@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/dot_config/redis/redisclirc

@@ -0,0 +1,41 @@
+# Redis CLI Configuration (~/.config/redis/redisclirc)
+# Sourced by redis-cli via REDISCLI_RCFILE environment variable
+
+# History file location
+# Set via: export REDISCLI_HISTFILE=~/.local/share/redis/history
+
+# Note: redis-cli has limited configuration options.
+# Most customization is done via environment variables:
+#
+# REDISCLI_HISTFILE - History file location
+# REDISCLI_AUTH - Default password (not recommended, use --askpass)
+# REDISCLI_CLUSTER_SLAVES - Show slave nodes in cluster commands
+#
+# Common usage patterns:
+#
+# Connect to local Redis:
+#   redis-cli
+#
+# Connect to remote Redis:
+#   redis-cli -h hostname -p 6379
+#
+# Connect with authentication:
+#   redis-cli --askpass
+#
+# Run command and exit:
+#   redis-cli PING
+#
+# Monitor all commands:
+#   redis-cli MONITOR
+#
+# Get server info:
+#   redis-cli INFO
+#
+# Cluster mode:
+#   redis-cli -c -h hostname
+
+# Useful aliases (defined in shell aliases):
+# alias redis='redis-cli'
+# alias redis-info='redis-cli INFO'
+# alias redis-keys='redis-cli --scan'
+# alias redis-monitor='redis-cli MONITOR'

package/dot_config/ripgrep/ripgreprc

@@ -0,0 +1,21 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Smart case search
+--smart-case
+# Add custom type definitions
+--type-add=web:*.{html,css,js,ts,tsx,jsx,vue,svelte}
+--type-add=config:*.{toml,yaml,yml,json,ini,conf}
+--type-add=shell:*.{sh,bash,zsh,fish}
+# Max columns before truncation
+--max-columns=200
+--max-columns-preview
+# Ignore common directories
+--glob=!.git
+--glob=!node_modules
+--glob=!.venv
+--glob=!target
+--glob=!dist
+--glob=!build
+--glob=!*.min.js
+--glob=!*.min.css
+--glob=!package-lock.json
+--glob=!yarn.lock

