@sebastienrousseau/dotfiles 0.2.481 → 0.2.500

package/dot_config/zsh/dot_zshrc.tmpl

@@ -1,6 +1,6 @@
-# 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.480) - <https://dotfiles.io>
+# .dotfiles (v{{ .dotfiles_version }}) - <https://dotfiles.io>
 # Made With ❤️ in London, United Kingdom
-# Designed by Sebastien Rousseau
+# Designed by
 # Copyright (c) 2015-2026. All rights reserved.
 # License: MIT
 
@@ -28,15 +28,83 @@ export FORCE_COLOR_OS="Windows"
 
 {{- $profile := default "laptop" .profile -}}
 {{- $features := default (dict "zsh" true "nvim" true "tmux" true "gui" true "secrets" true) .features -}}
-{{- $theme := default "catppuccin-mocha" .theme -}}
+{{- $theme := default "macos-monterey-dark" .theme -}}
+{{- $strict_mode := default false (index . "strict_mode") -}}
 {{- $enabled := list -}}
 {{- range $k, $v := $features }}{{- if $v }}{{- $enabled = append $enabled $k }}{{- end }}{{- end }}
 
 export DOTFILES_PROFILE="{{ $profile }}"
 export DOTFILES_FEATURES="{{ join "," $enabled }}"
 export DOTFILES_THEME="{{ $theme }}"
+: ${DOTFILES_STARTUP_MODE:=full}
+: ${DOTFILES_FAST:=0}
+: ${DOTFILES_ULTRA_FAST:=0}
+: ${DOTFILES_AI:=0}
+: ${DOTFILES_ALIAS_STRICT_MODE:={{ if $strict_mode }}1{{ else }}0{{ end }}}
+: ${DOTFILES_ULTRA_FAST_PROMPT:=1}
+: ${DOTFILES_LAYERS_LOAD:=ondemand}
+: ${DOTFILES_LAYERS_PREWARM:=system,text,api}
+: ${DOTFILES_ALIAS_WRAPPER:={{ if .features.alias_wrapper }}1{{ else }}0{{ end }}}
+
+# Default compinit based on profile (can be overridden by env)
+if [[ -z "${DOTFILES_ENABLE_COMPINIT+x}" ]]; then
+  case "${DOTFILES_PROFILE}" in
+    laptop|desktop) DOTFILES_ENABLE_COMPINIT=1 ;;
+    *) DOTFILES_ENABLE_COMPINIT=0 ;;
+  esac
+fi
+
+# Startup mode override (if explicit mode set and flags not already set)
+if [[ "${DOTFILES_FAST}" == "0" ]] && [[ "${DOTFILES_ULTRA_FAST}" == "0" ]]; then
+  if [[ "${DOTFILES_STARTUP_MODE}" == "fast" ]]; then
+    DOTFILES_FAST=1
+  elif [[ "${DOTFILES_STARTUP_MODE}" == "ultra" ]]; then
+    DOTFILES_ULTRA_FAST=1
+    DOTFILES_FAST=1
+  fi
+fi
+
+# Ultra-fast mode: minimal init (skip rc.d, plugins, prompts, AI, completions)
+if [[ "${DOTFILES_ULTRA_FAST}" == "1" ]]; then
+  export DOTFILES_FAST=1
+  if [[ "${DOTFILES_ULTRA_FAST_PROMPT}" == "1" ]]; then
+    PROMPT='%n@%m:%~%# '
+    RPROMPT=''
+  fi
+  # Ensure no precmd/preexec hooks run in ultra-fast mode
+  precmd_functions=()
+  preexec_functions=()
+  unset -f precmd preexec
+  typeset -aU path
+  return
+fi
+
+# Cached eval helper — sources cached init scripts, regenerates when stale
+# Debug/Trace modes — observability for shell startup
+: ${DOTFILES_DEBUG:=0}
+: ${DOTFILES_TRACE:=0}
+
+if [[ "${DOTFILES_TRACE}" == "1" ]]; then
+  _dotfiles_trace_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles"
+  mkdir -p "$_dotfiles_trace_dir"
+  exec 3>&2 2>"$_dotfiles_trace_dir/debug.log"
+  PS4='+%D{%s.%6.} %N:%i> '
+  set -x
+fi
+
+if [[ "${DOTFILES_DEBUG}" == "1" ]]; then
+  _dotfiles_debug_start=${EPOCHREALTIME:-$(date +%s.%N)}
+  _dotfiles_debug() {
+    local now=${EPOCHREALTIME:-$(date +%s.%N)}
+    local elapsed
+    elapsed=$(printf '%.0f' "$(( (now - _dotfiles_debug_start) * 1000 ))")
+    printf '[debug %4dms] %s\n' "$elapsed" "$1" >&2
+  }
+  _dotfiles_debug "startup begins"
+else
+  _dotfiles_debug() { :; }
+fi
 
