the MIT license.
+
+"""
+
+"""
+import os
+import sys
+import color_switcher
+
+CONFIG_FILE_NAME = "alacritty.toml"
+CONFIG_FILE_DIR = os.path.expanduser("~/.config/alacritty/")
+CONFIG_FILE_PATH = os.path.join(CONFIG_FILE_DIR, CONFIG_FILE_NAME)
+
+def main(turn_on=False):
+    padding_line = None
+    with open(CONFIG_FILE_PATH, "r") as config_file:
+        config_file.seek(0)
+        config_lines = config_file.readlines()
+        for i, line in enumerate(config_lines):
+            if "[window.padding]" in line and "x =" in config_lines[i+1]:
+                padding_line = i
+    if padding_line is None:
+        return
+    if turn_on:
+        config_lines[padding_line+1] = "x = 10\n"
+        config_lines[padding_line+2] = "y = 10\n"
+    else:
+        config_lines[padding_line+1] = "x = 0\n"
+        config_lines[padding_line+2] = "y = 0\n"
+    with open(CONFIG_FILE_PATH, "w") as config_file:
+        for line in config_lines:
+            config_file.write(line)
+
+if __name__=="__main__":
+    main(len(sys.argv) == 2 and sys.argv[1] == "on")
+    #color_switcher.main(len(sys.argv) == 2 and sys.argv[1] == "on")

.config/alacritty/solarized_light.toml

@@ -0,0 +1,23 @@
+[colors.bright]
+black = "0x002b36"
+blue = "0x839496"
+cyan = "0x93a1a1"
+green = "0x586e75"
+magenta = "0x6c71c4"
+red = "0xcb4b16"
+white = "0xfdf6e3"
+yellow = "0x657b83"
+
+[colors.normal]
+black = "0x073642"
+blue = "0x268bd2"
+cyan = "0x2aa198"
+green = "0x859900"
+magenta = "0xd33682"
+red = "0xdc322f"
+white = "0xeee8d5"
+yellow = "0xb58900"
+
+[colors.primary]
+background = "0xfdf6e3"
+foreground = "0x586e75"

.gitignore

@@ -1,3 +1,4 @@
 *.swp
 tags
 .DS_STORE
+__pycache__

.gitignore_global

@@ -0,0 +1,28 @@
+.DS_Store
+.localized
+__MACOSX/
+.AppleDouble
+.LSOverride
+
+# Resource forks
+._*
+
+# Files and directories that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+.com.apple.timemachine.supported
+.PKInstallSandboxManager
+.PKInstallSandboxManager-SystemSoftware
+.hotfiles.btree
+.vol
+.file
+.disk_label*
+lost+found
+.nobackup
+
+**/.claude/settings.local.json

.gittrees

@@ -1,14 +0,0 @@
-[subtree "tmux"]
-url = git@vcs.murgi.de:dotfiles_fabian/tmux.git
-path = tmux
-branch = master
-
-[subtree "zsh"]
-url = git@vcs.murgi.de:dotfiles_fabian/zsh.git
-path = zsh
-branch = master
-
-[subtree "vim"]
-url = git@vcs.murgi.de:dotfiles_fabian/vim.git
-path = vim
-branch = master

AGENTS.md

@@ -0,0 +1,37 @@
+# AGENTS.md
+
+This file provides guidance to AI Agents when working with code in this repository.
+
+This is a personal dotfiles repository targeting macOS (Apple Silicon + Intel) and Arch Linux. It is installed by symlinking config directories/files from the repo into `$HOME`, so files here are live configs — editing them changes the running system.
+
+## Installation & setup
+
+Setup is platform-specific and runs from the repo root:
+
+- **macOS:** `./setup_mac.sh` — brews dependencies, creates a `neovim` virtualenv, then calls `./clone_and_link_mac.sh`. Uses GNU coreutils' `gln` (not `ln`), so coreutils must be installed first.
+- **Arch:** `./setup_arch.sh` — pacman deps, then `./clone_and_link.sh` + `./copy_fonts_arch.sh`.
+- `clone_and_link*.sh` create the symlinks (`~/.zsh`, `~/.zshrc`, `~/.tmux`, `~/.tmux.conf`, `~/.config/nvim`, `~/.config/alacritty`, virtualenvwrapper hooks). `link_config.sh` is a simpler standalone variant.
+- `general_setup.sh` switches the login shell to zsh and triggers plugin installs.
+
+## Platform-specific config via `.example` templates
+
+The most important repo-wide convention: platform variants live as `.example` files and the active file is a symlink/copy produced at setup time. The setup scripts loop over files matching `zsh/.*_mac.example`, `tmux/.*_arch.example`, etc., and link/copy each to the name with the `_<platform>.example` suffix stripped.
+
+Practical rule: **edit the `.example` source, not the generated symlink target.** The unsuffixed active files are git-ignored (see each subdir's `.gitignore`). Templates that are copied (not symlinked) at setup — `nvim/scheme.vim.template` → `scheme.vim`, `.config/alacritty/schemes.yml.template` → `schemes.yml` — are also git-ignored once activated.
+
+## Component architecture
+
+- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
+- **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
+- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
+- **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
+- **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
+
+## Light/dark theme switching
+
+`.config/alacritty/color_switcher.py` toggles light/dark across the terminal **and** nvim in one shot: it rewrites the `import` line in `alacritty.toml` (`solarized_light.toml` ↔ `dark_mode.toml`) and the `background`/`colorscheme` lines in `~/.config/nvim/scheme.vim`. Keep the regex-matched line formats in those files intact when editing them by hand. `screenshot_mode.py` is a related toggle.
+
+## Maintenance
+
+- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also runs `claude --update` and `Codex --update`.
+- `brew_autoupdate` — sets up scheduled brew auto-updates.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

brew_autoupdate

@@ -0,0 +1,10 @@
+#!/bin/sh
+export HOMEBREW_NO_BOTTLE_SOURCE_FALLBACK=1
+export PATH='/opt/homebrew/Library/Homebrew/shims/shared:/opt/homebrew/opt/coreutils/libexec/gnubin:/Users/ising/.local/bin:/opt/homebrew/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/TeX/texbin:/Applications/VMware Fusion.app/Contents/Public:/Users/ising/.cargo/bin:/opt/homebrew/sbin:/Users/ising/go/bin:/opt/homebrew/Library/Taps/homebrew/homebrew-autoupdate/cmd:/opt/homebrew/Library/Taps/homebrew/homebrew-command-not-found/cmd:/opt/homebrew/Library/Taps/homebrew/homebrew-services/cmd'
+export HOMEBREW_CACHE='/Users/ising/Library/Caches/Homebrew'
+export HOMEBREW_LOGS='/Users/ising/Library/Logs/Homebrew'
+export SUDO_ASKPASS='/Users/ising/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate_sudo_gui'
+defaults export com.apple.dock "/tmp/dock-layout.plist"
+/bin/date && /opt/homebrew/bin/brew update && /opt/homebrew/bin/brew upgrade --formula -v && /opt/homebrew/bin/brew upgrade --cask -v && /opt/homebrew/bin/brew cleanup && /usr/bin/open -g /opt/homebrew/Library/Taps/homebrew/homebrew-autoupdate/notifier/brew-autoupdate.app
+defaults import com.apple.dock "/tmp/dock-layout.plist"
+killall dock

clone_and_link.sh

@@ -12,3 +12,5 @@ ln -Tsv ~/.zsh/.zshrc $HOME/.zshrc
 ln -Tsv $PWD/tmux $HOME/.tmux
 ln -Tsv ~/.tmux/.tmux.conf $HOME/.tmux.conf
 ln -Tsv $PWD/nvim $HOME/.config/nvim
+ln -Tsv $PWD/.config/alacritty $HOME/.config/alacritty
+ln -fsv $PWD/virtualenvwrapper/* $VIRTUALENVWRAPPER_HOOK_DIR

