@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/dot_config/shell/00-core-paths.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / dot_config/fish/conf.d/; inherits set -euo pipefail from the caller.
 ## Construct PATH hierarchy for all language runtimes and tools.
 ##
 ## Sets PATH precedence: Local bin > Language runtimes > Homebrew > System.
@@ -40,7 +41,14 @@ path_prepend() {
 }
 
 # 1. System Paths (Prepend, but will be pushed down by later prepends)
-PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:${PATH}"
+# Use path_prepend so existing entries are removed first — avoids the
+# duplicate-system-path bloat that `PATH="...:${PATH}"` produces when
+# the parent shell already had these (e.g. macOS launchd default PATH).
+path_prepend "/sbin"
+path_prepend "/usr/sbin"
+path_prepend "/bin"
+path_prepend "/usr/bin"
+path_prepend "/usr/local/bin"
 
 # 2. Homebrew Paths (Prepend -> Higher Priority)
 path_prepend "/opt/homebrew/sbin"

package/dot_config/shell/05-core-safety.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
 
 # 05-safety.sh: Core Safety Settings
 # Part of the "Core Layer"

package/dot_config/shell/10-secrets.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
 
 # 10-secrets.sh: Optional secret bucket auto-loader
 # Loads configured secret buckets into the current shell via `dot env load`.

package/dot_config/shell/40-fzf-defaults.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
 # 🅳🅾🆃🅵🅸🅻🅴🆂 (v{{ .dotfiles_version }})
 # FZF Shared Configuration for all shells (Zsh, Bash, Fish)
 

package/dot_config/shell/40-ls-colors.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by dot_zshrc.tmpl / dot_bashrc; inherits set -euo pipefail from the caller.
 
 # Set ls colors with GNU/BSD detection and caching
 # GNU coreutils: LS_COLORS via dircolors

package/dot_config/shell/50-logic-functions-core.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
 
 # Core Functions (Generated by Chezmoi) - minimal set
 

package/dot_config/shell/50-logic-functions.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
 
 # Universal Functions (Generated by Chezmoi)
 

package/dot_config/shell/51-logic-functions-extra.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc (lazy layer); inherits set -euo pipefail from the caller.
 
 # Extra Functions (Generated by Chezmoi) - loaded on demand
 # Group-wise lazy loaders to reduce first-load cost.

package/dot_config/shell/90-ux-aliases.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc / fish bridge; inherits set -euo pipefail from the caller.
 ## WARNING: Alias names must be unique across all alias source files in
 ## .chezmoitemplates/aliases/. Duplicates silently overwrite earlier
 ## definitions. Run the alias-conflict test to detect collisions.

package/dot_config/shell/91-ux-aliases-lazy.sh.tmpl

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Sourced by dot_zshrc.tmpl / dot_bashrc (lazy layer); inherits set -euo pipefail from the caller.
 
 # Tool-Specific Aliases — Lazy Load (Generated by Chezmoi)
 # These are loaded after the first prompt via precmd hook to keep startup fast.

package/dot_config/shell/README.md

@@ -7,13 +7,13 @@ Welcome to your universally compatible, high-performance dotfiles configuration,
 - **Universal Support**: Works seamlessly on macOS, Linux (Ubuntu/Debian), and Windows (WSL).
 - **Fast Startup**: Optimized with `zcompile` and lazy-loading. Benchmarks vary by machine; use `DOTFILES_FAST=1` for the quickest first prompt.
 - **Modern Core**: Replaces legacy Unix tools with Rust-based alternatives:
-    - `eza` (ls)
-    - `bat` (cat)
-    - `ripgrep` (grep)
-    - `zoxide` (cd)
-    - `atuin` (history)
-    - `yazi` (files)
-    - `zellij` (multiplexer)
+  - `eza` (ls)
+  - `bat` (cat)
+  - `ripgrep` (grep)
+  - `zoxide` (cd)
+  - `atuin` (history)
+  - `yazi` (files)
+  - `zellij` (multiplexer)
 - **Starship Prompt**: A fast, customizable, cross-shell prompt.
 - **Optimized Vim**: Vim settings are kept minimal and fast by default.
 - **Modular Design**: Configuration is split into small, manageable templates.
@@ -23,13 +23,15 @@ Welcome to your universally compatible, high-performance dotfiles configuration,
 ## Get started
 