-# Cached eval helper — sources cached init scripts, regenerates when stale
 _SHELL_CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/zsh"
 [[ -d "$_SHELL_CACHE" ]] || mkdir -p "$_SHELL_CACHE"
 
@@ -47,13 +115,64 @@ _cached_eval() {
   if [[ -f "$cache" ]] && [[ -z "$bin" || "$cache" -nt "$bin" ]]; then
     source "$cache"
   else
-    "$@" >| "$cache" 2>/dev/null
+    local init_output
+    local suspicious_re
+    init_output=$("$@" 2>/dev/null)
+    suspicious_re='(curl[[:space:]].*\|[[:space:]]*(ba)?sh|wget[[:space:]].*\|[[:space:]]*(ba)?sh|nc[[:space:]]+-e|/dev/tcp/|base64[[:space:]]+-d[[:space:]]*\|)'
+    # Reject suspicious patterns indicating malicious payloads
+    if printf '%s\n' "$init_output" | LC_ALL=C grep -Eqs -- "$suspicious_re"; then
+      print -u2 "[WARN] Suspicious output from $label init, skipping"
+      return 1
+    fi
+    print -r -- "$init_output" > "${cache}.tmp.$$"
+    mv "${cache}.tmp.$$" "$cache"
     source "$cache"
     { zcompile "$cache" } &!
   fi
 }
 
-## 🆅🅰🆁🅸🅰🆁🅸🅰🅱🅻🅴🆂 - Core variables, plugins, and options
+# Lightweight precmd hook manager (faster than add-zsh-hook)
+_dotfiles_add_precmd() {
+  local fn="$1"
+  [[ -z "$fn" ]] && return 0
+  precmd_functions=(${precmd_functions:#$fn} "$fn")
+}
+
+_dotfiles_del_precmd() {
+  local fn="$1"
+  [[ -z "$fn" ]] && return 0
+  precmd_functions=(${precmd_functions:#$fn})
+}
+
+# ==============================================================================
+# Dotfiles 2026: Zero-Jank & Artifact-Only Mode Foundation
+# ==============================================================================
+export DOTFILES_ARTIFACT_MODE="${DOTFILES_ARTIFACT_MODE:-0}"
+
+if [[ "$DOTFILES_ARTIFACT_MODE" == "1" ]]; then
+  # The Canvas: Strip away all visual noise.
+  export PROMPT="%F{green}➜ %f"
+  export RPROMPT=""
+  # Suppress all background job notifications
+  setopt NO_NOTIFY
+  setopt NO_MONITOR
+fi
+# ==============================================================================
+
+# Lightweight preexec hook manager
+_dotfiles_add_preexec() {
+  local fn="$1"
+  [[ -z "$fn" ]] && return 0
+  preexec_functions=(${preexec_functions:#$fn} "$fn")
+}
+
+_dotfiles_del_preexec() {
+  local fn="$1"
+  [[ -z "$fn" ]] && return 0
+  preexec_functions=(${preexec_functions:#$fn})
+}
+
+## 🆅🅰🆁🅸🅰🆁🅸🅰🅱🅻🅴🆂 - Core variables, plugins, and options
 ZSH_RC_DIR="${HOME}/.config/zsh/rc.d"
 if [[ -d "${ZSH_RC_DIR}" ]]; then
   for rc_file in "${ZSH_RC_DIR}"/**/*.zsh(N); do
@@ -61,6 +180,14 @@ if [[ -d "${ZSH_RC_DIR}" ]]; then
   done
 fi
 