clone_and_link_mac.sh

@@ -11,7 +11,10 @@ gln -Tsv $PWD/zsh $HOME/.zsh
 gln -Tsv ~/.zsh/.zshrc $HOME/.zshrc
 gln -Tsv $PWD/tmux $HOME/.tmux
 gln -Tsv ~/.tmux/.tmux.conf $HOME/.tmux.conf
-mkdir -p $HOME/.config/nvim
 gln -Tsv $PWD/nvim $HOME/.config/nvim
 gln -Tsv $PWD/.config/alacritty $HOME/.config/alacritty
-gln -Tsv $PWD/zsh/.p10k.mac.zsh.example  $PWD/zsh/.p10k.mac.zsh
+gln -Tsv $PWD/zsh/.p10k.zsh_mac.example $PWD/zsh/.p10k.mac.zsh
+gln -Tsv $PWD/zsh/.mac_config.example $PWD/zsh/.mac_config
+gln -Tsv $PWD/zsh/.virtual_env_config.zsh_mac.example $PWD/zsh/.virtual_env_config.zsh
+gln -fsv $PWD/virtualenvwrapper/* $VIRTUALENVWRAPPER_HOOK_DIR
+gln -Tsv $PWD/update_mac.sh $HOME/update_mac.sh

compile_ycm.sh

@@ -0,0 +1,9 @@
+#! /bin/sh
+#
+# compile_ycm.sh
+# Copyright (C) 2024 ising <ising@mac-nurmi>
+#
+# Distributed under terms of the MIT license.
+#
+
+python3 ~/.local/share/nvim/plugged/install.py --all

gitconfig/fhms.gitconfig

@@ -0,0 +1,3 @@
+[user]
+name = Fabian Ising
+email = f.ising@fh-muenster.de

gitconfig/gitconfig

@@ -0,0 +1,39 @@
+# This is Git's per-user configuration file.
+[user]
+# Please adapt and uncomment the following lines:
+name = Fabian Ising
+email = github@murgi.de
+
+[includeIf "hasconfig:remote.*.url:https://github.com/**"]
+    path = ~/dotfiles/gitconfig/github.gitconfig
+[includeIf "hasconfig:remote.*.url:git@github.com/**"]
+    path = ~/dotfiles/gitconfig/github.gitconfig
+[includeIf "hasconfig:remote.*.url:https://git.fh-muenster.de/**"]
+    path = ~/dotfiles/gitconfig/fhms.gitconfig
+[includeIf "hasconfig:remote.*.url:git@git.fh-muenster.de:*/**"]
+    path = ~/dotfiles/gitconfig/fhms.gitconfig
+[includeIf "hasconfig:remote.*.url:ssh://git@git.fh-muenster.de:*/**"]
+    path = ~/dotfiles/gitconfig/fhms.gitconfig
+[includeIf "hasconfig:remote.*.url:https://vcs.murgi.de/**"]
+    path = ~/dotfiles/gitconfig/murgi.gitconfig
+[includeIf "hasconfig:remote.*.url:ssh://git@vcs.murgi.de:*/**"]
+    path = ~/dotfiles/gitconfig/murgi.gitconfig
+[includeIf "hasconfig:remote.*.url:git@vcs.murgi.de:*/**"]
+    path = ~/dotfiles/gitconfig/murgi.gitconfig
+[includeIf "hasconfig:remote.*.url:git@git-int.sit.fraunhofer.de:*/**"]
+    path = ~/dotfiles/gitconfig/sit.gitconfig
+[includeIf "hasconfig:remote.*.url:https://git-int.sit.fraunhofer.de/**"]
+    path = ~/dotfiles/gitconfig/sit.gitconfig
+[core]
+	excludesfile = ~/dotfiles/.gitignore_global
+[submodule]
+	recurse = true
+[filter "lfs"]
+	clean = git-lfs clean -- %f
+	smudge = git-lfs smudge -- %f
+	process = git-lfs filter-process
+	required = true
+[rebase]
+	autoStash = true
+[pull]
+	rebase = true

gitconfig/github.gitconfig

@@ -0,0 +1,3 @@
+[user]
+name = Fabian Ising
+email = github@murgi.de

gitconfig/murgi.gitconfig

@@ -0,0 +1,3 @@
+[user]
+name = Fabian Ising
+email = fabian@murgi.de

gitconfig/sit.gitconfig

@@ -0,0 +1,3 @@
+[user]
+name = Fabian Ising
+email = fabian.ising@sit.fraunhofer.de

link_config.sh

@@ -11,3 +11,4 @@ for filename in .config/*; do
 done
 
 ln -Ts $PWD/nvim $HOME/.config/nvim
+ln -Ts $PWD/gitconfig/gitconfig $HOME/.gitconfig

nvim/ftplugin/tex.vim

@@ -1,4 +1,4 @@
-set formatoptions+=1rnmBa
+setlocal formatoptions+=1rnmBj
 
 " Reformat lines (getting the spacing correct) {{{
 fun! TeX_fmt()

nvim/init.vim

@@ -1,15 +1,40 @@
 set nocompatible
 filetype off
 
+" Find python
+if has("macunix")
+    " Required for virtualenvs
+    let arch=substitute(system('uname -m'), '\n', '', '')
+    if arch == 'arm64'
+        let g:python_interpreter=expand("~/python-envs/neovim/bin/python3")
+    else
+        let g:python_interpreter="/usr/local/bin/python3"
+    endif
+    let g:tagbar_ctags="/opt/homebrew/bin/ctags"
+else
+    let g:python_interpreter = 'python3'
+endif
+let g:python3_host_prog=g:python_interpreter
+
 " Plugins
 " Note: on most systems, this will make the plugins reside in \
 " ~/.local/share/nvim/plugged/
-let data_dir = has('nvim') ? stdpath('data') . '/site' : '~/.vim'
+let data_dir = has('nvim') ? stdpath('data') . '/site' : expand('~/.vim')
 if empty(glob(data_dir . '/autoload/plug.vim'))
   silent execute '!curl -fLo '.data_dir.'/autoload/plug.vim --create-dirs  https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim'
+  let &runtimepath = &runtimepath
   autocmd VimEnter * PlugInstall --sync | source $MYVIMRC
 endif
+
+" Disable Perl
+let g:loaded_perl_provider = 0
+
 call plug#begin()
+
+if !exists('g:vscode')
+" Warn about plugin updates
+Plug 'semanser/vim-outdated-plugins'
+
 " Powerline replacement
 Plug 'vim-airline/vim-airline'
 Plug 'vim-airline/vim-airline-themes'
@@ -35,18 +60,22 @@ Plug 'ConradIrwin/vim-bracketed-paste'
 Plug 'christoomey/vim-tmux-navigator'
 
 " YouCompleteMe
-Plug 'Valloric/YouCompleteMe'
+function! BuildYCM(info)
+  " info is a dictionary with 3 fields
+  " - name:   name of the plugin
+  " - status: 'installed', 'updated', or 'unchanged'
+  " - force:  set on PlugInstall! or PlugUpdate!
+  if a:info.status == 'installed' || a:info.status == 'updated' || a:info.force
+    execute '!' . g:python_interpreter . ' ./install.py --all'
+  endif
+endfunction
+
+Plug 'ycm-core/YouCompleteMe', { 'do': function('BuildYCM') }
 Plug 'rdnetto/YCM-Generator'
 
 " Git
 Plug 'tpope/vim-fugitive'
 
-" Comments
-Plug 'scrooloose/nerdcommenter'
-
-" Surround
-Plug 'tpope/vim-surround'
-
 " Snippets
 " Track the engine.
 Plug 'SirVer/ultisnips'
@@ -69,6 +98,18 @@ Plug 'lervag/vimtex'
 "Go
 Plug 'fatih/vim-go'
 
+"Macdown (only on macOS)
+"if has("macunix")
+    "Plug 'hashrocket/vim-macdown'
+"endif
+" Comments
+Plug 'scrooloose/nerdcommenter'
+
+" Surround
+Plug 'tpope/vim-surround'
+
+endif
+
 call plug#end()
 
