[ZSH] Note update has happened

Keep the server entrypoint focused on server policy while moving update checks, Antidote loading, interactive defaults, and prompt sourcing into reusable modules.

.gitignore_global

@@ -24,3 +24,5 @@ __MACOSX/
 .disk_label*
 lost+found
 .nobackup
+
+**/.claude/settings.local.json

AGENTS.md

@@ -0,0 +1,37 @@
+# AGENTS.md
+
+This file provides guidance to AI Agents when working with code in this repository.
+
+This is a personal dotfiles repository targeting macOS (Apple Silicon + Intel) and Arch Linux. It is installed by symlinking config directories/files from the repo into `$HOME`, so files here are live configs — editing them changes the running system.
+
+## Installation & setup
+
+Setup is platform-specific and runs from the repo root:
+
+- **macOS:** `./setup_mac.sh` — brews dependencies, creates a `neovim` virtualenv, then calls `./clone_and_link_mac.sh`. Uses GNU coreutils' `gln` (not `ln`), so coreutils must be installed first.
+- **Arch:** `./setup_arch.sh` — pacman deps, then `./clone_and_link.sh` + `./copy_fonts_arch.sh`.
+- `clone_and_link*.sh` create the symlinks (`~/.zsh`, `~/.zshrc`, `~/.tmux`, `~/.tmux.conf`, `~/.config/nvim`, `~/.config/alacritty`, virtualenvwrapper hooks). `link_config.sh` is a simpler standalone variant.
+- `general_setup.sh` switches the login shell to zsh and triggers plugin installs.
+
+## Platform-specific config via `.example` templates
+
+The most important repo-wide convention: platform variants live as `.example` files and the active file is a symlink/copy produced at setup time. The setup scripts loop over files matching `zsh/.*_mac.example`, `tmux/.*_arch.example`, etc., and link/copy each to the name with the `_<platform>.example` suffix stripped.
+
+Practical rule: **edit the `.example` source, not the generated symlink target.** The unsuffixed active files are git-ignored (see each subdir's `.gitignore`). Templates that are copied (not symlinked) at setup — `nvim/scheme.vim.template` → `scheme.vim`, `.config/alacritty/schemes.yml.template` → `schemes.yml` — are also git-ignored once activated.
+
+## Component architecture
+
+- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
+- **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
+- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
+- **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
+- **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
+
+## Light/dark theme switching
+
+`.config/alacritty/color_switcher.py` toggles light/dark across the terminal **and** nvim in one shot: it rewrites the `import` line in `alacritty.toml` (`solarized_light.toml` ↔ `dark_mode.toml`) and the `background`/`colorscheme` lines in `~/.config/nvim/scheme.vim`. Keep the regex-matched line formats in those files intact when editing them by hand. `screenshot_mode.py` is a related toggle.
+
+## Maintenance
+
+- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also runs `claude --update` and `Codex --update`.
+- `brew_autoupdate` — sets up scheduled brew auto-updates.

