@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/dot_config/dotfiles/policy-bundles.json

@@ -0,0 +1,38 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultBundle": "developer",
+  "bundles": {
+    "developer": {
+      "description": "Local development with bounded agent execution and strict-local MCP.",
+      "agentProfile": "apply",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    },
+    "offline": {
+      "description": "Disconnected local work with no remote MCP transport and no networked agents.",
+      "agentProfile": "ask",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "off"
+    },
+    "regulated": {
+      "description": "High-trust profile for controlled environments with explicit approvals and evidence export.",
+      "agentProfile": "audit",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    },
+    "enterprise": {
+      "description": "Enterprise remote profile with registry-backed MCP and governed audit posture.",
+      "agentProfile": "audit",
+      "mcpProfile": "enterprise-remote",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    }
+  }
+}

package/dot_config/dotfiles/prompt-registry.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultPromptSet": "core",
+  "promptSets": {
+    "core": {
+      "description": "General workstation guidance and bounded implementation prompts.",
+      "changeControl": "signed-commit",
+      "reviewRequired": true
+    },
+    "regulated-audit": {
+      "description": "Compliance and high-trust audit prompts with stricter review expectations.",
+      "changeControl": "signed-commit-and-policy-review",
+      "reviewRequired": true
+    }
+  }
+}

package/dot_config/dotfiles/versions.env

@@ -0,0 +1,18 @@
+# Version pins for provisioned tools (Linux).
+# Override by editing this file or exporting env vars before running.
+STARSHIP_TAG="v1.24.2"
+ZOXIDE_TAG="0.9.9"
+NEOVIM_TAG="v0.11.6"
+LAZYGIT_TAG="v0.60.0"
+ATUIN_TAG="v18.13.3"
+ZELLIJ_TAG="v0.43.1"
+UV_TAG="0.10.12"
+
+# Update & runtime tooling
+TOPGRADE_TAG="v17.1.0"
+MISE_TAG="v2026.3.8"
+YAZI_TAG="v26.1.22"
+
+# AI CLI Tools
+MODS_TAG="v1.8.1"
+

package/dot_config/duf/duf.conf

@@ -0,0 +1,6 @@
+# duf configuration (dotfiles)
+# Format: key: value
+
+theme: dark
+sort: size
+hide: tmpfs,devtmpfs

package/dot_config/duti/defaults.duti

@@ -0,0 +1,5 @@
+# Default app bindings for macOS (duti).
+# Format: <bundle-id> <UTI> <role>
+# Example:
+# com.google.Chrome public.html all
+# com.microsoft.VSCode public.plain-text all

package/dot_config/emoji/emoji.txt

@@ -0,0 +1,34 @@
+😀 grinning face
+😃 grinning face with big eyes
+😄 grinning face with smiling eyes
+😁 beaming face with smiling eyes
+😆 grinning squinting face
+😉 winking face
+😊 smiling face with smiling eyes
+😎 smiling face with sunglasses
+😍 smiling face with heart-eyes
+😘 face blowing a kiss
+😇 smiling face with halo
+🤔 thinking face
+🙃 upside-down face
+😴 sleeping face
+🤯 exploding head
+🥳 partying face
+😤 face with steam from nose
+😭 loudly crying face
+😱 face screaming in fear
+🤖 robot
+👋 waving hand
+👍 thumbs up
+🙏 folded hands
+💡 light bulb
+🔥 fire
+✨ sparkles
+🎉 party popper
+🚀 rocket
+🧠 brain
+🛠️ hammer and wrench
+📦 package
+✅ check mark
+❌ cross mark
+⚠️ warning

package/dot_config/environment.d/50-ssh-agent.conf

@@ -0,0 +1,2 @@
+# SSH agent — point all sessions at the systemd-managed agent socket
+SSH_AUTH_SOCK=${XDG_RUNTIME_DIR}/ssh-agent.socket

package/dot_config/environment.d/90-wayland.conf

@@ -0,0 +1,19 @@
+# Wayland session environment variables
+ELECTRON_OZONE_PLATFORM_HINT=auto
+TERMINAL=ghostty
+
+# Qt Wayland support
+QT_QPA_PLATFORM=wayland
+QT_QPA_PLATFORMTHEME=gtk3
+
+# Firefox native Wayland
+MOZ_ENABLE_WAYLAND=1
+
+# SDL Wayland support
+SDL_VIDEODRIVER=wayland
+
+# Java AWT fix (JetBrains IDEs, Ghidra)
+_JAVA_AWT_WM_NONREPARENTING=1
+
+# DMS icon theme
+QS_ICON_THEME=Papirus-Dark