 " Run PlugInstall if there are missing plugins
@@ -81,8 +122,7 @@ filetype plugin indent on
 set cinkeys-=0#
 
 " Terminal emulator settings
-set t_Co=256
-"set term=screen-256color
+set termguicolors
 
 " Color configuration
 try
@@ -90,6 +130,7 @@ try
 catch
     " Ignore non existing file
 endtry
+highlight Comment cterm=italic gui=italic
 syntax enable	" enable syntax processing
 
 " Disable annoying bell
@@ -102,7 +143,8 @@ set modeline
 let mapleader = "\<Space>" " Make space the leader key
 nnoremap <Leader>w :w<CR>| " Write file
 nnoremap <Leader>q :q<CR>| " Close file
-nnoremap <Leader>s :w !sudo tee %<CR>L<CR>
+nnoremap <Leader>s :w !sudo -A tee %<CR>L<CR>
+cmap w!! w !sudo -A tee > /dev/null %
 
 nmap <Leader><Leader> V| " Change to visual line mode
 map q: :q| " No command history
@@ -114,14 +156,23 @@ nmap <Leader>mt :tab sp<CR> | " maximize window to new tab
 nmap <Leader>. <C-w>= | " Split windows equally
 map gb :bnext<CR>
 map gB :bNext<CR>
+if !exists('g:vscode')
 call submode#enter_with('grow/shrink', 'n', '', '<Leader>r', '<Nop>')
 call submode#map('grow/shrink', 'n', '', '+', '<C-w>+')
 call submode#map('grow/shrink', 'n', '', '-', '<C-w>-')
 call submode#map('grow/shrink', 'n', '', '<', '<C-w><')
 call submode#map('grow/shrink', 'n', '', '>', '<C-w>>')
+endif
 set splitbelow
 set splitright
 
+" Delete without copying
+nnoremap <leader>d "_d
+xnoremap <leader>d "_d
+nnoremap <leader>x "_x
+xnoremap <leader>x "_x
+xnoremap <leader>p "_dP
+
 "disable submode timeouts:
 let g:submode_timeout = 0
 " don't consume submode-leaving key
@@ -191,6 +242,56 @@ nmap <Leader>t :call TextWrapToggle()<CR>
 "augroup END
 
 "Copying
+if !exists('g:vscode')
+lua << EOF
+local uname = vim.loop.os_uname()
+_G.OS = uname.sysname
+local IS_LINUX = _G.OS == 'Linux'
+_G.IS_WSL = IS_LINUX and uname.release:lower():find 'microsoft' and true or false
+if _G.IS_WSL then
+vim.g.clipboard = {
+     name = 'WslClipboard',
+     copy = {
+        ['+'] = 'clip.exe',
+        ['*'] = 'clip.exe',
+      },
+     paste = {
+        ['+'] = 'powershell.exe -NoLogo -NoProfile -c [Console]::Out.Write($(Get-Clipboard -Raw).tostring().replace("`r", ""))',
+        ['*'] = 'powershell.exe -NoLogo -NoProfile -c [Console]::Out.Write($(Get-Clipboard -Raw).tostring().replace("`r", ""))',
+     },
+     cache_enabled = 0,
+    }
+else
+vim.g.clipboard = {
+  name = 'OSC 52',
+  copy = {
+    ['+'] = require('vim.ui.clipboard.osc52').copy('+'),
+    ['*'] = require('vim.ui.clipboard.osc52').copy('*'),
+  },
+  paste = {
+    ['+'] = require('vim.ui.clipboard.osc52').paste('+'),
+    ['*'] = require('vim.ui.clipboard.osc52').paste('*'),
+  },
+}
+end
+if vim.env.TMUX ~= nil then
+  local copy = {'tmux', 'load-buffer', '-w', '-'}
+  local paste = {'bash', '-c', 'tmux refresh-client -l && sleep 0.05 && tmux save-buffer -'}
+  vim.g.clipboard = {
+    name = 'tmux',
+    copy = {
+      ['+'] = copy,
+      ['*'] = copy,
+    },
+    paste = {
+      ['+'] = paste,
+      ['*'] = paste,
+    },
+    cache_enabled = 0,
+  }
+end
+EOF
+endif
 set clipboard=unnamedplus,unnamed " Copy/Paste
 
 " Airline
@@ -203,9 +304,12 @@ nmap <C-]> <C-w><C-]><C-w>T
 
 " YouCompleteMe
 let g:ycm_collect_identifiers_from_tags_files = 1 " Read from tag files
-let g:ycm_global_ycm_extra_conf = '~/.config/nvim/.ycm_extra_conf.py' " Standard conf
+let g:ycm_global_ycm_extra_conf = expand('~/.config/nvim/.ycm_extra_conf.py') " Standard conf
 let g:ycm_enable_diagnostic_signs = 0 " Do not show semantic error bar
-let g:ycm_server_python_interpreter = 'python3'
+let g:ycm_server_python_interpreter=g:python_interpreter
+let g:ycm_python_interpreter_path=g:python_interpreter
+" Enable virtualenv autocompletion
+let g:ycm_python_binary_path = 'python3'
 let g:ycm_key_list_select_completion   = ['<C-j>', '<C-n>', '<Down>']
 let g:ycm_key_list_previous_completion = ['<C-k>', '<C-p>', '<Up>']
 
@@ -244,16 +348,16 @@ let g:UltiSnipsEditSplit="vertical"
 set rtp+=~/.config/nvim/my-snippets
 
 " Folding
-set foldmethod=syntax
+set foldmethod=indent
 set foldlevel=100
-" Use F9 to toggle folding
+" Use F9 or <Leader>z to toggle folding
 inoremap <F9> <C-O>za
 nnoremap <F9> za
 onoremap <F9> <C-C>za
 vnoremap <F9> zf
-nnoremap <Leader>a za
-onoremap <Leader>a <C-C>za
-vnoremap <Leader>a zf
+nnoremap <Leader>z za
+onoremap <Leader>z <C-C>za
+vnoremap <Leader>z zf
 
 try
     source ~/.config/nvim/.vimrc_config_expand_region
@@ -269,8 +373,3 @@ catch
 endtry
 let g:tex_flavor = "latex"
 autocmd FileType yaml setlocal ts=2 sts=2 sw=2 expandtab
-
-if has("macunix")
-    " Required for virtualenvs
-    let g:python3_host_prog="/usr/local/bin/python3"
-endif

push.sh

@@ -1,14 +0,0 @@
-#! /bin/sh
-#
-# update.sh
-# Copyright (C) 2017 Fabian Ising <fabian@murgi.de>
-#
-# Distributed under terms of the Apache v2.0 license.
-#
-
-git pull
-
-git subtree push --prefix=i3 i3 master
-git subtree push --prefix=tmux tmux master
-git subtree push --prefix=zsh zsh master
-git subtree push --prefix=vim vim master

setup_arch.sh

@@ -5,15 +5,17 @@
 #
 # Distributed under terms of the MIT license.
 #
+set -e
 
 sudo pacman --needed -Sy archlinux-keyring --noconfirm
 sudo pacman --needed -Syu --noconfirm
-sudo pacman --needed -Sy base-devel xorg xorg-xinit gnome gnome-extra neovim zsh tmux openssh alacritty powerline-fonts python-pip --noconfirm
-cp $PWD/nvim/scheme.vim.template $PWD/nvim/scheme.vim
-cp $PWD/.config/alacritty/schemes.yml.template $PWD/.config/alacritty/schemes.yml
-pip3 install neovim
+sudo pacman --needed -Sy base-devel gnome neovim zsh tmux openssh alacritty powerline-fonts python-pip python-pynvim --noconfirm
+
 ./clone_and_link.sh
 ./copy_fonts_arch.sh
+
+cp $PWD/nvim/scheme.vim.template $PWD/nvim/scheme.vim
+cp $PWD/.config/alacritty/schemes.yml.template $PWD/.config/alacritty/schemes.yml
 if [ $SHELL != "/bin/zsh" ]; then
     chsh -s /usr/bin/zsh;
 fi
@@ -26,7 +28,4 @@ for filename in tmux/.*_arch.example; do
     cp $filename ${filename:0:-13}
 done
 