 ### Install
+
 To install these dotfiles on a new machine, run:
 
 ```bash
-sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.500/install.sh)"
+sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.502/install.sh)"
 ```
 
 This command will:
+
 1. Install `chezmoi`.
 2. Clone this repository.
 3. Install required packages (Homebrew/Apt).
@@ -40,7 +42,9 @@ This command will:
 ## Keep it current
 
 ### macOS
+
 Updates are handled via [Homebrew](https://brew.sh/).
+
 1. Edit `~/.dotfiles/dot_config/shell/Brewfile.cli` and `~/.dotfiles/dot_config/shell/Brewfile.cask`.
 2. Run `chezmoi apply`.
    - This triggers `run_onchange_darwin_install-packages.sh.tmpl`, which runs `brew bundle` for CLI and GUI packages.
@@ -48,16 +52,20 @@ Updates are handled via [Homebrew](https://brew.sh/).
    - Optional: `duti` applies default app bindings from `~/.config/duti/defaults.duti`.
 
 ### VS Code extensions
+
 1. Edit `~/.config/vscode/extensions.txt`.
 2. Run `chezmoi apply` to install missing extensions (if `code` is available).
 
 ### Linux and WSL
+
 Updates are handled via `apt-get` (Ubuntu/Debian).
+
 1. Run `chezmoi apply`.
    - This checks for package updates defined in `run_onchange_linux_install-packages.sh.tmpl`.
    - Optional Flatpak list is read from `~/.config/flatpak/flatpak.list`.
 
 ### Vim plugins
+
 1. Edit `~/.dotfiles/dot_vimrc`.
 2. Run `chezmoi apply`.
    - This automatically runs `vim +PlugInstall +PlugClean +qa`.
@@ -69,12 +77,14 @@ Updates are handled via `apt-get` (Ubuntu/Debian).
 If you are migrating from an old `~/.dotfiles` setup:
 
 1. **Backup**:
+
    ```bash
    mv ~/.dotfiles ~/.dotfiles.legacy
    cp ~/.zshrc ~/.zshrc.bak
    ```
 
 2. **Initialize Chezmoi**:
+
    ```bash
    git clone https://github.com/sebastienrousseau/dotfiles.git ~/.dotfiles
    chezmoi apply
@@ -115,6 +125,7 @@ The configuration is managed in `~/.dotfiles`.
 ## Use it
 
 ### Apply changes
+
 After editing any file in `~/.dotfiles`, apply the changes to your home directory:
 
 ```bash
@@ -195,6 +206,7 @@ ${EDITOR:-nano} ~/.config/chezmoi/chezmoi.toml
 ```
 
 Fields:
+
 - `git_name`
 - `git_email`
 - `git_signingkey`
@@ -211,6 +223,7 @@ terminal_font_size = 12
 ```
 
 Available themes:
+
 - `tokyonight-night` (best dark default)
 - `tokyonight-day` (best light default)
 - `tokyonight-storm`
@@ -242,6 +255,7 @@ Available themes:
 ```
 
 ### Add aliases
+
 1. Navigate to `~/.dotfiles/.chezmoitemplates/aliases/`.
 2. Create a new file (e.g., `mytool/mytool.aliases.sh`) or edit an existing one.
 3. Add your aliases.
@@ -250,12 +264,14 @@ Available themes:
 **Note:** Files in `macOS/` are only included on macOS systems.
 
 ### Add functions
+
 1. Navigate to `~/.dotfiles/.chezmoitemplates/functions/`.
 2. Create a new `.sh` file.
 3. Define your function with a usage comment.
 4. Run `chezmoi apply`.
 