package/dot_config/shell/00-core-paths.sh.tmpl

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / dot_config/fish/conf.d/; inherits set -euo pipefail from the caller.
+## Construct PATH hierarchy for all language runtimes and tools.
+##
+## Sets PATH precedence: Local bin > Language runtimes > Homebrew > System.
+## This file is generated by Chezmoi and should not be edited directly.
+##
+## # Data Flow
+## ~/.zshenv (XDG vars) → 00-core-paths.sh (PATH) → tool-specific init
+##
+## # Platform Notes
+## ### Platform: macOS
+## - Adds /opt/homebrew/bin for Apple Silicon
+## - Includes macOS application paths (VS Code, Little Snitch)
+##
+## ### Platform: Linux
+## - Homebrew section skipped if /opt/homebrew absent
+## - Standard FHS paths (/usr/bin, /usr/local/bin)
+##
+## ### Platform: WSL
+## - Works with both Linux and Windows paths
+## - Windows PATH inherited via interop
+##
+## # Dependencies
+## - Bash 4+ for associative array PATH deduplication
+## - Falls back to awk for Bash 3.x
+##
+## # Idempotency
+## Safe to source multiple times. Deduplicates PATH entries.
+
+# Helper: prepend path if directory exists (moves to front if already present)
+path_prepend() {
+    local dir="$1"
+    [[ -n "$dir" && -d "$dir" ]] || return 0
+    # Remove existing entry (if any) then prepend — ensures correct precedence
+    PATH="${PATH/#"$dir:"/}"        # leading
+    PATH="${PATH/%":$dir"/}"        # trailing
+    PATH="${PATH//":$dir:"/:}"      # middle
+    [[ "$PATH" == "$dir" ]] && PATH=""  # sole entry
+    PATH="$dir${PATH:+:$PATH}"
+}
+
+# 1. System Paths (Prepend, but will be pushed down by later prepends)
+PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:${PATH}"
+
+# 2. Homebrew Paths (Prepend -> Higher Priority)
+path_prepend "/opt/homebrew/sbin"
+path_prepend "/opt/homebrew/bin"
+
+# 3. Language Runtimes
+# Ruby (Homebrew)
+path_prepend "/opt/homebrew/opt/ruby/bin"
+# Ruby (User Gems)
+path_prepend "${HOME}/.gem/ruby/bin"
+
+# Python (Pipx)
+export PIPX_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/pipx"
+export PIPX_BIN_DIR="${XDG_BIN_HOME:-$HOME/.local/bin}"
+path_prepend "${PIPX_BIN_DIR}"
+
+# .NET Tools
+path_prepend "${HOME}/.dotnet/tools"
+
+# Rust (Cargo)
+path_prepend "${HOME}/.cargo/bin"
+
+# Go
+path_prepend "${HOME}/go/bin"
+
+# Bun
+export BUN_INSTALL="${HOME}/.bun"
+path_prepend "${BUN_INSTALL}/bin"
+
+# Kubeconfig merge logic (merge all configs in ~/.kube/config.d/)
+# Lazy-loaded via kubectl wrapper to avoid startup cost
+_lazy_load_kubeconfig() {
+    if [[ -d "${HOME}/.kube/config.d" ]]; then
+        local kubeconfig_extra=""
+        for conf in "${HOME}/.kube/config.d"/*; do
+            [[ -f "$conf" ]] && kubeconfig_extra="${kubeconfig_extra}:${conf}"
+        done
+        [[ -n "$kubeconfig_extra" ]] && export KUBECONFIG="${HOME}/.kube/config${kubeconfig_extra}"
+    fi
+    unset -f kubectl _lazy_load_kubeconfig 2>/dev/null
+    command kubectl "$@"
+}
+# Only wrap kubectl if config.d exists and kubectl is installed
+if [[ -d "${HOME}/.kube/config.d" ]]; then
+    kubectl() { _lazy_load_kubeconfig "$@"; }
+fi
+# Still honor explicit KUBECONFIG or in-cluster detection
+if [[ -n "${KUBERNETES_SERVICE_HOST:-}" ]] || [[ -n "${KUBECONFIG:-}" ]]; then
+    _lazy_load_kubeconfig --version >/dev/null 2>&1 || true
+fi
+
+# Node.js (Global)
+path_prepend "${HOME}/.node_modules/bin"
+
+# Lua (Luarocks)
+path_prepend "${HOME}/.luarocks/bin"
+
+# 4. macOS System Paths
+{{- if eq .chezmoi.os "darwin" }}
+path_prepend "/Library/Apple/usr/bin"
+{{- end }}
+
+# 5. Local Bin and Tools (Highest Priority)
+path_prepend "${HOME}/.fzf/bin"
+path_prepend "${HOME}/.local/bin"
+path_prepend "${HOME}/.local/share/mise/shims"
+path_prepend "${HOME}/bin"
+
+# Deduplicate PATH (Keep first occurrence to maintain precedence)
+# Standard Zsh handles this with 'typeset -U path', but for bash compatibility/subshells:
+if [ -z "${ZSH_VERSION:-}" ]; then
+    # Use native bash associative arrays for O(n) deduplication (bash 4+)
+    if [[ ${BASH_VERSION%%.*} -ge 4 ]]; then
+        declare -A _seen_paths
+        IFS=':' read -ra _path_array <<< "$PATH"
+        _new_path=""
+        for _dir in "${_path_array[@]}"; do
+            if [[ -n "$_dir" && -z "${_seen_paths[$_dir]:-}" ]]; then
+                _seen_paths[$_dir]=1
+                _new_path="${_new_path:+$_new_path:}$_dir"
+            fi
+        done
+        PATH="$_new_path"
+        unset _seen_paths _path_array _new_path _dir
+    else
+        # Fallback to awk for bash 3.x
+        PATH=$(echo "$PATH" | awk -v RS=':' '!seen[$0]++ {ORS=(NR>1?":":"")} {print}')
+    fi
+    export PATH
+fi