+# User-local rc.d extensions (not managed by chezmoi)
+if [[ -d "${ZDOTDIR:-$HOME/.config/zsh}/rc.d.local" ]]; then
+  for _rc_local in "${ZDOTDIR:-$HOME/.config/zsh}"/rc.d.local/*.zsh(N); do
+    source "$_rc_local"
+  done
+  unset _rc_local
+fi
+
 ###############################
 # Performance: Auto-Zcompile  #
 ###############################
@@ -86,7 +213,10 @@ if [[ -o interactive ]]; then
                   "${HOME}/.config/shell/00-core-paths.sh" \
                   "${HOME}/.config/shell/05-core-safety.sh" \
                   "${HOME}/.config/shell/40-ls-colors.sh" \
-                  "${HOME}/.config/shell/90-ux-aliases.sh" &!
+                  "${HOME}/.config/shell/50-logic-functions-core.sh" \
+                  "${HOME}/.config/shell/90-ux-aliases.sh" \
+                  /opt/homebrew/opt/fzf/shell/completion.zsh \
+                  /opt/homebrew/opt/fzf/shell/key-bindings.zsh &
   )
 fi
 
@@ -116,84 +246,253 @@ fi
 # 90-99: UX (Aliases, Prompts)
 #
 # Optimized loading of core configurations + eager aliases
-for core_layer in 00-core-paths 05-core-safety 40-ls-colors 90-ux-aliases; do
-  if [[ -f "${HOME}/.config/shell/${core_layer}.sh" ]]; then
-    source "${HOME}/.config/shell/${core_layer}.sh"
-  fi
+if [[ "${DOTFILES_FAST}" == "1" ]]; then
+  _core_layers=(00-core-paths 05-core-safety)
+else
+  _core_layers=(00-core-paths 05-core-safety 90-ux-aliases)
+fi
+for core_layer in "${_core_layers[@]}"; do
+  [[ -f "${HOME}/.config/shell/${core_layer}.sh" ]] && source "${HOME}/.config/shell/${core_layer}.sh"
 done
+unset _core_layers
 
-# Deferred loading of heavy layers (lazy — loads after first prompt)
-autoload -Uz add-zsh-hook
-_load_deferred_layers() {
-  add-zsh-hook -d precmd _load_deferred_layers
-  [[ -f "${HOME}/.config/shell/50-logic-functions.sh" ]] && source "${HOME}/.config/shell/50-logic-functions.sh"
-  [[ -f "${HOME}/.config/shell/91-ux-aliases-lazy.sh" ]] && source "${HOME}/.config/shell/91-ux-aliases-lazy.sh"
-  # AI / Predictive Shell (deferred for faster startup)
-  [[ -f "${HOME}/.config/shell/custom/context_suggest.zsh" ]] && source "${HOME}/.config/shell/custom/context_suggest.zsh"
-  [[ -f "${HOME}/.config/shell/custom/error_analysis.zsh" ]] && source "${HOME}/.config/shell/custom/error_analysis.zsh"
-  [[ -f "${HOME}/.config/shell/custom/ollama_functions.zsh" ]] && source "${HOME}/.config/shell/custom/ollama_functions.zsh"
-}
-add-zsh-hook precmd _load_deferred_layers
-
-# Essential Aliases (fallback if 90-ux-aliases.sh is unavailable)
-if command -v bat >/dev/null; then
-  alias cat="bat"
+# Starship prompt (eager — must survive cache clears for consistent UI)
+if [[ "$DOTFILES_ARTIFACT_MODE" != "1" ]] && (( ${+commands[starship]} )); then
+  _cached_eval starship-init starship init zsh
 fi
 