 ## Performance
+
 - **Lazy Loading**: Heavy tools (like `nvm`, `rbenv`) are lazy-loaded. They only initialize when you type the command.
 - **Zcompile**: Your `.zshrc` and generated config files are automatically compiled to `.zwc` bytecode for faster parsing.
 - **Fast Mode**: Set `DOTFILES_FAST=1` to skip heavy startup work (plugins, completions, prompt tooling, AI helpers) for the quickest possible first prompt.
@@ -264,4 +280,5 @@ Available themes:
 - **Deferred Hooks**: Use `DOTFILES_DEFER_COMPINIT=1`, `DOTFILES_DEFER_TOOLS=1`, and `DOTFILES_DEFER_ZINIT_MODE=preexec` to move work after the first command.
 
 ## Test
+
 This repository includes GitHub Actions CI to test the configuration on macOS, Ubuntu, and Windows for every Pull Request.

package/dot_config/starship.toml.tmpl

@@ -5,8 +5,8 @@
 # Raise timeout to avoid spurious prompt warnings.
 command_timeout = 5000
 add_newline = true
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end }}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end }}
 # Palette driven by starship_palette in .chezmoidata/themes.toml
 palette = "{{ $t.app.starship_palette }}"
 

package/dot_config/tmux/tmux.conf.tmpl

@@ -1,5 +1,5 @@
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end -}}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end -}}
 {{- $bg := $t.term.bg -}}
 {{- $fg := $t.term.fg -}}
 {{- $accent := $t.ui.accent -}}
@@ -141,7 +141,7 @@ bind K confirm-before -p "kill all sessions? (y/n)" kill-server
 
 # ╔══════════════════════════════════════════════════════════════════════════╗
 # ║  THEME — Powerline Status Bar                                           ║
-# ║  Colors from .chezmoidata/themes.toml ({{ default "macos-monterey-dark" .theme }})  ║
+# ║  Colors from .chezmoidata/themes.toml ({{ default "big-sur-dark" .theme }})  ║
 # ╚══════════════════════════════════════════════════════════════════════════╝
 
 # --- Status Bar ---

package/dot_config/user-dirs.dirs

@@ -7,3 +7,4 @@ XDG_PICTURES_DIR="$HOME/Pictures"
 XDG_VIDEOS_DIR="$HOME/Videos"
 XDG_TEMPLATES_DIR="$HOME/Templates"
 XDG_PUBLICSHARE_DIR="$HOME/Public"
+XDG_PROJECTS_DIR="$HOME/Projects"

package/dot_config/vscode/settings.json.tmpl

@@ -1,7 +1,7 @@
 {
   // Theme Configuration - Dynamically set based on chezmoi theme variable
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end }}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end }}
   "workbench.colorTheme": "{{ $t.app.vscode }}",
   "workbench.preferredDarkColorTheme": "{{ $t.app.vscode_dark }}",
   "workbench.preferredLightColorTheme": "{{ $t.app.vscode_light }}",

package/dot_config/waybar/config.jsonc.tmpl

@@ -1,5 +1,5 @@
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end -}}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end -}}
 {{- /* Copyright (c) 2015-2026 Dotfiles. All rights reserved. */ -}}
 // Waybar configuration for niri — {{ .theme }}
 // Generated by chezmoi · dotfiles v{{ .dotfiles_version }}

package/dot_config/waybar/style.css.tmpl

@@ -1,5 +1,5 @@
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end -}}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end -}}
 {{- /* Copyright (c) 2015-2026 Dotfiles. All rights reserved. */ -}}
 {{- $bg := $t.term.bg -}}
 {{- $fg := $t.term.fg -}}

package/dot_config/wezterm/wezterm.lua.tmpl

@@ -7,10 +7,10 @@ end
 
 {{- $fontFamily := default "JetBrainsMono Nerd Font" .terminal_font_family -}}
 {{- $fontSize := default 12 .terminal_font_size -}}
-{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
-{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end }}
+{{- $t := index .themes (default "big-sur-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "big-sur-dark" -}}{{- end }}
 {{- $tt := $t -}}
-{{- $themeName := default "macos-monterey-dark" .theme -}}
+{{- $themeName := default "big-sur-dark" .theme -}}
 {{- if hasSuffix "-light" $themeName -}}
   {{- $darkTheme := index .themes (printf "%s-dark" (trimSuffix "-light" $themeName)) -}}
   {{- if $darkTheme -}}{{- $tt = $darkTheme -}}{{- end -}}

package/dot_config/zsh/dot_zshrc.tmpl

@@ -28,7 +28,7 @@ export FORCE_COLOR_OS="Windows"
 