package/dot_config/shell/05-core-safety.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
+
+# 05-safety.sh: Core Safety Settings
+# Part of the "Core Layer"
+
+# Set sane defaults for safety, though be careful with -e in interactive shell
+# Use 'set -o pipefail' to catch pipeline errors if supported
+if [[ -n "$BASH_VERSION" ]] || [[ -n "$ZSH_VERSION" ]]; then
+    set -o pipefail 2>/dev/null || true
+fi
+
+# Prevent file overwrite with redirection (force use of >|)
+set -o noclobber
+
+# Strict destructive-operation confirmation helper.
+# Enabled when DOTFILES_ALIAS_STRICT_MODE=1.
+dot_confirm_destructive() {
+    local action="${1:-destructive operation}"
+    local log_file="${DOTFILES_DESTRUCTIVE_LOG:-$HOME/.dotfiles_destruction.log}"
+    local ts
+
+    if [[ "${DOTFILES_ALIAS_STRICT_MODE:-0}" != "1" ]]; then
+        return 0
+    fi
+
+    if [[ ! -t 0 ]]; then
+        if [[ "${DOTFILES_FORCE_DESTRUCTIVE:-0}" == "1" ]]; then
+            ts="$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || date)"
+            printf "%s\tuser=%s\thost=%s\tpwd=%s\taction=%s\tmode=forced\n" \
+                "$ts" "${USER:-unknown}" "${HOSTNAME:-unknown}" "${PWD:-unknown}" "$action" >> "$log_file" 2>/dev/null || true
+            return 0
+        fi
+        echo "[STRICT] Refusing ${action} without TTY confirmation." >&2
+        return 1
+    fi
+
+    echo "[STRICT] About to run: ${action}" >&2
+    read -r -p "Type YES to continue: " confirm
+    if [[ "$confirm" == "YES" ]]; then
+        ts="$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || date)"
+        printf "%s\tuser=%s\thost=%s\tpwd=%s\taction=%s\tmode=confirmed\n" \
+            "$ts" "${USER:-unknown}" "${HOSTNAME:-unknown}" "${PWD:-unknown}" "$action" >> "$log_file" 2>/dev/null || true
+        return 0
+    fi
+    return 1
+}

package/dot_config/shell/10-secrets.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
+
+# 10-secrets.sh: Optional secret bucket auto-loader
+# Loads configured secret buckets into the current shell via `dot env load`.
+
+if [[ "${DOTFILES_SECRETS_AUTO_LOAD:-0}" != "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
+if ! command -v dot >/dev/null 2>&1; then
+  return 0 2>/dev/null || exit 0
+fi
+
+_dot_secret_buckets=()
+if [[ -n "${DOTFILES_SECRETS_BUCKET_NAMES:-}" ]]; then
+  while IFS= read -r _bucket; do
+    [[ -n "$_bucket" ]] || continue
+    _dot_secret_buckets+=("$_bucket")
+  done < <(printf '%s' "${DOTFILES_SECRETS_BUCKET_NAMES}" | tr ',' '\n')
+fi
+
+for _bucket in "${_dot_secret_buckets[@]}"; do
+  [[ -n "$_bucket" ]] || continue
+  _dot_secret_out="$(dot env load "$_bucket" 2>/dev/null || true)"
+  [[ -n "$_dot_secret_out" ]] || continue
+  case "$_dot_secret_out" in
+    export\ * | typeset\ * | unset\ *)
+      # Use process substitution instead of eval for safety
+      # shellcheck disable=SC1090
+      . /dev/stdin <<<"$_dot_secret_out"
+      ;;
+    *)
+      # Ignore non-shell output
+      ;;
+  esac
+  unset _dot_secret_out
+done
+
+unset _dot_secret_buckets _bucket