package/dot_config/fastfetch/config.jsonc

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fastfetch-cli/fastfetch/dev/doc/json_schema.json",
+  "logo": {
+    "type": "auto",
+    "padding": { "top": 1, "left": 1 }
+  },
+  "display": {
+    "separator": "  "
+  },
+  "modules": [
+    "title",
+    "os",
+    "host",
+    "kernel",
+    "uptime",
+    "packages",
+    "shell",
+    "display",
+    "wm",
+    "terminal",
+    "cpu",
+    "gpu",
+    "memory",
+    "disk",
+    "localip",
+    "publicip"
+  ]
+}

package/dot_config/firefox/user.js.tmpl

@@ -0,0 +1,58 @@
+// Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+// Firefox privacy and performance hardening
+// Apply by symlinking to ~/.mozilla/firefox/<profile>/user.js
+
+/* global user_pref */
+
+{{- $t := index .themes .theme -}}
+
+// Disable telemetry
+user_pref("toolkit.telemetry.enabled", false);
+user_pref("toolkit.telemetry.unified", false);
+user_pref("toolkit.telemetry.archive.enabled", false);
+user_pref("datareporting.healthreport.uploadEnabled", false);
+user_pref("datareporting.policy.dataSubmissionEnabled", false);
+user_pref("browser.ping-centre.telemetry", false);
+user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
+user_pref("browser.newtabpage.activity-stream.telemetry", false);
+
+// Disable Pocket
+user_pref("extensions.pocket.enabled", false);
+
+// Disable prefetching
+user_pref("network.prefetch-next", false);
+user_pref("network.dns.disablePrefetch", true);
+user_pref("network.predictor.enabled", false);
+
+// Enable HTTPS-Only
+user_pref("dom.security.https_only_mode", true);
+user_pref("dom.security.https_only_mode_ever_enabled", true);
+
+// Disable form autofill
+user_pref("extensions.formautofill.addresses.enabled", false);
+user_pref("extensions.formautofill.creditCards.enabled", false);
+
+// Enhanced tracking protection
+user_pref("browser.contentblocking.category", "strict");
+user_pref("privacy.trackingprotection.enabled", true);
+user_pref("privacy.trackingprotection.socialtracking.enabled", true);
+
+// DNS over HTTPS
+user_pref("network.trr.mode", 2);
+user_pref("network.trr.uri", "https://mozilla.cloudflare-dns.com/dns-query");
+
+// Disable WebRTC IP leak
+user_pref("media.peerconnection.ice.default_address_only", true);
+
+// Performance
+user_pref("gfx.webrender.all", true);
+user_pref("layers.acceleration.force-enabled", true);
+user_pref("layout.css.backdrop-filter.enabled", true);
+
+// Theme coordination
+// 0 = dark, 1 = light
+user_pref("layout.css.prefers-color-scheme.content-override", {{ if eq $t.mode "light" }}1{{ else }}0{{ end }});
+
+// UI
+user_pref("browser.uidensity", 1);
+user_pref("browser.compactmode.show", true);

package/dot_config/fish/completions/dot-theme-sync.fish.tmpl

@@ -0,0 +1,9 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Completions for dot-theme-sync
+
+# Complete with theme names from themes.toml
+complete -c dot-theme-sync -f -a "{{- range $name, $_ := .themes }}{{ $name }} {{ end }}"
+
+# Complete with flags
+complete -c dot-theme-sync -l help -s h -d "Show help"
+complete -c dot-theme-sync -l full -d "Full chezmoi apply + reload"