 {{- $profile := default "laptop" .profile -}}
 {{- $features := default (dict "zsh" true "nvim" true "tmux" true "gui" true "secrets" true) .features -}}
-{{- $theme := default "macos-monterey-dark" .theme -}}
+{{- $theme := default "big-sur-dark" .theme -}}
 {{- $strict_mode := default false (index . "strict_mode") -}}
 {{- $enabled := list -}}
 {{- range $k, $v := $features }}{{- if $v }}{{- $enabled = append $enabled $k }}{{- end }}{{- end }}
@@ -108,27 +108,189 @@ fi
 _SHELL_CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/zsh"
 [[ -d "$_SHELL_CACHE" ]] || mkdir -p "$_SHELL_CACHE"
 
+# Append a timing event to ${XDG_STATE_HOME:-~/.local/state}/dotfiles/eval-timings.jsonl.
+# Read by `dot perf --by-tool` to attribute startup time per tool.
+_cached_eval_log_timing() {
+  emulate -L zsh
+  setopt no_clobber 2>/dev/null && unsetopt no_clobber
+  local label="$1" t0="$2" t1="$3" rc="${4:-0}" shell="${5:-zsh}"
+  local log_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles"
+  [[ -d "$log_dir" ]] || mkdir -p "$log_dir" 2>/dev/null || return 0
+  local logfile="$log_dir/eval-timings.jsonl"
+  [[ -f "$logfile" ]] || touch "$logfile" 2>/dev/null || return 0
+  local ms_int=0
+  if [[ -n "$t0" && -n "$t1" ]]; then
+    ms_int=$(printf '%.0f' "$(( (t1 - t0) * 1000 ))" 2>/dev/null) || ms_int=0
+  fi
+  printf '{"ts":"%s","shell":"%s","label":"%s","ms":%s,"rc":%s}\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$shell" "$label" "$ms_int" "$rc" \
+    >> "$logfile" 2>/dev/null || true
+}
+
+# Cache and source a tool's init output, with mtime/realpath/file-arg invalidation.
+#
+# Runs <cmd args...> on cache miss, vets the output for shell-injection
+# patterns, writes atomically, sources, and precompiles via zcompile in
+# the background. Cache invalidates when the binary's mtime is newer,
+# its realpath has changed (PATH-shadow swap), or a file-path argument
+# is newer than the cache.
+#
+# @arg $1 string Cache label (cache file: $_SHELL_CACHE/<label>.zsh)
+# @arg $2..N string Command and args to run on cache miss
+# @env EVALCACHE_DISABLE Set to "true" to bypass cache read AND write
+# @env EVALCACHE_TIMING  Set to "1" to log per-call timing for `dot perf --by-tool`
+# @stdout Sourced cache content
+# @stderr Warning on init failure or suspicious-output rejection
+# @exitcode 0 Cache hit, successful regeneration, or successful bypass
+# @exitcode 1 Suspicious pattern detected in init output
+# @exitcode * Init command's exit code on non-zero return
 _cached_eval() {
+  if [[ "$EVALCACHE_TIMING" != "1" ]]; then
+    _cached_eval_impl "$@"
+    return
+  fi
+  zmodload zsh/datetime 2>/dev/null
+  local _ce_t0="${EPOCHREALTIME:-$(date +%s.%N 2>/dev/null || echo 0)}"
+  _cached_eval_impl "$@"
+  local _ce_rc=$?
+  local _ce_t1="${EPOCHREALTIME:-$(date +%s.%N 2>/dev/null || echo 0)}"
+  _cached_eval_log_timing "${1:-unknown}" "$_ce_t0" "$_ce_t1" "$_ce_rc" "zsh"
+  return $_ce_rc
+}
+
+_cached_eval_impl() {
   local label=$1; shift
+
+  # Debug bypass: skip cache read AND write entirely.
+  # Set EVALCACHE_DISABLE=true to eval directly without touching cache files.
+  if [[ "$EVALCACHE_DISABLE" == "true" ]]; then
+    eval "$("$@" 2>/dev/null)"
+    return $?
+  fi
+
   local cache="$_SHELL_CACHE/${label}.zsh"
+  local pin="${cache}.bin"
   local bin="${commands[$1]}"
-  if [[ -f "$cache" ]] && [[ -z "$bin" || "$cache" -nt "$bin" ]]; then
-    source "$cache"
-  else
-    local init_output
-    local suspicious_re
-    init_output=$("$@" 2>/dev/null)
-    suspicious_re='(curl[[:space:]].*\|[[:space:]]*(ba)?sh|wget[[:space:]].*\|[[:space:]]*(ba)?sh|nc[[:space:]]+-e|/dev/tcp/|base64[[:space:]]+-d[[:space:]]*\|)'
-    # Reject suspicious patterns indicating malicious payloads
-    if printf '%s\n' "$init_output" | LC_ALL=C grep -Eqs -- "$suspicious_re"; then
-      print -u2 "[WARN] Suspicious output from $label init, skipping"
-      return 1
-    fi
-    print -r -- "$init_output" > "${cache}.tmp.$$"
-    mv "${cache}.tmp.$$" "$cache"
+  local real_bin=""
+  [[ -n "$bin" ]] && real_bin=${bin:A}
+
+  # Cache is valid when: it exists non-empty, the binary is not newer than it,
+  # the recorded realpath (if any) still matches the current realpath, and no