-# Smart Alias Function (Colorize output when listing, standard behavior otherwise)
-alias_wrapper() {
-  if [[ $# -eq 0 ]]; then
-     if command -v bat >/dev/null; then
-       builtin alias | bat -l sh --style=plain
-     else
-       builtin alias
-     fi
+# User-local modules (aliases, functions — not managed by chezmoi)
+for _mod_dir in "${XDG_CONFIG_HOME:-$HOME/.config}/dotfiles/modules.d"/*(N/); do
+  for _mod_file in "$_mod_dir"/*.sh(N); do
+    source "$_mod_file"
+  done
+done
+unset _mod_dir _mod_file
+
+if [[ "${DOTFILES_FAST}" != "1" ]]; then
+  # On-demand loading of heavy layers (functions + aliases only when needed)
+  DOTFILES_LAYERS_LOADED=0
+  DOTFILES_LAYERS_LOAD_STATE=idle
+  unset DOTFILES_LAYERS_LOAD_STATUS
+  _dotfiles_load_heavy_layers_stage1() {
+    [[ "${DOTFILES_LAYERS_LOAD_STATE}" == "stage1" || "${DOTFILES_LAYERS_LOAD_STATE}" == "ready" ]] && return 0
+    DOTFILES_LAYERS_LOAD_STATE=loading
+    unset DOTFILES_LAYERS_LOAD_STATUS
+    [[ -f "${HOME}/.config/shell/10-secrets.sh" ]] && source "${HOME}/.config/shell/10-secrets.sh"
+    [[ -f "${HOME}/.config/shell/40-ls-colors.sh" ]] && source "${HOME}/.config/shell/40-ls-colors.sh"
+    [[ -f "${HOME}/.config/shell/50-logic-functions-core.sh" ]] && source "${HOME}/.config/shell/50-logic-functions-core.sh"
+    [[ -f "${HOME}/.config/shell/91-ux-aliases-lazy.sh" ]] && source "${HOME}/.config/shell/91-ux-aliases-lazy.sh"
+    DOTFILES_LAYERS_LOAD_STATE=stage1
+  }
+
+  _dotfiles_load_heavy_layers_stage2() {
+    [[ "${DOTFILES_LAYERS_LOAD_STATE}" == "ready" ]] && return 0
+    [[ -f "${HOME}/.config/shell/51-logic-functions-extra.sh" ]] && source "${HOME}/.config/shell/51-logic-functions-extra.sh"
+    # Compile extra functions for faster future loads
+    if command -v zcompile >/dev/null 2>&1; then
+      { [[ ! -f "${HOME}/.config/shell/51-logic-functions-extra.sh.zwc" || "${HOME}/.config/shell/51-logic-functions-extra.sh" -nt "${HOME}/.config/shell/51-logic-functions-extra.sh.zwc" ]] && zcompile "${HOME}/.config/shell/51-logic-functions-extra.sh" } &!
+    fi
+    DOTFILES_LAYERS_LOAD_STATE=ready
+    DOTFILES_LAYERS_LOAD_STATUS=ready
+    export DOTFILES_LAYERS_LOAD_STATUS
+  }
+
+  _dotfiles_prewarm_groups() {
+    local -a _groups
+    _groups=(${(s:,:)DOTFILES_LAYERS_PREWARM})
+    local g
+    for g in "${_groups[@]}"; do
+      [[ -z "$g" ]] && continue
+      if (( ${+functions[_dotfiles_load_group_${g}]} )); then
+        "_dotfiles_load_group_${g}"
+      fi
+    done
+  }
+
+  _dotfiles_load_heavy_layers() {
+    [[ "${DOTFILES_LAYERS_LOADED}" == "1" ]] && return 0
+    DOTFILES_LAYERS_LOADED=1
+    _dotfiles_load_heavy_layers_stage1
+    _dotfiles_load_heavy_layers_stage2
+  }
+
+  # Optional background prewarm for heavy layers (idle after first prompt)
+  _dotfiles_schedule_heavy_layers() {
+    if [[ "${DOTFILES_LAYERS_LOAD}" == "background" ]]; then
+      if [[ -n "${ZSH_EXECUTION_STRING:-}" ]]; then
+          (sleep 1; _dotfiles_load_heavy_layers_stage1; _dotfiles_load_heavy_layers_stage2; _dotfiles_prewarm_groups) &
+      else
+        zmodload zsh/sched 2>/dev/null || return 0
+        sched +1 _dotfiles_load_heavy_layers_stage1
+        sched +2 _dotfiles_load_heavy_layers_stage2
+        # Prewarm selected groups after stage2 loads stubs
+        sched +3 _dotfiles_prewarm_groups
+      fi
+    fi
+  }
+  # Compatibility: use add-zsh-hook when available (tests rely on this)
+  autoload -Uz add-zsh-hook
+  _load_deferred_layers() {
+    if (( ${+functions[add-zsh-hook]} )); then
+      add-zsh-hook -d precmd _load_deferred_layers
+    else
+      _dotfiles_del_precmd _load_deferred_layers
+    fi
+    _dotfiles_schedule_heavy_layers
+  }
+  if (( ${+functions[add-zsh-hook]} )); then
+    add-zsh-hook precmd _load_deferred_layers
   else
-     builtin alias "$@"
+    _dotfiles_add_precmd _load_deferred_layers
+  fi
+
+  # Capture existing command_not_found handler (if any)
+  if (( ${+functions[command_not_found_handler]} )); then
+    functions[_dotfiles_prev_command_not_found_handler]="${functions[command_not_found_handler]}"
   fi
-}
-alias alias=alias_wrapper
 
