source "${ZDOTDIR:-$HOME}/.zsh/lib/startup.zsh"
[[ -d ${ZDOTDIR:-$HOME}/.cache/zsh ]] || mkdir -p ${ZDOTDIR:-$HOME}/.cache/zsh

# May ask for the key passphrase (once per boot), so it precedes instant prompt.
_in_coding_agent="$CLAUDECODE$CODEX_SESSION_ID$PI_CODING_AGENT"
if [[ -f ~/.ssh/sudo_key && -z $_in_coding_agent ]] &&
    _zsh_cached sudo_key.fp ~/.ssh/sudo_key -- ssh-keygen -lf ~/.ssh/sudo_key; then
    read -r _ _sudo_fp _ < $REPLY
    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q "$_sudo_fp" ||
        SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
    # agent forwarded by coding agents (see ~/.ssh/config): every signature,
    # i.e. every remote sudo, needs confirmation via askpass
    [[ -e /tmp/sudo-agent-confirm.sock ]] ||
        SSH_ASKPASS=~/.ssh/askpass-agent-confirm.sh SSH_ASKPASS_REQUIRE=force \
            ssh-agent -a /tmp/sudo-agent-confirm.sock &>/dev/null
    SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -l | grep -q "$_sudo_fp" ||
        SSH_AUTH_SOCK=/tmp/sudo-agent-confirm.sock ssh-add -c ~/.ssh/sudo_key
    unset _sudo_fp
fi
_zst_mark sudo-agent

# Powerlevel10k instant prompt; nothing below may need console input.
if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
    source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
fi
_zst_mark instant-prompt

# Machine-local layers.
[[ -f ~/.zsh/.powerline_config ]] && source ~/.zsh/.powerline_config
[[ -f ~/.zsh/.user_config ]] && source ~/.zsh/.user_config
[[ -f ~/.zsh/.virtual_env_config.zsh ]] && source ~/.zsh/.virtual_env_config.zsh
[[ -f ~/.zsh/.local_config ]] && source ~/.zsh/.local_config
[[ -f ~/.zsh/.env.local ]] && source ~/.zsh/.env.local
_zst_mark layers

source "${ZDOTDIR:-$HOME}/.zsh/lib/updates.zsh"
export LC_OSC52=1
_zst_mark updates

# Completions for tools installed under ~/.local (e.g. tools-repo's safe*
# wrappers). Must precede antidote, whose completion plugin runs compinit.
fpath=("$HOME/.local/share/zsh/site-functions" $fpath)

plugins_txt=${ZDOTDIR:-$HOME}/.zsh/.zsh_plugins.txt
static_file=${ZDOTDIR:-$HOME}/.cache/zsh/.zsh_plugins.zsh
source "${ZDOTDIR:-$HOME}/.zsh/lib/antidote.zsh"
_zst_mark antidote
source "${ZDOTDIR:-$HOME}/.zsh/lib/interactive.zsh"

bindkey '^w' kill-region
bindkey -v
VI_MODE_SET_CURSOR=true
# fzf keys (Ctrl-R/Ctrl-T/Alt-C, **<Tab>); after bindkey -v so vi keymaps get them
(( $+commands[fzf] )) && _zsh_cached fzf.zsh ${commands[fzf]:A} -- fzf --zsh &&
    source $REPLY
_zst_mark fzf

[[ -f ~/.zsh/.mac_config.zsh ]] && source ~/.zsh/.mac_config.zsh
_zst_mark mac-config
# deps: go binary and `go env -w` files (macOS, Linux)
if (( $+commands[go] )) && _zsh_cached gopath ${commands[go]:A} \
    "$HOME/Library/Application Support/go/env" "${XDG_CONFIG_HOME:-$HOME/.config}/go/env" \
    -- env -u GOPATH go env GOPATH; then
    [[ -n $GOPATH ]] || read -r GOPATH < $REPLY
    export GOPATH
    path+=("$GOPATH/bin")
fi
_zst_mark go

# Use safe wrappers after ~/.local/bin has been added to PATH.
# Agent shells: </dev/null makes the prompt decline (exit 1) instead of blocking.
if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]]; then
    _safe_redir=' </dev/null'
fi
(( $+commands[safecp] )) && alias cp="safecp${_safe_redir:-}"
(( $+commands[safemv] )) && alias mv="safemv${_safe_redir:-}"
(( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
unset _safe_redir

# no GUI password dialog for sudo from agent shells; a non-interactive sudo just fails
[[ -z $_in_coding_agent ]] && export SUDO_ASKPASS=${commands[ssh-askpass]}
unset _in_coding_agent

if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
    p10k_config=~/dotfiles/zsh/.p10k.mac.zsh
else
    p10k_config=~/dotfiles/zsh/.p10k.zsh
fi
source "${ZDOTDIR:-$HOME}/.zsh/lib/prompt.zsh"
_zst_mark prompt

alias screenshot_mode='powerlevel10k_plugin_unload; export PS1="$ "; python3 ~/.config/alacritty/screenshot_mode.py on'
alias screenshot_mode_off='prompt_powerlevel9k_setup; python3 ~/.config/alacritty/screenshot_mode.py off'

[[ -d "$HOME/.lmstudio/bin" ]] && path+=("$HOME/.lmstudio/bin")
[[ -d "$HOME/.runai/bin" ]] && path+=("$HOME/.runai/bin")
runai_bin="$HOME/.runai/bin/runai"
[[ -x "$runai_bin" ]] &&
    _zsh_cached runai-completion.zsh "$runai_bin" -- "$runai_bin" --quiet completion zsh &&
    source $REPLY

# Keep this last: activate must snapshot the fully built PATH for deactivate.
typeset -U path PATH
[[ -z "${VIRTUAL_ENV:-}" ]] && unset VIRTUAL_ENV
if [[ -n "$VIRTUAL_ENV" && -f "$VIRTUAL_ENV/bin/activate" ]]; then
    if [[ ${PATH%%:*} != "$VIRTUAL_ENV/bin" ]]; then
        source "$VIRTUAL_ENV/bin/activate"
    fi
fi
_zst_mark rest
autoload -Uz add-zsh-hook
add-zsh-hook precmd _zst_report