+  # file-path argument has been modified since cache write.
+  local cache_valid=1
+  if [[ ! -s "$cache" ]]; then
+    cache_valid=0
+  elif [[ -n "$bin" && "$bin" -nt "$cache" ]]; then
+    cache_valid=0
+  elif [[ -f "$pin" && -n "$real_bin" ]]; then
+    local pinned_real
+    pinned_real=$(<"$pin")
+    [[ -n "$pinned_real" && "$pinned_real" != "$real_bin" ]] && cache_valid=0
+  fi
+  if (( cache_valid )); then
+    local arg
+    for arg in "${@:2}"; do
+      if [[ -f "$arg" && "$arg" -nt "$cache" ]]; then
+        cache_valid=0
+        break
+      fi
+    done
+  fi
+
+  if (( cache_valid )); then
     source "$cache"
-    { zcompile "$cache" } &!
+    return
+  fi
+
+  local init_output rc
+  init_output=$("$@" 2>/dev/null)
+  rc=$?
+  if (( rc != 0 )); then
+    print -u2 "[WARN] $label init exited $rc; not caching"
+    return $rc
   fi
+
+  # Reject suspicious patterns indicating malicious payloads
+  local suspicious_re='(curl[[:space:]].*\|[[:space:]]*(ba)?sh|wget[[:space:]].*\|[[:space:]]*(ba)?sh|nc[[:space:]]+-e|/dev/tcp/|base64[[:space:]]+-d[[:space:]]*\|)'
+  if printf '%s\n' "$init_output" | LC_ALL=C grep -Eqs -- "$suspicious_re"; then
+    print -u2 "[WARN] Suspicious output from $label init, skipping"
+    return 1
+  fi
+
+  # `mktemp` instead of `${cache}.tmp.$$` — under PID recycling (very
+  # rare but possible) two concurrent shells with the same $$ could
+  # otherwise race on the same temp file. mktemp gives a unique name.
+  # Use `>|` so we overwrite the just-created mktemp file even when the
+  # user has `setopt noclobber` (see dot_config/shell/05-core-safety.sh).
+  local _tmp _tmp_pin
+  _tmp="$(mktemp "${cache}.XXXXXX")" || return 1
+  print -r -- "$init_output" >| "$_tmp" && mv "$_tmp" "$cache" || { rm -f "$_tmp"; return 1; }
+  if [[ -n "$real_bin" ]]; then
+    _tmp_pin="$(mktemp "${pin}.XXXXXX")" || return 1
+    print -r -- "$real_bin" >| "$_tmp_pin" && mv "$_tmp_pin" "$pin" || { rm -f "$_tmp_pin"; return 1; }
+  fi
+  source "$cache"
+  { zcompile "$cache" } &!
+}
+
+# Clear cache files written by _cached_eval.
+#
+# Safe by design: only deletes *.zsh / *.zsh.bin / *.zwc files in
+# $_SHELL_CACHE, leaving any unrelated content untouched.
+#
+# @noargs
+# @stdout Single-line summary: "Cleared N cached eval file(s) from <dir>"
+# @exitcode 0 Always (no-op when cache dir doesn't exist)
+_cached_eval_clear() {
+  local cache_dir="$_SHELL_CACHE"
+  [[ -d "$cache_dir" ]] || return 0
+  local count=0 f
+  for f in "$cache_dir"/*.zsh(N) "$cache_dir"/*.zsh.bin(N) "$cache_dir"/*.zwc(N); do
+    rm -f -- "$f" && (( count++ ))
+  done
+  printf 'Cleared %d cached eval file(s) from %s\n' "$count" "$cache_dir"
+}
+
+# Lazy-load helper for user-supplied slow tools.
+#
+# Usage in ~/.config/zsh/rc.d/99-local.zsh:
+#   _dot_lazy nvm nvm node npm npx               # nvm.sh sourced on first nvm/node/npm/npx call
+#   _dot_lazy pyenv pyenv python python3 pip pip3
+#   _dot_lazy conda conda
+#
+# First arg is the "trigger" — also the function name that bootstraps
+# the real tool. Remaining args are the commands that, when invoked,
+# bootstrap the trigger then re-exec the command. Bootstrap functions
+# must export `_DOT_LAZY_<TRIGGER>_LOADED` so subsequent calls bypass
+# the stub.
+#
+# Why this matters: every `eval "$(slowtool init zsh)"` at startup
+# costs 50-200ms; lazy-load defers that to first use, keeping
+# `dot version` cold-start under 100ms.
+_dot_lazy() {
+  local trigger="$1"; shift || return 1
+  local cmd
+  for cmd in "$trigger" "$@"; do
+    # shellcheck disable=SC2139,SC2140
+    eval "$cmd() {
+      local _trigger=\"$trigger\"
+      local _loaded_var=\"_DOT_LAZY_\${(U)_trigger//[^A-Z0-9]/_}_LOADED\"
+      if [[ -z \${(P)_loaded_var} ]]; then
+        # Unset every stub so the real binary takes over.
+        local _c
+        for _c in \"$trigger\" $@; do
+          unset -f -- \"\$_c\" 2>/dev/null
+        done
+        # User must define a __dot_lazy_init_<trigger> bootstrap.
+        local _init=\"__dot_lazy_init_\${_trigger//-/_}\"
+        if (( \${+functions[\$_init]} )); then
+          \"\$_init\" || return \$?
+        fi
+        export \"\$_loaded_var=1\"
+      fi
+      command \"$cmd\" \"\$@\"
+    }"
+  done
 }
 