package/dot_config/shell/40-fzf-defaults.sh.tmpl

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
+# 🅳🅾🆃🅵🅸🅻🅴🆂 (v{{ .dotfiles_version }})
+# FZF Shared Configuration for all shells (Zsh, Bash, Fish)
+
+# Set FZF defaults to use 'fd' for speed and 'bat' for previews
+export FZF_DEFAULT_COMMAND='fd --type f --strip-cwd-prefix --hidden --follow --exclude .git'
+export FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
+
+# Sublime FZF Colors (Catppuccin Mocha)
+export FZF_DEFAULT_OPTS=" 
+--color=bg+:#313244,bg:#1e1e2e,spinner:#f5e0dc,hl:#f38ba8 
+--color=fg:#cdd6f4,header:#f38ba8,info:#cba6f7,pointer:#f5e0dc 
+--color=marker:#f5e0dc,fg+:#cdd6f4,prompt:#cba6f7,hl+:#f38ba8 
+--multi --layout=reverse --border --height=40% 
+--preview-window='right:60%:wrap' 
+--preview 'if [ -d {} ]; then eza --tree --level 2 --icons {} | head -200; else bat --style=numbers --color=always --line-range :500 {} 2>/dev/null || cat {} | head -500; fi'"

package/dot_config/shell/40-ls-colors.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
+
+# Set ls colors with GNU/BSD detection and caching
+# GNU coreutils: LS_COLORS via dircolors
+# BSD/macOS: LSCOLORS + CLICOLOR
+
+_dircolors_cache="${XDG_CACHE_HOME:-$HOME/.cache}/shell/dircolors.sh"
+
+_dircolors_cached_eval() {
+  local cmd="$1"
+  shift
+  if [ -f "$_dircolors_cache" ]; then
+    # shellcheck disable=SC1090
+    . "$_dircolors_cache"
+  else
+    mkdir -p "$(dirname "$_dircolors_cache")"
+    "$cmd" "$@" >"$_dircolors_cache" 2>/dev/null
+    # shellcheck disable=SC1090
+    . "$_dircolors_cache"
+  fi
+}
+
+if command -v dircolors >/dev/null 2>&1; then
+  if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/dircolors" ]; then
+    _dircolors_cached_eval dircolors -b "${XDG_CONFIG_HOME:-$HOME/.config}/dircolors"
+  else
+    _dircolors_cached_eval dircolors -b
+  fi
+else
+  case "$(uname -s 2>/dev/null)" in
+    Darwin*)
+      export CLICOLOR=1
+      export LSCOLORS="ExFxCxDxBxegedabagacad"
+      if command -v gdircolors >/dev/null 2>&1; then
+        _dircolors_cached_eval gdircolors -b
+      fi
+      ;;
+  esac
+fi
+
+unset -f _dircolors_cached_eval
+unset _dircolors_cache
+
+# Ensure LS_COLORS is set for Zsh completion when only LSCOLORS exists
+if [ -z "${LS_COLORS:-}" ] && [ -n "${LSCOLORS:-}" ]; then
+  export LS_COLORS=""
+fi

package/dot_config/shell/50-logic-functions-core.sh.tmpl

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
+
+# Core Functions (Generated by Chezmoi) - minimal set
+
+{{- $globPattern := joinPath .chezmoi.sourceDir ".chezmoitemplates/functions/utils/*.sh" -}}
+{{- $files := glob $globPattern -}}
+{{- range $files -}}
+{{- include . }}
+{{- "\n" -}}
+{{- end -}}

package/dot_config/shell/50-logic-functions.sh.tmpl

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
+
+# Universal Functions (Generated by Chezmoi)
+
+{{- $globPattern := joinPath .chezmoi.sourceDir ".chezmoitemplates/functions/**/*.sh" }}
+{{- $files := glob $globPattern }}
+{{- range $files }}
+  {{- include . }}
+  {{- "\n" }}
+{{- end }}