package/dot_config/fish/completions/dot.fish.tmpl

@@ -0,0 +1,115 @@
+# Fish completion for 'dot' CLI
+# 🅳🅾🆃🅵🅸🅻🅴🆂 (v{{ .dotfiles_version }})
+
+# Disable file completions for subcommands
+complete -c dot -f
+
+# Core Commands
+complete -c dot -n "__fish_use_subcommand" -a apply -d "Apply dotfiles configuration"
+complete -c dot -n "__fish_use_subcommand" -a sync -d "Alias of apply"
+complete -c dot -n "__fish_use_subcommand" -a update -d "Pull latest changes and apply"
+complete -c dot -n "__fish_use_subcommand" -a clean-cache -d "Clear shell initialization caches"
+complete -c dot -n "__fish_use_subcommand" -a prewarm -d "Regenerate shell caches for ultra-fast startup"
+complete -c dot -n "__fish_use_subcommand" -a cl -d "Claude CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a copilot -d "GitHub Copilot CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a gemini -d "Gemini CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a kiro -d "Kiro CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a sgpt -d "Shell-GPT with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a ollama -d "Ollama with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a opencode -d "OpenCode with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a aider -d "Aider with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a add -d "Add a file to chezmoi source"
+
+# AI Pattern completions for AI CLIs
+for cmd in cl copilot gemini kiro sgpt ollama opencode aider
+    complete -c dot -n "__fish_seen_subcommand_from $cmd" -s p -l pattern -x -a "(ls -1 ~/.config/ai/patterns 2>/dev/null | sed 's/\.md\$//')"
+end
+complete -c dot -n "__fish_use_subcommand" -a diff -d "Show chezmoi diff with exclusions"
+complete -c dot -n "__fish_use_subcommand" -a status -d "Show configuration drift"
+complete -c dot -n "__fish_use_subcommand" -a remove -d "Safely remove a managed file"
+complete -c dot -n "__fish_use_subcommand" -a cd -d "Print source directory path"
+complete -c dot -n "__fish_use_subcommand" -a edit -d "Open chezmoi source in $EDITOR"
+complete -c dot -n "__fish_use_subcommand" -a patterns -d "Manage AI steering patterns"
+complete -c dot -n "__fish_use_subcommand" -a commit -d "AI-powered conventional commit"
+
+# Diagnostics
+complete -c dot -n "__fish_use_subcommand" -a doctor -d "Check system health and configuration"
+complete -c dot -n "__fish_use_subcommand" -a heal -d "Auto-repair common dotfiles issues"
+complete -c dot -n "__fish_use_subcommand" -a health -d "Run comprehensive health check"
+complete -c dot -n "__fish_use_subcommand" -a smoke-test -d "Run automated toolchain verification"
+complete -c dot -n "__fish_use_subcommand" -a chaos -d "Simulate config corruption"
+complete -c dot -n "__fish_use_subcommand" -a scorecard -d "Show the unified scorecard"
+complete -c dot -n "__fish_use_subcommand" -a security-score -d "Score workstation security"
+complete -c dot -n "__fish_use_subcommand" -a drift -d "Drift dashboard"
+complete -c dot -n "__fish_use_subcommand" -a history -d "Shell history analysis"
+complete -c dot -n "__fish_use_subcommand" -a benchmark -d "Run shell startup benchmark"
+complete -c dot -n "__fish_use_subcommand" -a perf -d "Show current performance mode"
+complete -c dot -n "__fish_use_subcommand" -a snapshot -d "Capture workstation state"
+complete -c dot -n "__fish_use_subcommand" -a verify -d "Run verification checks"
+complete -c dot -n "__fish_use_subcommand" -a restore -d "Restore from backup or git ref"
+complete -c dot -n "__fish_use_subcommand" -a ai -d "Show AI helper status"
+complete -c dot -n "__fish_use_subcommand" -a ai-setup -d "Interactive setup for all AI CLI tools"
+complete -c dot -n "__fish_use_subcommand" -a ai-query -d "Context-aware RAG query over your dotfiles"
+complete -c dot -n "__fish_use_subcommand" -a attest -d "Export workstation attestation evidence"
+complete -c dot -n "__fish_use_subcommand" -a lint -d "Lint shell scripts"
+
+# Tools
+complete -c dot -n "__fish_use_subcommand" -a tools -d "Show or install nix packages"
+complete -c dot -n "__fish_use_subcommand" -a new -d "Create a new project from a template"
+complete -c dot -n "__fish_use_subcommand" -a sandbox -d "Launch a safe sandbox preview"
+complete -c dot -n "__fish_use_subcommand" -a keys -d "Show keybindings catalog"
+complete -c dot -n "__fish_use_subcommand" -a learn -d "Interactive tour"
+complete -c dot -n "__fish_use_subcommand" -a docs -d "Show repo README"
+complete -c dot -n "__fish_use_subcommand" -a env -d "Show managed tool versions"
+complete -c dot -n "__fish_use_subcommand" -a profile -d "Show or switch configuration profile"
+
+# Appearance
+complete -c dot -n "__fish_use_subcommand" -a theme -d "Switch terminal theme (dark/light)"
+complete -c dot -n "__fish_use_subcommand" -a wallpaper -d "Apply a wallpaper"
+complete -c dot -n "__fish_use_subcommand" -a fonts -d "Install Nerd Fonts"
+
+# Secrets & Security
+complete -c dot -n "__fish_use_subcommand" -a secrets-init -d "Initialize age key for secrets"
+complete -c dot -n "__fish_use_subcommand" -a secrets -d "Edit encrypted secrets"
+complete -c dot -n "__fish_use_subcommand" -a bundle -d "Create offline archive"
+complete -c dot -n "__fish_use_subcommand" -a upgrade -d "Update flake, plugins, and dotfiles"
+complete -c dot -n "__fish_use_subcommand" -a mcp -d "Inspect MCP policy and registry"
+complete -c dot -n "__fish_use_subcommand" -a mode -d "Show or set the agent profile"
+complete -c dot -n "__fish_use_subcommand" -a agent -d "Show agent metadata and logs"
+complete -c dot -n "__fish_use_subcommand" -a search -d "Find commands by keyword"
+
+# Meta
+complete -c dot -n "__fish_use_subcommand" -a "version --version" -d "Show version"
+complete -c dot -n "__fish_use_subcommand" -a help -d "Show help"
+
+# Focused command flags
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s H -l heal -d "Auto-repair common issues"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s s -l score -d "Show score output"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s A -l ai -d "Include AI diagnostics"
+complete -c dot -n "__fish_seen_subcommand_from attest" -s j -l json -d "Emit JSON output"
+complete -c dot -n "__fish_seen_subcommand_from attest" -s w -l write -r -d "Write attestation to a file"
+complete -c dot -n "__fish_seen_subcommand_from lint" -s c -l check -d "Run check-only mode"
+complete -c dot -n "__fish_seen_subcommand_from lint" -s f -l fix -d "Apply safe fixes"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -s s -l strict -d "Treat policy warnings as errors"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -a registry -d "Show the MCP registry"
+complete -c dot -n "__fish_seen_subcommand_from health" -s v -l verbose -d "Show detailed checks"
+complete -c dot -n "__fish_seen_subcommand_from health" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from health" -s f -l fix -d "Apply common fixes"
+complete -c dot -n "__fish_seen_subcommand_from health" -s F -l force -d "Apply fixes without prompts"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s j -l json -d "Emit JSON timing data"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s p -l profile -d "Include profile output"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s r -l runs -x -d "Set the number of runs"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s t -l target -x -d "Set the timing target in milliseconds"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s v -l verbose -d "Show detailed scoring"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s q -l quiet -d "Reduce output noise"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from snapshot" -s b -l baseline -d "Capture the baseline snapshot"
+complete -c dot -n "__fish_seen_subcommand_from snapshot" -s f -l force -d "Overwrite an existing snapshot"
+complete -c dot -n "__fish_seen_subcommand_from verify" -s s -l security -d "Run security verification"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s l -l list -d "List available backups"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s L -l latest -d "Restore the latest backup"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s g -l git -x -d "Restore from a git ref"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s d -l diff -x -d "Show a diff for a git ref"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s n -l dry-run -d "Preview the restore"