 # Lightweight precmd hook manager (faster than add-zsh-hook)
@@ -259,6 +421,23 @@ unset _core_layers
 # Starship prompt (eager — must survive cache clears for consistent UI)
 if [[ "$DOTFILES_ARTIFACT_MODE" != "1" ]] && (( ${+commands[starship]} )); then
   _cached_eval starship-init starship init zsh
+  # Transient Prompt: collapse the prompt of past commands to the
+  # [character] glyph after Enter, reducing scrollback noise.
+  #
+  # Forward-compatibility hook. Starship's `enable_transience` function
+  # is currently defined only by `starship init fish` (upstream issue
+  # starship/starship#3522 tracks the zsh equivalent). On zsh the
+  # `${+functions[enable_transience]}` guard evaluates to 0, so the
+  # block silently no-ops. When upstream ships the zsh-side function,
+  # this code activates automatically — no zshrc change needed.
+  #
+  # The `_DOTFILES_STARSHIP_TRANSIENT` flag prevents the lazy-hydration
+  # path below (which also re-runs starship init) from binding the
+  # widgets twice.
+  if [[ -z "${_DOTFILES_STARSHIP_TRANSIENT:-}" ]] && (( ${+functions[enable_transience]} )); then
+    enable_transience
+    _DOTFILES_STARSHIP_TRANSIENT=1
+  fi
 fi
 