package/dot_config/shell/51-logic-functions-extra.sh.tmpl

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc (lazy layer); inherits set -euo pipefail from the caller.
+
+# Extra Functions (Generated by Chezmoi) - loaded on demand
+# Group-wise lazy loaders to reduce first-load cost.
+
+{{ $root := . }}
+{{ $groupsPath := joinPath $root.chezmoi.sourceDir ".chezmoitemplates/functions/groups.json" }}
+{{ $groups := (fromJson (include $groupsPath)) }}
+
+{{ range $group, $files := $groups }}
+_dotfiles_load_group_{{ $group }}() {
+  unset -f _dotfiles_load_group_{{ $group }} 2>/dev/null
+  # shellcheck disable=SC1090
+  . /dev/stdin <<'__DOTFILES_EOF__'
+{{ range $files }}
+{{ $p := joinPath $root.chezmoi.sourceDir ".chezmoitemplates/functions" . }}
+{{ include $p }}
+
+{{ end }}
+__DOTFILES_EOF__
+}
+
+{{ range $files }}
+{{ $func := trimSuffix ".sh" (base .) }}
+{{ $func }}() { _dotfiles_load_group_{{ $group }}; {{ $func }} "$@"; }
+
+{{ end }}
+{{ end }}
+
+# Pueue Background Task Wrappers (2026 Strategy)
+# Use these for long-running blocking tasks.
+if command -v pueue >/dev/null 2>&1; then
+    # silent-run: Submit a command to pueue and forget about it.
+    silent-run() {
+        local cmd="$*"
+        if [[ -z "$cmd" ]]; then
+            echo "Usage: silent-run <command>"
+            return 1
+        fi
+        pueue add -- "$cmd"
+    }
+
+    # notify-run: Submit a command and notify when done.
+    notify-run() {
+        local cmd="$*"
+        if [[ -z "$cmd" ]]; then
+            echo "Usage: notify-run <command>"
+            return 1
+        fi
+        local task_id
+        task_id=$(pueue add --print-id -- "$cmd")
+        echo "Task $task_id submitted: $cmd"
+        (pueue wait "$task_id" && echo "✅ Task $task_id finished: $cmd") &!
+    }
+
+    # bg-upgrade: Background upgrade of all package managers.
+    bg-upgrade() {
+        echo "🚀 Starting background upgrades (Homebrew, Nix, Chezmoi)..."
+        if command -v brew >/dev/null; then silent-run "brew upgrade"; fi
+        if command -v nix >/dev/null; then silent-run "nix flake update"; fi
+        silent-run "chezmoi update"
+        echo "Check status with 'pueue status'"
+    }
+fi