+  command_not_found_handler() {
+    local cmd="$1"
+    shift || true
 
-# Phase 33: Atuin (Memory Layer)
-if command -v atuin > /dev/null; then
-    _cached_eval atuin-init atuin init zsh
-fi
+    if [[ "${DOTFILES_LAYERS_LOADED}" != "1" ]]; then
+      _dotfiles_load_heavy_layers_stage1
+      if (( ${+functions[$cmd]} )); then
+        "$cmd" "$@"
+        return $?
+      fi
+      if alias "$cmd" >/dev/null 2>&1; then
+        local -a _args
+        _args=("$@")
+        eval "$cmd ${(@q)_args}"
+        unset _args
+        return $?
+      fi
+      _dotfiles_load_heavy_layers_stage2
+      if (( ${+functions[$cmd]} )); then
+        "$cmd" "$@"
+        return $?
+      fi
+      if alias "$cmd" >/dev/null 2>&1; then
+        local -a _args2
+        _args2=("$@")
+        eval "$cmd ${(@q)_args2}"
+        unset _args2
+        return $?
+      fi
+    fi
 
-# Starship Prompt (High Performance)
-if command -v starship >/dev/null; then
-  _cached_eval starship-init starship init zsh
-fi
+    if (( ${+functions[_dotfiles_prev_command_not_found_handler]} )); then
+      _dotfiles_prev_command_not_found_handler "$cmd" "$@"
+      return $?
+    fi
 