CLAUDE.md

@@ -1,37 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-This is a personal dotfiles repository targeting macOS (Apple Silicon + Intel) and Arch Linux. It is installed by symlinking config directories/files from the repo into `$HOME`, so files here are live configs — editing them changes the running system.
-
-## Installation & setup
-
-Setup is platform-specific and runs from the repo root:
-
-- **macOS:** `./setup_mac.sh` — brews dependencies, creates a `neovim` virtualenv, then calls `./clone_and_link_mac.sh`. Uses GNU coreutils' `gln` (not `ln`), so coreutils must be installed first.
-- **Arch:** `./setup_arch.sh` — pacman deps, then `./clone_and_link.sh` + `./copy_fonts_arch.sh`.
-- `clone_and_link*.sh` create the symlinks (`~/.zsh`, `~/.zshrc`, `~/.tmux`, `~/.tmux.conf`, `~/.config/nvim`, `~/.config/alacritty`, virtualenvwrapper hooks). `link_config.sh` is a simpler standalone variant.
-- `general_setup.sh` switches the login shell to zsh and triggers plugin installs.
-
-## Platform-specific config via `.example` templates
-
-The most important repo-wide convention: platform variants live as `.example` files and the active file is a symlink/copy produced at setup time. The setup scripts loop over files matching `zsh/.*_mac.example`, `tmux/.*_arch.example`, etc., and link/copy each to the name with the `_<platform>.example` suffix stripped.
-
-Practical rule: **edit the `.example` source, not the generated symlink target.** The unsuffixed active files are git-ignored (see each subdir's `.gitignore`). Templates that are copied (not symlinked) at setup — `nvim/scheme.vim.template` → `scheme.vim`, `.config/alacritty/schemes.yml.template` → `schemes.yml` — are also git-ignored once activated.
-
-## Component architecture
-
-- **zsh** (`zsh/.zshrc`): Powerlevel10k instant prompt + [antidote](https://github.com/mattmc3/antidote) plugin manager (plugin list in `zsh/.zsh_plugins.txt`). `.zshrc` sources optional layered configs if present: `.powerline_config`, `.user_config`, `.virtual_env_config.zsh`, `.mac_config.zsh`, `.local_config`. `update_dotfiles()` auto-`git pull`s this repo in the background on every shell start. Machine-local overrides belong in `.local_config` (not committed).
-- **nvim** (`nvim/init.vim`): [vim-plug](https://github.com/junegunn/vim-plug), auto-bootstrapped on first launch (`:PlugInstall`). Python provider points at the `~/python-envs/neovim` virtualenv on Apple Silicon. `colors/` holds a large bundled colorscheme collection.
-- **tmux** (`tmux/.tmux.conf`): TPM-style `plugins/`. `tmux/tmux_attach.sh` is an attach helper.
-- **alacritty** (`.config/alacritty/`): active theme selected via the `import = [...]` line in `alacritty.toml`.
-- **gitconfig** (`gitconfig/gitconfig`): identity/behavior split by remote host using `includeIf "hasconfig:remote.*.url:..."` — `github`, `fhms` (fh-muenster), `murgi`, and `sit` (Fraunhofer) each load their own `*.gitconfig`. Change per-context email/signing in the matching include file, not the base config.
-
-## Light/dark theme switching
-
-`.config/alacritty/color_switcher.py` toggles light/dark across the terminal **and** nvim in one shot: it rewrites the `import` line in `alacritty.toml` (`solarized_light.toml` ↔ `dark_mode.toml`) and the `background`/`colorscheme` lines in `~/.config/nvim/scheme.vim`. Keep the regex-matched line formats in those files intact when editing them by hand. `screenshot_mode.py` is a related toggle.
-
-## Maintenance
-
-- `./update_mac.sh` — macOS update runner. Default (no args) runs `--brew-update --cleanup --diagnostics --update-others`; other flags: `--system-update`, `--permission-fix` (strips Caskroom/App quarantine xattrs). Run `./update_mac.sh --help` for the list. `--update-others` also runs `claude --update`.
-- `brew_autoupdate` — sets up scheduled brew auto-updates.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

nvim/ftplugin/tex.vim

@@ -1,4 +1,4 @@
-set formatoptions+=1rnmBa
+setlocal formatoptions+=1rnmBj
 
 " Reformat lines (getting the spacing correct) {{{
 fun! TeX_fmt()

tmux/.tmux.conf

@@ -27,8 +27,19 @@ bind -T off F12 \
 setw -g mode-keys vi
 set-option -g status-keys vi
 
-bind | split-window -h -c '#{pane_current_path}'
+# Splits keep the source pane's cwd AND its active Python venv. #{@venv} is set
-bind - split-window -v -c '#{pane_current_path}'
+# per-pane by the shell (see .virtual_env_config.zsh); we go through run-shell
+# because tmux expands FORMATS in a run-shell command but NOT in split-window's
+# own -e value. The new pane inherits VIRTUAL_ENV and .zshrc re-activates it;
+# when the source pane has no venv we omit -e so no empty var leaks in. New
+# *windows* deliberately don't inherit it.
+bind | run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -h -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -h -c "$d"; fi'
+bind - run-shell 'v="#{@venv}"; d="#{pane_current_path}"; if [ -n "$v" ]; then tmux split-window -v -c "$d" -e VIRTUAL_ENV="$v"; else tmux split-window -v -c "$d"; fi'
+
+# New windows always start in the base environment: -e clears any inherited
+# VIRTUAL_ENV (e.g. if the tmux server was first started from inside a venv, so
+# its global env carries one), regardless of what the source pane had.
+bind c new-window -e VIRTUAL_ENV=
 