package/dot_config/shell/90-ux-aliases.sh.tmpl

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
+## WARNING: Alias names must be unique across all alias source files in
+## .chezmoitemplates/aliases/. Duplicates silently overwrite earlier
+## definitions. Run the alias-conflict test to detect collisions.
+##
+## Core Aliases — Eager Load.
+##
+## High-frequency aliases loaded at shell startup (~40KB). Generated by Chezmoi
+## from alias definition files in .chezmoitemplates/aliases/. Edit the source
+## templates, not this file.
+##
+## # Data Flow
+## .chezmoidata.toml (profile, buckets) → 90-ux-aliases.sh.tmpl → aliases
+##
+## # Chezmoi Variables
+## | Variable | Default | Description |
+## |----------|---------|-------------|
+## | .aliases.profile | standard | minimal, standard, or full |
+## | .aliases.buckets | all true | Enable/disable alias categories |
+##
+## # Core Categories (14)
+## archives, cd, clear, configuration, default, diagnostics, disk-usage,
+## editor, git, interactive, installer, mkdir, modern, ps, rsync, sudo, system
+##
+## # Platform Notes
+## - macOS-specific aliases excluded from non-Darwin systems
+## - Bash and Zsh compatible
+##
+## # Idempotency
+## Safe to source multiple times. Aliases overwrite previous definitions.
+if [ -n "${BASH_VERSION:-}" ]; then
+  shopt -s expand_aliases
+fi
+if [ -n "${ZSH_VERSION:-}" ]; then
+  setopt aliases
+fi
+
+{{ $coreCategories := list "archives" "cd" "clear" "configuration" "default" "diagnostics" "disk-usage" "editor" "git" "interactive" "installer" "mkdir" "modern" "ps" "rsync" "sudo" "system" "compliance" -}}
+{{ $aliasProfile := lower (default "standard" (env "DOTFILES_ALIAS_PROFILE")) -}}
+{{ $aliasBuckets := default (dict) .aliases.buckets -}}
+{{ $globPattern := joinPath .chezmoi.sourceDir ".chezmoitemplates/aliases/**/*.aliases.sh" -}}
+{{ $files := glob $globPattern -}}
+{{ range $files -}}
+  {{ $name := . -}}
+  {{ $isCore := false -}}
+  {{ $bucketEnabled := true -}}
+  {{ if contains "/system/" $name -}}
+    {{ $bucketEnabled = default true (index $aliasBuckets "system") -}}
+  {{ end -}}
+  {{ if contains "/subversion/" $name -}}
+    {{ $bucketEnabled = default true (index $aliasBuckets "svn") -}}
+  {{ end -}}
+  {{ $isCoreMinimalExcluded := or (contains "/interactive/" $name) (contains "/sudo/" $name) -}}
+  {{ $includeByProfile := true -}}
+  {{ if and (eq $aliasProfile "minimal") $isCoreMinimalExcluded -}}
+    {{ $includeByProfile = false -}}
+  {{ end -}}
+  {{ range $coreCategories -}}
+    {{ if contains (printf "/%s/" .) $name -}}
+      {{ $isCore = true -}}
+    {{ end -}}
+  {{ end -}}
+  {{ if and $isCore (not (contains "/macOS/" $name)) (not (contains "/archives/" $name)) $includeByProfile $bucketEnabled }}
+{{ include $name }}
+  {{ end -}}
+{{ end }}
+
+# Archive aliases loaded last among core aliases so extraction shortcuts
+# take precedence over earlier generic shims.
+{{- range $files -}}
+  {{- $name := . -}}
+  {{- if and (contains "/archives/" $name) (not (contains "/macOS/" $name)) }}
+{{ include $name }}
+  {{- end -}}
+{{- end }}
+
+# Zsh fallback: if alias expansion is disabled, provide function shims.
+_dotfiles_alias_shims() {
+  [[ -n "${_DOTFILES_ALIAS_SHIMS_LOADED:-}" ]] && return 0
+  _DOTFILES_ALIAS_SHIMS_LOADED=1
+  c() { clear_screen; }
+  q() { exit; }
+  e() { "${EDITOR:-nano}" "$@"; }
+  h() { history; }
+  l() { dot_ls "$@"; }
+  ll() { dot_ll "$@"; }
+  la() { dot_la "$@"; }
+  lt() { dot_lt "$@"; }
+  lr() { dot_lr "$@"; }
+  lra() { dot_lra "$@"; }
+  lta() { dot_lta "$@"; }
+  d() {
+    if command -v dot >/dev/null 2>&1; then
+      dot "$@"
+    elif command -v docker >/dev/null 2>&1; then
+      docker "$@"
+    fi
+  }
+  i() { command -v epoch >/dev/null 2>&1 && epoch "$@"; }
+  a() { command -v ai_core >/dev/null 2>&1 && ai_core query "$@"; }
+  _() { sudo "$@"; }
+}
+
+if [ -n "${ZSH_VERSION:-}" ]; then
+  if ! setopt | grep -q '^aliases$' || [[ "${DOTFILES_FORCE_ALIAS_SHIMS:-0}" == "1" ]]; then
+    _dotfiles_alias_shims
+  fi
+fi
+
+# OS-Specific Core Aliases
+
+## macOS
+{{- if eq .chezmoi.os "darwin" }}
+  {{- $macGlobPattern := joinPath .chezmoi.sourceDir ".chezmoitemplates/aliases/macOS/*.aliases.sh" }}
+  {{- $macFiles := glob $macGlobPattern }}
+  {{- range $macFiles }}
+    {{- include . }}
+    {{- "\n" }}
+  {{- end }}
+{{- end }}