-# Zoxide (Smart Directory Jumper) - Replaces 'cd'
-if command -v zoxide >/dev/null; then
-  _cached_eval zoxide-init zoxide init zsh
+    print -r -- "zsh: command not found: ${cmd}" >&2
+    return 127
+  }
+
+  # dot load: force heavy layers now
+  unalias dot 2>/dev/null
+  functions[dot]='
+    if [[ "$1" == "load" ]]; then
+      if [[ "$2" == "--background" ]]; then
+        DOTFILES_LAYERS_LOAD=background
+        _dotfiles_schedule_heavy_layers
+        return 0
+      fi
+      if [[ "$2" == "--status" ]]; then
+        if [[ "$3" == "--watch" ]]; then
+          local _timeout="${4:-5}"
+          local _t0=$EPOCHREALTIME
+          if [[ "${DOTFILES_LAYERS_LOAD_STATE:-idle}" == "idle" ]]; then
+            _dotfiles_load_heavy_layers
+          fi
+          while [[ "${DOTFILES_LAYERS_LOAD_STATE:-idle}" != "ready" ]]; do
+            sleep 0.1
+            if [[ -n "${_timeout}" && "${_timeout}" != "0" ]]; then
+              local _t1=$EPOCHREALTIME
+              if (( (_t1 - _t0) >= _timeout )); then
+                print -r -- "timeout"
+                return 124
+              fi
+            fi
+          done
+        fi
+        print -r -- "${DOTFILES_LAYERS_LOAD_STATE:-idle}"
+        return 0
+      fi
+      _dotfiles_load_heavy_layers
+      return 0
+    fi
+    "$HOME/.local/bin/dot" "$@"
+  '
 fi
 
-# Mise (Runtime Version Manager) - Replaces asdf/pyenv/nvm
-if command -v mise >/dev/null; then
-  _cached_eval mise-init mise activate zsh
+# Essential Aliases (fallback if 90-ux-aliases.sh is unavailable)
+if command -v bat >/dev/null; then
+  alias cat="bat"
 fi
 
-# FZF (Fuzzy Finder) - Cross-platform detection
-if command -v fzf >/dev/null; then
-  # Detect FZF shell integration path (Homebrew, apt, manual install)
-  local fzf_shell_dir=""
-  for dir in "${HOMEBREW_PREFIX:-/opt/homebrew}/opt/fzf/shell" \
-             /usr/local/opt/fzf/shell \
-             /usr/share/fzf \
-             /usr/share/doc/fzf/examples \
-             "${HOME}/.fzf/shell"; do
-    [[ -d "$dir" ]] && { fzf_shell_dir="$dir"; break; }
-  done
 
-  if [[ -n "$fzf_shell_dir" ]]; then
-    [[ -f "${fzf_shell_dir}/completion.zsh" ]] && source "${fzf_shell_dir}/completion.zsh"
-    [[ -f "${fzf_shell_dir}/key-bindings.zsh" ]] && source "${fzf_shell_dir}/key-bindings.zsh"
+if [[ "${DOTFILES_FAST}" != "1" ]]; then
+  ## AI / Predictive Shell (opt-in)
+  if [[ "${DOTFILES_AI}" == "1" ]]; then
+    [[ -f "$HOME/.config/shell/custom/context_suggest.zsh" ]] && source "$HOME/.config/shell/custom/context_suggest.zsh"
+    [[ -f "$HOME/.config/shell/custom/error_analysis.zsh" ]] && source "$HOME/.config/shell/custom/error_analysis.zsh"
   fi
 