package/dot_config/fish/conf.d/000-perf-cache.fish

@@ -0,0 +1,56 @@
+# Startup performance cache
+# Loaded before vendor conf.d — intercepts slow commands with cached results.
+
+# Fast fish_add_path replacement — builtins only, no argparse overhead.
+# Shadows the standard fish_add_path function (autoloaded from /usr/share/fish/).
+# Handles the common calling conventions used by vendor conf.d scripts.
+function fish_add_path
+    set -l append false
+    set -l paths
+    for arg in $argv
+        switch $arg
+            case --append -a
+                set append true
+            case --global --path -g -p -P -U
+                # Accepted and ignored — we always use global scope + PATH
+            case '--*' '-*'
+                # Ignore unknown flags
+            case '*'
+                set -a paths $arg
+        end
+    end
+    for p in $paths
+        if not contains -- $p $PATH
+            if $append
+                set -g --append PATH $p
+            else
+                set -g --prepend PATH $p
+            end
+        end
+    end
+end
+
+# Cache flatpak --installations (saves ~11ms per startup).
+# The vendor /usr/share/fish/vendor_conf.d/flatpak.fish calls this on every
+# shell start. We wrap it so only the first call after cache expiry is slow.
+# Cache is refreshed by `dot prewarm` or manually:
+#   command flatpak --installations > ~/.cache/fish/flatpak-installations
+if type -q flatpak
+    function flatpak --wraps flatpak
+        if test (count $argv) -eq 1; and test "$argv[1]" = --installations
+            set -l cache "$HOME/.cache/fish/flatpak-installations"
+            if test -f "$cache"
+                while read -l line
+                    echo $line
+                end <"$cache"
+                return 0
+            end
+            mkdir -p "$HOME/.cache/fish"
+            command flatpak --installations 2>/dev/null | tee "$cache"
+            return 0
+        end
+        command flatpak $argv
+    end
+end
+
+status is-interactive; or return