package/dot_config/shell/91-ux-aliases-lazy.sh.tmpl

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc (lazy layer); inherits set -euo pipefail from the caller.
+
+# Tool-Specific Aliases — Lazy Load (Generated by Chezmoi)
+# These are loaded after the first prompt via precmd hook to keep startup fast.
+if [ -n "${BASH_VERSION:-}" ]; then
+  shopt -s expand_aliases
+fi
+
+{{ $coreCategories := list "archives" "cd" "clear" "configuration" "default" "diagnostics" "disk-usage" "editor" "git" "interactive" "installer" "mkdir" "modern" "ps" "rsync" "sudo" "system" "compliance" -}}
+{{ $aliasProfile := lower (default "standard" (env "DOTFILES_ALIAS_PROFILE")) -}}
+{{ $ecosystems := lower (default "all" (env "DOTFILES_ALIAS_ECOSYSTEMS")) -}}
+{{ $aliasBuckets := default (dict) .aliases.buckets -}}
+{{ $globPattern := joinPath .chezmoi.sourceDir ".chezmoitemplates/aliases/**/*.aliases.sh" -}}
+{{ $files := glob $globPattern -}}
+{{ range $files -}}
+  {{ $name := . -}}
+  {{ $isCore := false -}}
+  {{ $bucketEnabled := true -}}
+  {{ if contains "/system/" $name -}}
+    {{ $bucketEnabled = default true (index $aliasBuckets "system") -}}
+  {{ end -}}
+  {{ if contains "/subversion/" $name -}}
+    {{ $bucketEnabled = default true (index $aliasBuckets "svn") -}}
+  {{ end -}}
+  {{ $isPython := contains "/python/" $name -}}
+  {{ $isNode := or (contains "/npm/" $name) (contains "/pnpm/" $name) (contains "/yarn/" $name) -}}
+  {{ $isRust := contains "/rust/" $name -}}
+  {{ $isNetwork := or (contains "/dig/" $name) (contains "/security/" $name) -}}
+  {{ $isLegacy := or (contains "/subversion/" $name) (contains "/vagrant/" $name) -}}
+  {{ $isEcosystem := or $isPython (or $isNode (or $isRust (or $isNetwork $isLegacy))) -}}
+  {{ $ecosystemEnabled := true -}}
+  {{ if not (eq $ecosystems "all") -}}
+    {{ $ecosystemEnabled = false -}}
+    {{ if and $isPython (contains "python" $ecosystems) -}}{{ $ecosystemEnabled = true -}}{{ end -}}
+    {{ if and $isNode (contains "node" $ecosystems) -}}{{ $ecosystemEnabled = true -}}{{ end -}}
+    {{ if and $isRust (contains "rust" $ecosystems) -}}{{ $ecosystemEnabled = true -}}{{ end -}}
+    {{ if and $isNetwork (contains "network" $ecosystems) -}}{{ $ecosystemEnabled = true -}}{{ end -}}
+    {{ if and $isLegacy (contains "legacy" $ecosystems) -}}{{ $ecosystemEnabled = true -}}{{ end -}}
+  {{ end -}}
+  {{ $isHeavy := or (contains "/security/" $name) (contains "/docker/" $name) (contains "/kubernetes/" $name) (contains "/terraform/" $name) (contains "/gcloud/" $name) -}}
+  {{ $isMinimalExcluded := or $isHeavy (contains "/ai/" $name) (contains "/benchmarks/" $name) -}}
+  {{ $includeByProfile := true -}}
+  {{ if and (eq $aliasProfile "minimal") $isMinimalExcluded -}}
+    {{ $includeByProfile = false -}}
+  {{ end -}}
+  {{ range $coreCategories -}}
+    {{ if contains (printf "/%s/" .) $name -}}
+      {{ $isCore = true -}}
+    {{ end -}}
+  {{ end -}}
+  {{ if and (not $isCore) (not (contains "/macOS/" $name)) $includeByProfile (or (not $isEcosystem) $ecosystemEnabled) $bucketEnabled }}
+{{ include $name }}
+  {{ end -}}
+{{ end }}