-for filename in vim/.*_arch.example; do
-    cp $filename ${filename:0:-13}
-done
 echo "You should now start tmux (and zsh) and nvim  for automatic plugin installation."

setup_mac.sh

@@ -1,4 +1,4 @@
-#! /bin/sh
+#! /bin/zsh
 #
 # setup_mac.sh
 # Copyright (C) 2022 fabian <fabian@FordPrefect.home>
@@ -6,8 +6,11 @@
 # Distributed under terms of the MIT license.
 #
 
-brew install neovim tmux alacritty coreutils
-pip3 install neovim
+brew install neovim tmux alacritty coreutils cmake golang npm virtualenvwrapper
+source /opt/homebrew/bin/virtualenvwrapper.sh
+mkvirtualenv neovim
+pip3 install pynvim
+npm install -g neovim
 echo For alacritty to work seemlessly with tmux, we will have to add '/usr/local/bin'\
     to the path. This will require your root password.
 sudo launchctl config user path /usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin 
@@ -15,16 +18,14 @@ cp $PWD/nvim/scheme.vim.template $PWD/nvim/scheme.vim
 cp $PWD/.config/alacritty/schemes.yml.template $PWD/.config/alacritty/schemes.yml
 ./clone_and_link_mac.sh
 
-for filename in zsh/.*_mac.example; do
-    cp $filename ${filename:0:-12}
+for filename in zsh/.*_mac.example(N); do
+    gln -Tsvf $PWD/$filename $PWD/${filename:0:-12}
 done
 
-for filename in tmux/.*_mac.example; do
-    cp $filename ${filename:0:-12}
+for filename in tmux/.*_mac.example(N); do
+    gln -Tsvf $PWD/$filename $PWD/${filename:0:-12}
 done
 
-for filename in vim/.*_mac.example; do
-    cp $filename ${filename:0:-12}
-done
+open fonts/*.ttf
 
 echo "You should now start tmux (and zsh) and nvim for automatic plugin installation."

tmux/.tmux.conf

@@ -1,5 +1,6 @@
-set-environment -g PATH "/usr/local/bin:/bin:/usr/bin"
-set -g default-terminal "xterm-256color"
+set-environment -g PATH "/usr/local/bin:/bin:/usr/bin:/opt/homebrew/bin"
+set -g default-terminal "tmux-256color"
+set -sa terminal-features ",xterm-256color:RGB"
 
 set -g history-limit 20000
 
@@ -10,11 +11,35 @@ bind-key C-a send-prefix
 bind-key -n C-b send-keys C-b
 #bind-key -n C-b send-prefix
 
+# Use F12 to toggle hotekys on/off for nested remote tmux sessions
+bind -T root F12  \
+  set prefix None \;\
+  set key-table off \;\
+  set status-style "fg=colour245,bg=colour238"\;\
+  refresh-client -S
+
+bind -T off F12 \
+  set -u prefix \;\
+  set -u key-table \;\
+  set -u status-style \;\
+  refresh-client -S
+
 setw -g mode-keys vi
 set-option -g status-keys vi
 
-bind | split-window -h -c '#{pane_current_path}'
-bind - split-window -v -c '#{pane_current_path}'
+# Splits keep the source pane's cwd AND its active Python venv. #{@venv} is set
+# per-pane by the shell (see .virtual_env_config.zsh); we go through run-shell
+# because tmux expands FORMATS in a run-shell command but NOT in split-window's
+# own -e value. The new pane inherits VIRTUAL_ENV and .zshrc re-activates it;
+# when the source pane has no venv we omit -e so no empty var leaks in. New
+# *windows* deliberately don't inherit it.
+bind | run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -h -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -h -c "$d"; fi'
+bind - run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -v -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -v -c "$d"; fi'
+
+# New windows always start in the base environment: -e clears any inherited
+# VIRTUAL_ENV (e.g. if the tmux server was first started from inside a venv, so
+# its global env carries one), regardless of what the source pane had.
+bind c new-window -e VIRTUAL_ENV=
 
 # Switch windows
 bind-key -n M-Left select-window -t -1
@@ -33,9 +58,10 @@ bind k clear-history\; display "History cleared"
 
 bind-key a set-window-option synchronize-panes
 
-bind r source-file ~/.tmux.conf\; display "Conf reloaded!"
+bind r source-file ~/.tmux.conf\; display "Tmux conf reloaded!"
 
 set -g mouse on
+set-option -g focus-events on
 
 #bind-key -Tcopy-mode-vi 'v' send -X begin-selection
 #bind-key -Tcopy-mode-vi 'y' send -X copy-selection
@@ -59,9 +85,13 @@ bind-key C-o send-keys C-o
 # move tmux copy buffer into x clipboard
 # Vi copypaste mode
 set-window-option -g mode-keys vi
-set-option -s set-clipboard on
+set -g allow-passthrough on
+set-option -g set-clipboard on
 set -g @yank_with_mouse off
 set -g @yank_action 'copy-pipe'
+bind-key -Tcopy-mode-vi 'C-right' send -X next-word
+bind-key -Tcopy-mode-vi 'C-left' send -X previous-word
+unbind-key -T copy-mode-vi MouseDragEnd1Pane
 
 if '[ `uname` == Darwin ]' \
     'source-file ~/.tmux/.mac_config'
@@ -69,6 +99,12 @@ if '[ `uname` == Darwin ]' \
 set-option -g set-titles on
 
 
+set -g visual-bell on
+# Forward bells from ALL panes to terminal (not just active one)
+set -g bell-action any
+# Enable bell monitoring
+set -g monitor-bell on
+
 # Escape timeout for nvim
 set -sg escape-time 10
 
@@ -78,7 +114,10 @@ set -g @plugin 'tmux-plugins/tpm'
 set -g @plugin 'tmux-plugins/tmux-open'
 set -g @plugin 'tmux-plugins/tmux-yank'
 set -g @plugin 'jimeh/tmux-themepack'
-set -g @themepack 'powerline/double/blue'
+set -g @plugin 'nhdaly/tmux-better-mouse-mode'
+set -g @themepack 'powerline/double/green'
+
+set -g @tpm-clean 'u'
 
 setenv -g TMUX_PLUGIN_MANAGER_PATH "$HOME/.tmux/plugins/"
 

tmux/mac_tmux_wrapper.sh

@@ -1,11 +0,0 @@
-#! /bin/sh
-#
-# test.sh
-# Copyright (C) 2018 fabian <fabian@FordPrefect.local>
-#
-# Distributed under terms of the MIT license.
-#
-
-
-export PATH=$PATH:/usr/local/bin
-tmux

tmux/tmux_attach.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 #
 # tmux-attach - attach to first unattached session or
 #         create new session if none are found