package/dot_config/fish/conf.d/aliases.fish.tmpl

@@ -0,0 +1,77 @@
+{{- $fishFuncsPattern := joinPath .chezmoi.sourceDir "dot_config/fish/functions/*.fish" -}}
+{{- $fishFuncs := glob $fishFuncsPattern -}}
+# Fish aliases — bridged from bash alias library (Generated by Chezmoi)
+# Edit .chezmoitemplates/aliases/ source files, not this file.
+#
+# Data flow: .chezmoitemplates/aliases/ -> 90/91-ux-aliases*.sh -> bash bridge -> cache
+
+if status is-interactive
+    set -l _cache_dir "$HOME/.cache/fish"
+    set -l _alias_cache "$_cache_dir/bash-aliases.fish"
+    set -l _src_eager "$HOME/.config/shell/90-ux-aliases.sh"
+    set -l _src_lazy "$HOME/.config/shell/91-ux-aliases-lazy.sh"
+
+    # Native fish functions that must not be overridden by bash aliases
+    set -l _skip{{ range $fishFuncs }} {{ trimSuffix ".fish" (base .) }}{{ end }}
+
+    # Rebuild cache when alias sources change or cache is missing
+    set -l _stale 0
+    if not test -f "$_alias_cache"
+        set _stale 1
+    else if test -f "$_src_eager"; and test "$_src_eager" -nt "$_alias_cache"
+        set _stale 1
+    else if test -f "$_src_lazy"; and test "$_src_lazy" -nt "$_alias_cache"
+        set _stale 1
+    end
+
+    if test "$_stale" = 1
+        mkdir -p "$_cache_dir"
+        # Source bash aliases, filter fish-incompatible syntax, write cache
+        env -i HOME="$HOME" PATH="$PATH" bash --norc --noprofile -c '
+            source "$HOME/.config/shell/90-ux-aliases.sh" 2>/dev/null
+            source "$HOME/.config/shell/91-ux-aliases-lazy.sh" 2>/dev/null
+            alias -p 2>/dev/null | while IFS= read -r line; do
+                name="${line#alias }"
+                name="${name#-- }"
+                name="${name%%=*}"
+                [[ "$name" =~ ^[a-zA-Z_][a-zA-Z0-9_.-]*$ ]] || continue
+                val="${line#*=}"
+                # Skip bash-specific syntax incompatible with fish
+                case "$val" in
+                    *\$\{*) continue ;;
+                    *"; then "*) continue ;;
+                    *"[[ "*) continue ;;
+                    *\`*) continue ;;
+                esac
+                printf "alias %s=%s\n" "$name" "$val"
+            done
+        ' 2>/dev/null | while read -l _line
+            set -l _parts (string match -r '^alias ([^=]+)=' -- "$_line")
+            set -l _name
+            if set -q _parts[2]
+                set _name $_parts[2]
+            end
+            set -l _target (string replace -r '^alias [^=]+=["'\'']?([^ "'\'']+).*$' '$1' -- "$_line")
+            if set -q _name[1]; and not contains -- "$_name" $_skip
+                if string match -rq '^dot_[a-z0-9_]+$' -- "$_target"
+                    continue
+                end
+                echo "$_line"
+            end
+        end >"$_alias_cache.tmp"
+        mv "$_alias_cache.tmp" "$_alias_cache"
+    end
+
+    # Source cached aliases
+    if test -s "$_alias_cache"
+        source "$_alias_cache"
+    end
+
+    # Remove stale alias wrappers that reference bash-only helper functions.
+    if functions -q cat; and not functions -q dot_cat
+        set -l _cat_def (functions cat)
+        if string match -rq 'dot_cat \$argv' -- "$_cat_def"
+            functions -e cat
+        end
+    end
+end