 # Switch windows
 bind-key -n M-Left select-window -t -1

update_mac.sh

@@ -59,6 +59,11 @@ function update_others {
         echo "-- CLAUDE"
         claude --update
     fi
+
+    if [ -x "$(command -v codex)" ]; then
+        echo "-- CODEX"
+        codex update
+    fi
 }
 
 if [[ $* == *--help* ]]; then

zsh/.mac_config.zsh_mac.example

@@ -8,11 +8,11 @@ defaults write .GlobalPreferences AppleLocale en_DE
 
 ARCH=`uname -m`
 if [[ $ARCH == "arm64" ]]; then
-    HOMEBREWPREFIX="/opt/homebrew"
+    export HOMEBREW_PREFIX="/opt/homebrew"
 else
-    HOMEBREWPREFIX="/usr/local"
+    export HOMEBREW_PREFIX="/usr/local"
 fi
-export PATH="$HOMEBREWPREFIX/opt/coreutils/libexec/gnubin:$HOME/.local/bin:$HOMEBREWPREFIX/bin:$PATH:$HOMEBREWPREFIX/sbin"
+export PATH="$HOMEBREW_PREFIX/opt/coreutils/libexec/gnubin:$HOME/.local/bin:$HOMEBREW_PREFIX/bin:$PATH:$HOMEBREW_PREFIX/sbin"
 
 # test -e "${HOME}/.iterm2_shell_integration.zsh" && source "${HOME}/.iterm2_shell_integration.zsh"
 
@@ -27,6 +27,12 @@ if [ -f "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER" ]; then
   source "$HOMEBREW_COMMAND_NOT_FOUND_HANDLER";
 fi
 
-export DYLD_FALLBACK_LIBRARY_PATH="$HOMEBREW_PREFIX/lib:${DYLD_FALLBACK_LIBRARY_PATH}"
+export DYLD_FALLBACK_LIBRARY_PATH="$HOMEBREW_PREFIX/lib${DYLD_FALLBACK_LIBRARY_PATH:+:$DYLD_FALLBACK_LIBRARY_PATH}"
-export GI_TYPELIB_PATH="$HOMEBREW_PREFIX/lib/girepository-1.0:${GI_TYPELIB_PATH}"
+export GI_TYPELIB_PATH="$HOMEBREW_PREFIX/lib/girepository-1.0${GI_TYPELIB_PATH:+:$GI_TYPELIB_PATH}"
-export PKG_CONFIG_PATH="$HOMEBREW_PREFIX/lib/pkgconfig:$HOMEBREW_PREFIX/share/pkgconfig:${PKG_CONFIG_PATH}"
+export PKG_CONFIG_PATH="$HOMEBREW_PREFIX/lib/pkgconfig:$HOMEBREW_PREFIX/share/pkgconfig${PKG_CONFIG_PATH:+:$PKG_CONFIG_PATH}"
+alias claude="workon claude; claude; deactivate"
+alias python="python3"
+
+# Tahoe 26 WindowServer bug: windows stay interactive but can't be moved by
+# mouse or API until the window-management daemon is restarted (no logout).
+alias unstick-windows="killall WindowManager"

zsh/.virtual_env_config.zsh_mac.example

@@ -10,6 +10,20 @@ export VIRTUALENVWRAPPER_VIRTUALENV=$PREFIX/bin/virtualenv
 mkdir -p $WORKON_HOME
 source $PREFIX/bin/virtualenvwrapper.sh
 