update_mac.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+ARCH=`uname -m`
+if [[ $ARCH == "arm64" ]]; then
+    PREFIX="/opt/homebrew/"
+else
+    PREFIX="/usr/local/"
+fi
+
+function set_permissions {
+    echo "----------"
+    echo "Disabling Quarantine for Casks ..."
+    echo "----------"
+    sudo find $PREFIX/Caskroom -name *.app -exec bash -c "xattr -d com.apple.quarantine {} 2> /dev/null" \;
+    sudo find $PREFIX/Caskroom -type f -perm +111 -exec bash -c "xattr -d com.apple.quarantine {} 2> /dev/null" \; 
+    sudo find /Applications/ -name *.app -exec bash -c 'xattr -d com.apple.quarantine "{}" 2> /dev/null' \;
+    sudo find /Applications/ -type f -perm +111 -exec bash -c 'xattr -d com.apple.quarantine "{}" 2> /dev/null' \;
+}
+
+function software_update {
+    echo "----------"
+    echo "Running software update"
+    echo "----------"
+    softwareupdate --all --install --force
+}
+
+function update_brew {
+    echo "----------"
+    echo "Updating brew software"
+    echo "----------"
+    brew update
+    sudo -u $USER brew upgrade
+    echo "----------"
+    echo "Updating casks"
+    echo "----------"
+    sudo -u $USER brew upgrade --cask --greedy --verbose
+}
+
+function cleanup {
+    echo "----------"
+    echo "Running cleanup"
+    echo "----------"
+    sudo -u $USER brew cleanup -s
+}
+
+function diagnostics {
+    echo "----------"
+    echo "Running diagnostics"
+    echo "----------"
+    brew doctor
+    brew missing
+}
+function update_others {
+    echo "----------"
+    echo "Update other stuff"
+    echo "----------"
+
+    if [ -x "$(command -v claude)" ]; then
+        echo "-- CLAUDE"
+        claude --update
+    fi
+
+    if [ -x "$(command -v codex)" ]; then
+        echo "-- CODEX"
+        codex update
+    fi
+}
+
+if [[ $* == *--help* ]]; then
+    echo "Usage: $0 [option]"
+    echo "Default options: --brew-update --update-others --cleanup --diagnostics"
+    echo -e "Options:\n\t--brew-update\n\t--update-others\n\t--cleanup\n\t--diagnostics\n\t--permission-fix\n\t--system-update"
+fi
+
+if [[ -z $* ]]; then
+    set -- "$*" "--brew-update --cleanup --diagnostics --update-others"
+fi
+
+if [[ $* == *--system-update* ]]; then
+    software_update
+fi
+if [[ $* == *--brew-update* ]]; then
+    update_brew
+fi
+if [[ $* == *--update-others* ]]; then
+    update_others
+fi
+if [[ $* == *--cleanup* ]]; then
+    cleanup
+fi
+if [[ $* == *--diagnostics* ]]; then
+    diagnostics
+fi
+if [[ $* == *--permission-fix* ]]; then
+    set_permissions
+fi

virtualenvwrapper/postactivate

@@ -0,0 +1,6 @@
+#!/bin/zsh
+# This hook is sourced after every virtualenv is activated.
+
+if [[ -n "$TMUX" ]]; then
+    tmux set-environment VIRTUAL_ENV $VIRTUAL_ENV
+fi

virtualenvwrapper/postdeactivate

@@ -0,0 +1,6 @@
+#!/bin/zsh
+# This hook is sourced after every virtualenv is deactivated.
+
+if [[ -n "$TMUX" ]]; then
+    tmux set-environment -r VIRTUAL_ENV
+fi

virtualenvwrapper/postmkvirtualenv

@@ -0,0 +1,4 @@
+#!/bin/zsh
+# This hook is sourced after a new virtualenv is activated.
+
+pip3 install neovim

zsh/.gitignore

@@ -1,4 +1,6 @@
 .*_config*
 !.*_config*.example
+.p10k.zsh
 .p10k.mac.zsh
 antigen/
+.env.local

zsh/.mac_config.example

@@ -1,13 +0,0 @@
-export LC_ALL=en_US.UTF-8
-export LANG=en_US.UTF-8
-export POWERLINE_CONFIG_COMMAND=/usr/local/bin/powerline-config
-export JAVA_HOME=`/usr/libexec/java_home -v 1.8`
-
-# Set path to work with pycharm ...
-[[ "$PATH" =~ /usr/local/bin ]] || export PATH=$PATH:/usr/local/bin
-PATH="/usr/local/opt/coreutils/libexec/gnubin:$PATH"
-
-test -e "${HOME}/.iterm2_shell_integration.zsh" && source "${HOME}/.iterm2_shell_integration.zsh"
-
-# Research
-export PATH="/Users/fabian/Labor/Research/code_signing/02-tools:$PATH"

zsh/.mac_config.zsh_mac.example

@@ -0,0 +1,42 @@
+export LC_ALL=en_US.UTF-8
+export LANG=en_US.UTF-8
+export JAVA_HOME=`/usr/libexec/java_home`
+defaults write .GlobalPreferences AppleLocale en_DE
+
+# Set path to work with pycharm ...
+# [[ "$PATH" =~ /usr/local/bin ]] || export PATH=$PATH:/usr/local/bin
+
+ARCH=`uname -m`
+if [[ $ARCH == "arm64" ]]; then
+    export HOMEBREW_PREFIX="/opt/homebrew"
+else
+    export HOMEBREW_PREFIX="/usr/local"
+fi
+export PATH="$HOMEBREW_PREFIX/opt/coreutils/libexec/gnubin:$HOME/.local/bin:$HOMEBREW_PREFIX/bin:$PATH:$HOMEBREW_PREFIX/sbin"
+
+# macOS-specific completion functions.
+fpath=("${ZDOTDIR:-$HOME}/.zsh/completions_mac" $fpath)
+autoload -Uz _launchctl
+compdef _launchctl launchctl
+
+# test -e "${HOME}/.iterm2_shell_integration.zsh" && source "${HOME}/.iterm2_shell_integration.zsh"
+
+# Research
+# export PATH="/Users/fabian/Labor/Research/code_signing/02-tools:$PATH"
+alias tailscale=/Applications/Tailscale.app/Contents/MacOS/Tailscale
+#alias virt-manager="LD_PRELOAD=/opt/homebrew/Cellar/glib/2.86.0/lib virt-manager"
+#alias virt-manager="LD_PRELOAD=/opt/homebrew/Cellar/glib/2.86.0/lib $HOME/python-envs/virt-manager/bin/python3 $HOME/stuff/virt-manager/virt-manager"
+
+HOMEBREW_COMMAND_NOT_FOUND_HANDLER="$(brew --repository)/Library/Homebrew/command-not-found/handler.sh"
+if [ -f "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER" ]; then
+  source "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER";
+fi
+
+export DYLD_FALLBACK_LIBRARY_PATH="$HOMEBREW_PREFIX/lib${DYLD_FALLBACK_LIBRARY_PATH:+:$DYLD_FALLBACK_LIBRARY_PATH}"
+export GI_TYPELIB_PATH="$HOMEBREW_PREFIX/lib/girepository-1.0${GI_TYPELIB_PATH:+:$GI_TYPELIB_PATH}"
+export PKG_CONFIG_PATH="$HOMEBREW_PREFIX/lib/pkgconfig:$HOMEBREW_PREFIX/share/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+alias python="python3"
+
+# Tahoe 26 WindowServer bug: windows stay interactive but can't be moved by
+# mouse or API until the window-management daemon is restarted (no logout).
+alias unstick-windows="killall WindowManager"