package/dot_config/fish/conf.d/env.fish.tmpl

@@ -0,0 +1,48 @@
+# 🅳🅾🆃🅵🅸🅻🅴🆂 (v{{ .dotfiles_version }}) — Environment, PATH, and tool defaults
+# Consolidated for startup performance (fewer conf.d files = less source overhead).
+# Values baked at chezmoi apply time where possible — no subshells at startup.
+
+# ── PATH Construction ────────────────────────────────────────────
+# Uses direct set -p (builtin) instead of fish_add_path for speed.
+# Lowest priority first, highest last (each set -p pushes to front).
+set -gx PIPX_HOME (set -q XDG_DATA_HOME; and echo "$XDG_DATA_HOME"; or echo "$HOME/.local/share")/pipx
+set -gx PIPX_BIN_DIR (set -q XDG_BIN_HOME; and echo "$XDG_BIN_HOME"; or echo "$HOME/.local/bin")
+set -gx BUN_INSTALL "$HOME/.bun"
+
+for p in \
+    /usr/sbin /sbin /usr/bin /bin \
+    /opt/homebrew/sbin /opt/homebrew/bin \
+    /opt/homebrew/opt/ruby/bin \
+    "$HOME/.gem/ruby/bin" \
+    "$PIPX_BIN_DIR" \
+    "$HOME/.cargo/bin" \
+    "$HOME/go/bin" \
+    "$BUN_INSTALL/bin" \
+    "$HOME/.node_modules/bin" \
+    "$HOME/.luarocks/bin" \
+{{- if eq .chezmoi.os "darwin" }}
+    /Library/Apple/usr/bin \
+{{- end }}
+    "$HOME/.local/bin" \
+    "$HOME/.local/share/mise/shims" \
+    "$HOME/bin"
+    contains -- "$p" $PATH; or set -p PATH "$p"
+end
+
+# ── Build artifacts → /tmp (cleared on reboot) ─────────────────
+mkdir -p /tmp/builds
+
+# ── Direnv ──────────────────────────────────────────────────────
+set -gx DIRENV_LOG_FORMAT ""
+
+# ── Environment Variables ────────────────────────────────────────
+status is-interactive; or return
+
+set -gx HOSTNAME '{{ output "hostname" | trim }}'
+
+# ── FZF Defaults ─────────────────────────────────────────────────
+if test -f "$HOME/.config/shell/40-fzf-defaults.sh"
+    set -gx FZF_DEFAULT_COMMAND 'fd --type f --strip-cwd-prefix --hidden --follow --exclude .git'
+    set -gx FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
+    set -gx FZF_DEFAULT_OPTS "--color=bg+:#313244,bg:#1e1e2e,spinner:#f5e0dc,hl:#f38ba8 --color=fg:#cdd6f4,header:#f38ba8,info:#cba6f7,pointer:#f5e0dc --color=marker:#f5e0dc,fg+:#cdd6f4,prompt:#cba6f7,hl+:#f38ba8 --multi --layout=reverse --border --height=40% --preview-window='right:60%:wrap' --preview 'if [ -d {} ]; then eza --tree --level 2 --icons {} | head -200; else bat --style=numbers --color=always --line-range :500 {} 2>/dev/null; or cat {} | head -500; end'"
+end

package/dot_config/fish/conf.d/functions.fish.tmpl

@@ -0,0 +1,22 @@
+{{- $root := . -}}
+{{- $groupsPath := joinPath $root.chezmoi.sourceDir ".chezmoitemplates/functions/groups.json" -}}
+{{- $groups := (fromJson (include $groupsPath)) -}}
+{{- $fishFuncsPattern := joinPath $root.chezmoi.sourceDir "dot_config/fish/functions/*.fish" -}}
+{{- $fishFuncs := glob $fishFuncsPattern -}}
+# Fish function wrappers (Generated by Chezmoi)
+# Delegates to bash function library in ~/.config/shell/50-logic-functions.sh
+# Edit .chezmoitemplates/functions/ source files, not this file.
+
+if status is-interactive
+{{- range $group, $files := $groups }}
+{{- range $files }}
+{{- $func := trimSuffix ".sh" (base .) }}
+{{- $nativePath := joinPath $root.chezmoi.sourceDir (printf "dot_config/fish/functions/%s.fish" $func) }}
+{{- if not (has $nativePath $fishFuncs) }}
+    function {{ $func }} --description 'Dotfiles: {{ $func }}'
+        bash -c 'source "$HOME/.config/shell/50-logic-functions.sh" 2>/dev/null; {{ $func }} "$@"' -- $argv
+    end
+{{- end }}
+{{- end }}
+{{- end }}
+end