-  # Use fd/rg for fzf source if available
-  if command -v rg >/dev/null; then
-    export FZF_DEFAULT_COMMAND='rg --files --no-ignore --hidden --follow --glob "!.git/*"'
+: ${DOTFILES_DEFER_TOOLS:=1}
+
+# Dotfiles 2026 Async Loader: Move heavy binary path resolution to background
+_dotfiles_async_init() {
+  [[ "$DOTFILES_FAST" == "1" ]] && return
+  local tools=(mise atuin starship zoxide)
+  local t
+  for t in $tools; do
+    if [[ -x "${commands[$t]}" ]]; then
+      case "$t" in
+        mise)
+          _cached_eval mise-init mise activate zsh
+          ;;
+        atuin)
+          _cached_eval atuin-init atuin init zsh
+          ;;
+        starship)
+          [[ "$DOTFILES_ARTIFACT_MODE" == "0" ]] && _cached_eval starship-init starship init zsh
+          ;;
+        zoxide)
+          _cached_eval zoxide-init zoxide init zsh
+          ;;
+      esac
+    fi
+  done
+}
+
+# Deferred Hydration for Zero-Jank Experience
+_dotfiles_deferred_hydration() {
+  # Unregister self
+  _dotfiles_del_precmd _dotfiles_deferred_hydration
+  _dotfiles_del_preexec _dotfiles_deferred_hydration
+
+  # Check if already hydrated in this shell instance
+  [[ -n "$DOTFILES_HYDRATED" ]] && return 0
+  export DOTFILES_HYDRATED=1
+
+  _dotfiles_async_init
+
+  # Bento-Grid 2.0 (Liquid Glass Dashboard)
+  # Only render if interactive and not in restricted ultra-fast mode
+  if [[ "$DOTFILES_ARTIFACT_MODE" == "1" ]]; then
+    [[ -f "$HOME/.dotfiles/scripts/dot/lib/bento.sh" ]] && (bash "$HOME/.dotfiles/scripts/dot/lib/bento.sh" </dev/null; kill -WINCH $$) &!
   fi
+}
+
+# 1. Idle trigger (500ms)
+zmodload zsh/sched 2>/dev/null
+sched +1 _dotfiles_deferred_hydration 2>/dev/null
+
+# 2. First-action trigger (Prompt or Enter)
+_dotfiles_add_precmd _dotfiles_deferred_hydration
+_dotfiles_add_preexec _dotfiles_deferred_hydration
+
 fi

package/dot_config/zsh/rc.d/00-alias-shims.zsh

@@ -0,0 +1,77 @@
+# shellcheck shell=bash
+# Cognitive Shell Enhancements
+if [[ -o interactive ]]; then
+  # Carapace completions — cached to avoid subshell on every startup
+  if command -v carapace >/dev/null 2>&1; then
+    if typeset -f _cached_eval >/dev/null 2>&1; then
+      _cached_eval carapace carapace _carapace zsh
+    else
+      source <(carapace _zsh)
+    fi
+  fi
+
+  # thefuck — lazy-loaded to avoid ~200ms startup penalty
+  if command -v thefuck >/dev/null 2>&1; then
+    _lazy_load_thefuck() {
+      unset -f fuck _lazy_load_thefuck 2>/dev/null
+      _cached_eval "thefuck-alias" thefuck --alias
+    }
+    fuck() { _lazy_load_thefuck; fuck "$@"; }
+    alias fix='fuck'
+  fi
+fi
+
+# Fallback command shims for environments with aliases disabled.
+# These are lightweight functions to ensure core shortcuts still work.
+
+# Opt-out with: export DOTFILES_ALIAS_SHIMS=0
+if [[ "${DOTFILES_ALIAS_SHIMS:-1}" != "1" ]]; then
+  return 0
+fi
+
+# Avoid redefining if already present.
+if ! typeset -f c >/dev/null 2>&1; then
+  c() { clear; }
+fi
+if ! typeset -f q >/dev/null 2>&1; then
+  q() { exit; }
+fi
+if ! typeset -f e >/dev/null 2>&1; then
+  e() { "${EDITOR:-nano}" "$@"; }
+fi
+if ! typeset -f h >/dev/null 2>&1; then
+  h() { history; }
+fi
+if ! typeset -f l >/dev/null 2>&1; then
+  l() { command -v eza >/dev/null 2>&1 && eza --sort Name --icons --group-directories-first "$@" || command ls "$@"; }
+fi
+if ! typeset -f ll >/dev/null 2>&1; then
+  ll() { command -v eza >/dev/null 2>&1 && eza -alF --sort Name --icons --group-directories-first "$@" || command ls -lA "$@"; }
+fi
+if ! typeset -f la >/dev/null 2>&1; then
+  la() { command -v eza >/dev/null 2>&1 && eza -a --sort Name --icons --group-directories-first "$@" || command ls -a "$@"; }
+fi
+if ! typeset -f lt >/dev/null 2>&1; then
+  lt() { command -v eza >/dev/null 2>&1 && eza -aT --sort Name --icons --group-directories-first "$@" || command ls -R "$@"; }
+fi
+if ! typeset -f lr >/dev/null 2>&1; then
+  lr() { command -v eza >/dev/null 2>&1 && eza -alF --recurse --sort Name --icons --group-directories-first "$@" || command ls -lAR "$@"; }
+fi
+if ! typeset -f lra >/dev/null 2>&1; then
+  lra() { command -v eza >/dev/null 2>&1 && eza -alF --recurse --all --sort Name --icons --group-directories-first "$@" || command ls -lAR "$@"; }
+fi
+if ! typeset -f lta >/dev/null 2>&1; then
+  lta() { command -v eza >/dev/null 2>&1 && eza -aT --all --sort Name --icons --group-directories-first "$@" || command ls -aR "$@"; }
+fi
+if ! typeset -f d >/dev/null 2>&1; then
+  d() { command -v dot >/dev/null 2>&1 && dot "$@" || command -v docker >/dev/null 2>&1 && docker "$@"; }
+fi
+if ! typeset -f i >/dev/null 2>&1; then
+  i() { command -v epoch >/dev/null 2>&1 && epoch "$@"; }
+fi
+if ! typeset -f a >/dev/null 2>&1; then
+  a() { command -v ai_core >/dev/null 2>&1 && ai_core query "$@"; }
+fi
+if ! typeset -f _ >/dev/null 2>&1; then
+  _() { sudo "$@"; }
+fi