zsh/.virtual_env_config.zsh_mac.example

@@ -1,4 +1,75 @@
+ARCH=`uname -m`
+if [[ $ARCH == "arm64" ]]; then
+    PREFIX="/opt/homebrew"
+else
+    PREFIX="/usr/local"
+fi
+
 export WORKON_HOME=~/python-envs
-export VIRTUALENVWRAPPER_VIRTUALENV=/usr/local/bin/virtualenv
+export VIRTUALENVWRAPPER_VIRTUALENV=$PREFIX/bin/virtualenv
 mkdir -p $WORKON_HOME
-source /usr/local/bin/virtualenvwrapper.sh
+source $PREFIX/bin/virtualenvwrapper.sh
+
+# NOTE: an inherited VIRTUAL_ENV is *not* re-activated here — that happens at the
+# very end of .zshrc so activate captures the fully-built PATH (see the comment
+# there). Sourcing virtualenvwrapper.sh above only defines workon/deactivate/etc.
+
+# Mirror the current venv into a per-pane tmux option so that splitting a pane
+# can carry it into the new pane (.tmux.conf reads #{@venv} with `-e`). Per-pane
+# (not session) state is what lets two panes hold different venvs and lets new
+# *windows* start clean. Only fork tmux when the value actually changes.
+_venv_track_precmd() {
+    [[ -n $TMUX ]] || return
+    if [[ "${VIRTUAL_ENV:-}" != "${_LAST_TRACKED_VENV-unset}" ]]; then
+        tmux set -p @venv "${VIRTUAL_ENV:-}" 2>/dev/null
+        _LAST_TRACKED_VENV="${VIRTUAL_ENV:-}"
+    fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd _venv_track_precmd
+
+# Which venv an agent shell should use: nearest .venv/venv walking up from $1
+# (default $PWD, stopping above $HOME), else the shared fallback env.
+_agent_venv_path() {
+    local d=${1:-$PWD} c
+    while [[ $d == */* && $d != $HOME ]]; do
+        for c in "$d/.venv" "$d/venv"; do
+            [[ -f $c/bin/activate ]] && { print -r -- "$c"; return 0 }
+        done
+        d=${d%/*}
+    done
+    [[ -f $HOME/python-envs/claude/bin/activate ]] && print -r -- "$HOME/python-envs/claude"
+}
+
+# Agent shells source this file once per session, rooted at the project dir, and
+# snapshot the result: CLAUDECODE marks Claude Code, CODEX_SHELL the ChatGPT/Codex
+# desktop app. Only VIRTUAL_ENV is set here; the block at the end of .zshrc turns it
+# into an activation once PATH is fully built. Terminal launches use the wrappers below.
+if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]] && [[ -z ${VIRTUAL_ENV:-} ]]; then
+    _venv=$(_agent_venv_path)
+    [[ -n $_venv ]] && export VIRTUAL_ENV=$_venv
+    unset _venv
+fi
+
+# Claude Code takes PATH from its own process env: its shell snapshot writes
+# `export PATH=` last, discarding whatever .zshrc built. So the venv has to be
+# active *before* launch. The subshell keeps this shell's PATH untouched.
+claude() {
+    if [[ -n ${VIRTUAL_ENV:-} ]]; then
+        command claude "$@"
+        return
+    fi
+    local v=$(_agent_venv_path)
+    ( [[ -n $v ]] && source "$v/bin/activate"; exec command claude "$@" )
+}
+
+# Codex captures the profile's own PATH, so hand it VIRTUAL_ENV only and let the
+# activation block at the end of .zshrc order PATH correctly. Pre-activating here
+# would leave venv/bin behind gnubin and homebrew, same as tmux-inherited venvs.
+codex() {
+    if [[ -n ${VIRTUAL_ENV:-} ]]; then
+        command codex "$@"
+    else
+        VIRTUAL_ENV=$(_agent_venv_path) command codex "$@"
+    fi
+}

zsh/.zsh_plugins.txt

@@ -1,22 +1,27 @@
 # Load OMZ plugins
 ohmyzsh/ohmyzsh
+ohmyzsh/ohmyzsh path:lib
 ohmyzsh/ohmyzsh path:plugins/git
 ohmyzsh/ohmyzsh path:plugins/golang
 ohmyzsh/ohmyzsh path:plugins/ssh-agent
 ohmyzsh/ohmyzsh path:plugins/pip
 ohmyzsh/ohmyzsh path:plugins/python
+ohmyzsh/ohmyzsh path:plugins/brew
 ohmyzsh/ohmyzsh path:plugins/virtualenv
-ohmyzsh/ohmyzsh path:plugins/python
+ohmyzsh/ohmyzsh path:plugins/command-not-found
+ohmyzsh/ohmyzsh path:plugins/docker-compose
+ohmyzsh/ohmyzsh path:plugins/docker
+ohmyzsh/ohmyzsh path:plugins/vi-mode
 
 
 romkatv/powerlevel10k
-zsh-users/zsh-syntax-highlighting
 zsh-users/zsh-autosuggestions
 zsh-users/zsh-completions
 zsh-users/zsh-history-substring-search
 urbainvaes/fzf-marks
-greymd/docker-zsh-completion
-zdharma-continuum/fast-syntax-highlighting kind:defer
+zdharma-continuum/fast-syntax-highlighting
+# Select with shift
+jirutka/zsh-shift-select
 
 # Initialize completions
 belak/zsh-utils path:completion

zsh/.zshrc

@@ -1,64 +1,77 @@
-# Enable Powerlevel10k instant prompt. Should stay close to the top of ~/.zshrc.
-# Initialization code that may require console input (password prompts, [y/n]
-# confirmations, etc.) must go above this block; everything else may go below.
-#if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
-  #source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
-#fi
-export PATH="$HOME/.local/bin:$PATH"
-
+# Powerlevel10k instant prompt and machine-local layers must remain first.
 [[ -f ~/.zsh/.powerline_config ]] && source ~/.zsh/.powerline_config
 [[ -f ~/.zsh/.user_config ]] && source ~/.zsh/.user_config
 [[ -f ~/.zsh/.virtual_env_config.zsh ]] && source ~/.zsh/.virtual_env_config.zsh
-[[ -f /usr/share/doc/find-the-command/ftc.zsh ]] && source /usr/share/doc/find-the-command/ftc.zsh
 [[ -f ~/.zsh/.local_config ]] && source ~/.zsh/.local_config
+[[ -f ~/.zsh/.env.local ]] && source ~/.zsh/.env.local
 
-# Load Antidote
-mkdir -p ${ZDOTDIR:-~}/.cache/zsh
-static_file=${ZDOTDIR:-~}/.cache/zsh/.zsh_plugins.zsh
-plugins_txt=${ZDOTDIR:-~}/.zsh/.zsh_plugins.txt
-# clone antidote if necessary
-if ! [[ -e ${ZDOTDIR:-~}/.antidote ]]; then
-  git clone https://github.com/mattmc3/antidote.git ${ZDOTDIR:-~}/.antidote
+source "${ZDOTDIR:-$HOME}/.zsh/lib/updates.zsh"
+export LC_OSC52=1
+
+# Completions for tools installed under ~/.local (e.g. tools-repo's safe*
+# wrappers). Must precede antidote, whose completion plugin runs compinit.
+fpath=("$HOME/.local/share/zsh/site-functions" $fpath)
+
+plugins_txt=${ZDOTDIR:-$HOME}/.zsh/.zsh_plugins.txt
+static_file=${ZDOTDIR:-$HOME}/.cache/zsh/.zsh_plugins.zsh
+source "${ZDOTDIR:-$HOME}/.zsh/lib/antidote.zsh"
+source "${ZDOTDIR:-$HOME}/.zsh/lib/interactive.zsh"
+
+bindkey '^w' kill-region
+bindkey -v
+VI_MODE_SET_CURSOR=true
+
+[[ -f ~/.zsh/.mac_config.zsh ]] && source ~/.zsh/.mac_config.zsh
+if (( $+commands[go] )); then
+    export GOPATH="$(go env GOPATH 2>/dev/null)"
+    [[ -n "$GOPATH" ]] && path+=("$GOPATH/bin")
 fi
 
-# source antidote and load plugins from `${ZDOTDIR:-~}/.zsh_plugins.txt`
-source ${ZDOTDIR:-~}/.antidote/antidote.zsh
-antidote load ${plugins_txt} ${static_file}
+# Use safe wrappers after ~/.local/bin has been added to PATH.
+(( $+commands[safecp] )) && alias cp=safecp
+(( $+commands[safemv] )) && alias mv=safemv
+(( $+commands[safescp] )) && alias scp=safescp
 
-setopt interactivecomments
-setopt HIST_IGNORE_SPACE
-# Clear screen by ctrl+q
-bindkey '^q' clear-screen
+if [[ -f ~/.ssh/sudo_key ]]; then
+    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
+    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l |
+        grep -q "$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')" ||
+        SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
+fi
+export SUDO_ASKPASS=$(command -v ssh-askpass)
 