 # User-local modules (aliases, functions — not managed by chezmoi)
@@ -458,7 +637,13 @@ _dotfiles_async_init() {
           _cached_eval atuin-init atuin init zsh
           ;;
         starship)
-          [[ "$DOTFILES_ARTIFACT_MODE" == "0" ]] && _cached_eval starship-init starship init zsh
+          if [[ "$DOTFILES_ARTIFACT_MODE" == "0" ]]; then
+            _cached_eval starship-init starship init zsh
+            if [[ -z "${_DOTFILES_STARSHIP_TRANSIENT:-}" ]] && (( ${+functions[enable_transience]} )); then
+              enable_transience
+              _DOTFILES_STARSHIP_TRANSIENT=1
+            fi
+          fi
           ;;
         zoxide)
           _cached_eval zoxide-init zoxide init zsh
@@ -466,6 +651,11 @@ _dotfiles_async_init() {
       esac
     fi
   done
+  # mise/atuin/etc emit `export PATH=...` which bypasses zsh's -U flag on
+  # the `path` array — re-apply uniqueness to drop any duplicates baked
+  # into the cached output (e.g. system paths inherited from a dirty
+  # parent shell).
+  typeset -U path
 }
 
 # Deferred Hydration for Zero-Jank Experience

package/dot_config/zsh/rc.d/00-alias-shims.zsh

@@ -1,13 +1,35 @@
 # shellcheck shell=bash
 # Cognitive Shell Enhancements
+#
+# Carapace is deferred to first `preexec` (closes #862). The eager
+# `_cached_eval carapace ...` call previously cost ~15ms on every
+# interactive shell start even with the cache warm — that work is
+# only needed when the user invokes tab-completion, which happens
+# after the first command at the earliest. Opt out by setting
+# `DOTFILES_DEFER_CARAPACE=0` (rarely useful).
 if [[ -o interactive ]]; then
-  # Carapace completions — cached to avoid subshell on every startup
-  if command -v carapace >/dev/null 2>&1; then
-    if typeset -f _cached_eval >/dev/null 2>&1; then
-      _cached_eval carapace carapace _carapace zsh
-    else
-      source <(carapace _zsh)
+  : ${DOTFILES_DEFER_CARAPACE:=1}
+
+  _dotfiles_carapace_init() {
+    if command -v carapace >/dev/null 2>&1; then
+      if typeset -f _cached_eval >/dev/null 2>&1; then
+        _cached_eval carapace carapace _carapace zsh
+      else
+        source <(carapace _zsh)
+      fi
     fi
+  }
+
+  if [[ "${DOTFILES_DEFER_CARAPACE}" == "1" ]] && typeset -f _dotfiles_add_preexec >/dev/null 2>&1; then
+    _dotfiles_carapace_deferred() {
+      _dotfiles_del_preexec _dotfiles_carapace_deferred
+      _dotfiles_carapace_init
+    }
+    _dotfiles_add_preexec _dotfiles_carapace_deferred
+  else
+    # Fallback to eager init when preexec helpers aren't available
+    # (e.g., DOTFILES_FAST=1 paths that skip the zshrc helper block).
+    _dotfiles_carapace_init
   fi
 
   # thefuck — lazy-loaded to avoid ~200ms startup penalty