package/dot_config/zsh/rc.d/05-ssh-agent.zsh

@@ -1,5 +1,18 @@
-# SSH agent: auto-start and load key from macOS Keychain
-if [ -z "$SSH_AUTH_SOCK" ]; then
-  eval "$(ssh-agent -s)" > /dev/null
-  ssh-add --apple-use-keychain ~/.ssh/id_ed25519 2>/dev/null
+# YubiKey FIDO2/U2F security key helper
+if [[ -x /usr/lib/ssh/ssh-sk-helper ]]; then
+  export SSH_SK_HELPER=/usr/lib/ssh/ssh-sk-helper
+fi
+
+# SSH agent: auto-start if no agent is running (interactive only)
+if [[ -o interactive ]] && [[ -z "$SSH_AUTH_SOCK" ]]; then
+  eval "$(ssh-agent -s)" >/dev/null 2>&1
+
+  # Add default key with timeout guard (2s max) to prevent startup hangs
+  if [[ -f ~/.ssh/id_ed25519 ]]; then
+    if [[ "$OSTYPE" == darwin* ]]; then
+      timeout 2 ssh-add --apple-use-keychain ~/.ssh/id_ed25519 2>/dev/null || true
+    else
+      timeout 2 ssh-add ~/.ssh/id_ed25519 2>/dev/null || true
+    fi
+  fi
 fi

package/dot_config/zsh/rc.d/10-env.zsh.tmpl

@@ -1,12 +1,12 @@
 # Environment and core variables
 export HOSTNAME="${HOST}"
 export INPUTRC="${HOME}/.inputrc"
-export OS_ARCH="$(uname -m)"
-export OS_NAME="$(uname)"
-export OS_VERSION="$(uname -r)"
+export OS_ARCH='{{ output "uname" "-m" | trim }}'
+export OS_NAME='{{ output "uname" | trim }}'
+export OS_VERSION='{{ output "uname" "-r" | trim }}'
 export USER_LANGUAGE="en_GB.UTF-8"
 export ARCHFLAGS="-arch ${OS_ARCH}"
-export DOTFILES_VERSION='0.2.480'
+export DOTFILES_VERSION='{{ .dotfiles_version }}'
 export DOTFILES="${HOME}/.dotfiles/lib"
 export LANG="${USER_LANGUAGE}"
 export LANGUAGE="${USER_LANGUAGE}"