-alias vim=nvim
-alias sudo='sudo '
-export EDITOR='nvim'
-
-#PATH="/home/fabian/perl5/bin${PATH:+:${PATH}}"; export PATH;
-#PERL5LIB="/home/fabian/perl5/lib/perl5${PERL5LIB:+:${PERL5LIB}}"; export PERL5LIB;
-#PERL_LOCAL_LIB_ROOT="/home/fabian/perl5${PERL_LOCAL_LIB_ROOT:+:${PERL_LOCAL_LIB_ROOT}}"; export PERL_LOCAL_LIB_ROOT;
-#PERL_MB_OPT="--install_base \"/home/fabian/perl5\""; export PERL_MB_OPT;
-#PERL_MM_OPT="INSTALL_BASE=/home/fabian/perl5"; export PERL_MM_OPT;
-alias ls="ls --color=always"
-#export PATH="$PATH:${HOME}/Labor/tls-in-muas/starttls-research/99-Tools:/home/fabian/go/bin"
-# For ccache
-#export CCACHE_CPP2=YES
-
-delzip() {
-   unzip -Z -1 "$@" |  xargs -I{} rm -rf {}
-}
-# mitmproxy
-export MITMPROXY_SSLKEYLOGFILE="~/.mitmproxy/sslkeylogfile.txt"
-
-[[ -f ~/.zsh/.mac_config ]] && source ~/.zsh/.mac_config
-
-# Powerlevel 10k
-# Remove padding on right side
-ZLE_RPROMPT_INDENT=0
-
-# To customize prompt, run `p10k configure` or edit ~/dotfiles/zsh/.p10k.zsh.
-if test -f ~/dotfiles/zsh/.p10k.mac.zsh; then 
-    source ~/dotfiles/zsh/.p10k.mac.zsh
+if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
+    p10k_config=~/dotfiles/zsh/.p10k.mac.zsh
 else
-    [[ ! -f ~/dotfiles/zsh/.p10k.zsh ]] || source ~/dotfiles/zsh/.p10k.zsh
+    p10k_config=~/dotfiles/zsh/.p10k.zsh
+fi
+source "${ZDOTDIR:-$HOME}/.zsh/lib/prompt.zsh"
+
+alias screenshot_mode='powerlevel10k_plugin_unload; export PS1="$ "; python3 ~/.config/alacritty/screenshot_mode.py on'
+alias screenshot_mode_off='prompt_powerlevel9k_setup; python3 ~/.config/alacritty/screenshot_mode.py off'
+antidote update &>/dev/null &|
+
+[[ -d "$HOME/.lmstudio/bin" ]] && path+=("$HOME/.lmstudio/bin")
+[[ -d "$HOME/.runai/bin" ]] && path+=("$HOME/.runai/bin")
+runai_bin="$HOME/.runai/bin/runai"
+runai_completion=${ZDOTDIR:-$HOME}/.cache/zsh/runai-completion.zsh
+if [[ -x "$runai_bin" ]]; then
+    if [[ ! -s "$runai_completion" || "$runai_bin" -nt "$runai_completion" ]]; then
+        runai_completion_tmp="$runai_completion.$$.tmp"
+        if "$runai_bin" --quiet completion zsh >| "$runai_completion_tmp"; then
+            command mv -f "$runai_completion_tmp" "$runai_completion"
+        else
+            command rm -f "$runai_completion_tmp"
+        fi
+    fi
+    [[ -s "$runai_completion" ]] && source "$runai_completion"
+fi
+
+# Keep this last: activate must snapshot the fully built PATH for deactivate.
+typeset -U path PATH
+[[ -z "${VIRTUAL_ENV:-}" ]] && unset VIRTUAL_ENV
+if [[ -n "$VIRTUAL_ENV" && -f "$VIRTUAL_ENV/bin/activate" ]]; then
+    if [[ ${PATH%%:*} != "$VIRTUAL_ENV/bin" ]]; then
+        source "$VIRTUAL_ENV/bin/activate"
+    fi
 fi

zsh/completions_mac/_launchctl

@@ -0,0 +1,127 @@
+#compdef launchctl
+# macOS launchd completion.
+
+_launchctl_domains() {
+    local uid=$EUID
+    local -a domains=(
+        'system:system services'
+        "user/${uid}:services for the current user"
+        "gui/${uid}:services in the current graphical session"
+    )
+    _describe -t domains 'launchd domain' domains
+}
+
+_launchctl_service_targets() {
+    local uid=$EUID label
+    local -a targets=()
+
+    while IFS=$'\t' read -r _ _ label; do
+        [[ -n $label ]] && targets+=("gui/${uid}/${label}")
+    done < <(launchctl list 2>/dev/null | tail -n +2)
+
+    if (( ${#targets} )); then
+        _describe -t services 'launchd service target' targets
+    else
+        _message 'launchd service target'
+    fi
+}
+
+_launchctl() {
+    local context state state_descr line
+    typeset -A opt_args
+
+    local -a commands=(
+        'bootstrap:register services or directories in a domain'
+        'bootout:unregister services or directories from a domain'
+        'enable:enable a service'
+        'disable:disable a service'
+        'kickstart:run or restart a service'
+        'kill:send a signal to a service'
+        'print:show a domain or service'
+        'print-disabled:show persistent enable and disable overrides'
+        'list:list loaded services'
+        'start:start a legacy service by label'
+        'stop:stop a legacy service by label'
+        'remove:remove a legacy service by label'
+        'load:load legacy plist files'
+        'unload:unload legacy plist files'
+        'setenv:set an environment variable'
+        'unsetenv:unset an environment variable'
+        'getenv:get an environment variable'
+        'limit:view or change resource limits'
+        'config:set persistent launchd configuration'
+        'dumpstate:dump launchd state'
+        'reboot:reboot a launchd domain or the system'
+        'version:show launchd version'
+        'help:show launchctl help'
+    )
+
+    _arguments -C \
+        '1:command:->command' \
+        '*::argument:->args'
+
+    case $state in
+        command)
+            _describe -t commands 'launchctl command' commands
+            ;;
+        args)
+            case $words[2] in
+                bootstrap)
+                    if (( CURRENT == 3 )); then
+                        _launchctl_domains
+                    else
+                        _files -g '*.plist(-.)'
+                    fi
+                    ;;
+                bootout)
+                    if (( CURRENT == 3 )); then
+                        _launchctl_domains
+                        _launchctl_service_targets
+                    else
+                        _files -g '*.plist(-.)'
+                    fi
+                    ;;
+                enable|disable|kickstart)
+                    _launchctl_service_targets
+                    ;;
+                print)
+                    _launchctl_domains
+                    _launchctl_service_targets
+                    ;;
+                print-disabled)
+                    _launchctl_domains
+                    ;;
+                load|unload)
+                    _files -g '*.plist(-.)'
+                    ;;
+                start|stop|remove)
+                    local -a labels
+                    labels=(${${(f)"$(launchctl list 2>/dev/null)"}[2,-1]##*$'\t'})
+                    _describe -t services 'service label' labels
+                    ;;
+                kill)
+                    if (( CURRENT == 3 )); then
+                        _signals
+                    else
+                        _launchctl_service_targets
+                    fi
+                    ;;
+                setenv)
+                    if (( CURRENT == 3 )); then
+                        _parameters
+                    else
+                        _message 'value'
+                    fi
+                    ;;
+                getenv|unsetenv)
+                    _parameters
+                    ;;
+                *)
+                    _message 'argument'
+                    ;;
+            esac
+            ;;
+    esac
+}
+
+_launchctl "$@"

zsh/lib/antidote.zsh

@@ -0,0 +1,12 @@
+# Callers set plugins_txt and static_file before sourcing this module.
+mkdir -p "${static_file:h}"
+if [[ ! -e ${ZDOTDIR:-$HOME}/.antidote ]]; then
+    git clone https://github.com/mattmc3/antidote.git "${ZDOTDIR:-$HOME}/.antidote"
+fi
+
+zstyle ':completion:*:ssh:*' hosts off
+zstyle ':completion:*:scp:*' hosts off
+zstyle ':completion:*:commands' rehash 1
+
+source "${ZDOTDIR:-$HOME}/.antidote/antidote.zsh"
+antidote load "$plugins_txt" "$static_file"

zsh/lib/interactive.zsh

@@ -0,0 +1,110 @@
+setopt interactivecomments
+
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY
+setopt INC_APPEND_HISTORY
+setopt SHARE_HISTORY
+setopt HIST_EXPIRE_DUPS_FIRST
+setopt HIST_IGNORE_DUPS
+setopt HIST_IGNORE_ALL_DUPS
+setopt HIST_FIND_NO_DUPS
+setopt HIST_IGNORE_SPACE
+setopt HIST_SAVE_NO_DUPS
+setopt HIST_REDUCE_BLANKS
+
+bindkey '^q' clear-screen
+(( $+commands[nvim] )) && alias vim=nvim
+(( $+commands[nvim] )) && export EDITOR=nvim VISUAL=nvim
+alias sudo='sudo '
+alias ls='ls --color=always'
+alias cgrep='grep --color=always'
+alias cdiff='git diff --color-words --no-index'
+
+# Remove the files an archive extracted into the current directory.
+# Lists what it will delete and asks first; -f skips the prompt, -n dry-runs.
+# Directories are only removed if they end up empty.
+delzip() {
+    emulate -L zsh
+    setopt local_options
+
+    local dry=0 force=0
+    while [[ $1 == -[nf] ]]; do
+        [[ $1 == -n ]] && dry=1 || force=1
+        shift
+    done
+    (( $# )) || { print -ru2 "usage: delzip [-n|-f] <archive.zip>..."; return 2 }
+
+    local zip entry parent
+    local -a entries files dirs
+    for zip in "$@"; do
+        [[ -f $zip ]] || { print -ru2 "delzip: no such file: $zip"; return 1 }
+        entries=("${(f)$(unzip -Z -1 -- $zip)}") || return 1
+        for entry in $entries; do
+            [[ -n $entry ]] || continue
+            # zip-slip guard: never touch anything outside the cwd
+            if [[ $entry == (/|~)* || $entry == (|*/)..(|/*) ]]; then
+                print -ru2 "delzip: refusing unsafe path: $entry"
+                return 1
+            fi
+            [[ $entry == */ ]] && dirs+=(${entry%/}) || files+=($entry)
+            # many archives omit directory entries, so infer them from the
+            # paths as well; unzip creates those dirs regardless
+            parent=${entry%/}
+            while [[ $parent == */* ]]; do
+                parent=${parent%/*}
+                dirs+=($parent)
+            done
+        done
+    done
+    dirs=(${(u)dirs})
+
+    # only keep what is actually on disk, so the list reflects reality;
+    # -L catches broken symlinks, which -e alone misses
+    local -a present
+    present=(); for entry in $files; do [[ -e $entry || -L $entry ]] && present+=($entry); done
+    files=($present)
+    present=(); for entry in $dirs; do [[ -d $entry ]] && present+=($entry); done
+    dirs=($present)
+
+    (( $#files + $#dirs )) || { print -ru2 "delzip: nothing to remove here (already gone?)"; return 1 }
+
+    if (( dry )); then
+        print -rl -- ${files} ${(O)dirs}
+        return 0
+    fi
+
+    if (( ! force )); then
+        [[ -t 0 ]] || { print -ru2 "delzip: not a terminal, use -f to skip the prompt"; return 1 }
+        print -r -- "delzip: remove ${#files} file(s) under ${PWD}:"
+        print -rl -- "  "${^files[1,20]}
+        (( $#files > 20 )) && print -r -- "  ... and $(( $#files - 20 )) more"
+        (( $#dirs )) && print -r -- "plus ${#dirs} directory/ies, if they end up empty."
+        read -q "?Proceed? [y/N] " || { print -r -- $'\naborted'; return 1 }
+        print
+    fi
+
+    (( $#files )) && rm -f -- $files
+    # deepest first, so parents can empty out; rmdir refuses non-empty dirs
+    for entry in ${(O)dirs}; do
+        [[ -d $entry ]] && rmdir -- $entry 2>/dev/null
+    done
+    return 0
+}
+export MITMPROXY_SSLKEYLOGFILE="$HOME/.mitmproxy/sslkeylogfile.txt"
+
+unset ZSH_AUTOSUGGEST_USE_ASYNC
+export LANG='en_US.UTF-8'
+export LC_CTYPE='en_US.UTF-8'
+export TIME_STYLE='long-iso'
+
+pasteinit() {
+    OLD_SELF_INSERT=${${(s.:.)widgets[self-insert]}[2,3]}
+    zle -N self-insert url-quote-magic
+}
+pastefinish() {
+    zle -N self-insert "$OLD_SELF_INSERT"
+}
+zstyle :bracketed-paste-magic paste-init pasteinit
+zstyle :bracketed-paste-magic paste-finish pastefinish
+ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)

zsh/lib/prompt.zsh

@@ -0,0 +1,3 @@
+# Callers select p10k_config before sourcing this module.
+ZLE_RPROMPT_INDENT=0
+[[ -z "$p10k_config" || ! -f "$p10k_config" ]] || source "$p10k_config"

zsh/lib/updates.zsh

@@ -0,0 +1,67 @@
+# Background repository maintenance shared by desktop and server shells.
+
+update_dotfiles() {
+    local repo="$HOME/dotfiles"
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/dotfiles-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 15)
+    GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+        $TO git -C "$repo" fetch --quiet </dev/null 2>/dev/null || return
+    git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return
+    git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return
+    if git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null; then
+        local notice="⬆ dotfiles updated — run: exec zsh"
+        mkdir -p "$cache_dir" || return
+        print -r -- "$notice" >| "$notice_tmp" || return
+        mv -f "$notice_tmp" "$notice_file"
+        return
+    fi
+    local notice="⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
+    mkdir -p "$cache_dir" || return
+    print -r -- "$notice" >| "$notice_tmp" || return
+    mv -f "$notice_tmp" "$notice_file"
+}
+update_dotfiles &!
+
+check_tools_repo() {
+    local repo branch remote mergeref remote_sha local_sha cmd notice
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/tools-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 10)
+    for repo in /opt/tools "$HOME/tools" "$HOME/tools/tools-repo"; do
+        local -a g=(git -c 'safe.directory=*' -C "$repo")
+        $g rev-parse --is-inside-work-tree >/dev/null 2>&1 || continue
+        branch=$($g symbolic-ref --short HEAD 2>/dev/null) || return
+        remote=$($g config "branch.$branch.remote" 2>/dev/null) || return
+        mergeref=$($g config "branch.$branch.merge" 2>/dev/null) || return
+        remote_sha=$(GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+            $TO $g ls-remote "$remote" "$mergeref" </dev/null 2>/dev/null | awk '{print $1}')
+        local_sha=$($g rev-parse HEAD 2>/dev/null)
+        [[ -n "$remote_sha" && -n "$local_sha" ]] || return
+        [[ "$remote_sha" == "$local_sha" ]] && return
+        $g merge-base --is-ancestor "$remote_sha" HEAD 2>/dev/null && return
+        [[ -w "$repo/.git" ]] && cmd="git -C $repo pull" || cmd="sudo git -C $repo pull"
+        notice="⬆ tools: updates available in $repo — run: $cmd"
+        mkdir -p "$cache_dir" || return
+        print -r -- "$notice" >| "$notice_tmp" || return
+        mv -f "$notice_tmp" "$notice_file"
+        return
+    done
+}
+check_tools_repo &!
+
+show_update_notices() {
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file claimed_notice
+    for notice_file in "$cache_dir"/{dotfiles,tools}-update-notice; do
+        [[ -s "$notice_file" ]] || continue
+        claimed_notice="$notice_file.$$.show"
+        mv "$notice_file" "$claimed_notice" 2>/dev/null || continue
+        command cat "$claimed_notice"
+        command rm -f "$claimed_notice"
+    done
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd show_update_notices