-if [ -n "$VIRTUAL_ENV" ] && [[ -f "$VIRTUAL_ENV/bin/activate" ]]; then
+# NOTE: an inherited VIRTUAL_ENV is *not* re-activated here — that happens at the
-      source $VIRTUAL_ENV/bin/activate;
+# very end of .zshrc so activate captures the fully-built PATH (see the comment
-fi
+# there). Sourcing virtualenvwrapper.sh above only defines workon/deactivate/etc.
+
+# Mirror the current venv into a per-pane tmux option so that splitting a pane
+# can carry it into the new pane (.tmux.conf reads #{@venv} with `-e`). Per-pane
+# (not session) state is what lets two panes hold different venvs and lets new
+# *windows* start clean. Only fork tmux when the value actually changes.
+_venv_track_precmd() {
+    [[ -n $TMUX ]] || return
+    if [[ "${VIRTUAL_ENV:-}" != "${_LAST_TRACKED_VENV-unset}" ]]; then
+        tmux set -p @venv "${VIRTUAL_ENV:-}" 2>/dev/null
+        _LAST_TRACKED_VENV="${VIRTUAL_ENV:-}"
+    fi
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd _venv_track_precmd

zsh/.zshrc

@@ -1,134 +1,72 @@
-# Enable Powerlevel10k instant prompt. Should stay close to the top of ~/.zshrc.
+# Powerlevel10k instant prompt and machine-local layers must remain first.
-# Initialization code that may require console input (password prompts, [y/n]
-# confirmations, etc.) must go above this block; everything else may go below.
 [[ -f ~/.zsh/.powerline_config ]] && source ~/.zsh/.powerline_config
 [[ -f ~/.zsh/.user_config ]] && source ~/.zsh/.user_config
 [[ -f ~/.zsh/.virtual_env_config.zsh ]] && source ~/.zsh/.virtual_env_config.zsh
 [[ -f ~/.zsh/.local_config ]] && source ~/.zsh/.local_config
 
-# On shell start, bring ~/dotfiles up to date by fast-forwarding the CURRENT
+source "${ZDOTDIR:-$HOME}/.zsh/lib/updates.zsh"
-# branch to its upstream only. Never rebase or stash in the background: if the
-# branch diverged or local edits block it, warn and leave it for a manual pull.
-# Per-branch, so `server` on each device fast-forwards to origin/server.
-update_dotfiles() {
-    local repo="$HOME/dotfiles"
-    git -C "$repo" fetch --quiet 2>/dev/null || return
-    git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return    # no upstream
-    git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return # already current
-    git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null \
-        || print -u2 "⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
-}
-
-update_dotfiles &!
 export LC_OSC52=1
 
-# Load Antidote
+plugins_txt=${ZDOTDIR:-$HOME}/.zsh/.zsh_plugins.txt
-mkdir -p ${ZDOTDIR:-~}/.cache/zsh
+static_file=${ZDOTDIR:-$HOME}/.cache/zsh/.zsh_plugins.zsh
-static_file=${ZDOTDIR:-~}/.cache/zsh/.zsh_plugins.zsh
+source "${ZDOTDIR:-$HOME}/.zsh/lib/antidote.zsh"
-plugins_txt=${ZDOTDIR:-~}/.zsh/.zsh_plugins.txt
+source "${ZDOTDIR:-$HOME}/.zsh/lib/interactive.zsh"
-# clone antidote if necessary
-if ! [[ -e ${ZDOTDIR:-~}/.antidote ]]; then
-  git clone https://github.com/mattmc3/antidote.git ${ZDOTDIR:-~}/.antidote
-fi
 
-zstyle ':completion:*:ssh:*' hosts off
+bindkey '^w' kill-region
-zstyle ':completion:*:scp:*' hosts off
-
-# Run rehash for external commands
-zstyle ":completion:*:commands" rehash 1
-# source antidote and load plugins from `${ZDOTDIR:-~}/.zsh_plugins.txt`
-source ${ZDOTDIR:-~}/.antidote/antidote.zsh
-antidote load ${plugins_txt} ${static_file}
-
-setopt interactivecomments
-
-# History options
-HISTSIZE=100000                  # Set the amount of lines you want saved
-SAVEHIST=100000                  # This is required to actually save them, needs to match with HISTSIZE
-setopt EXTENDED_HISTORY          # Write the history file in the ":start:elapsed;command" format.
-setopt INC_APPEND_HISTORY        # Write to the history file immediately, not when the shell exits.
-setopt SHARE_HISTORY             # Share history between all sessions.
-setopt HIST_EXPIRE_DUPS_FIRST    # Expire duplicate entries first when trimming history.
-setopt HIST_IGNORE_DUPS          # Don\'t record an entry that was just recorded again.
-setopt HIST_IGNORE_ALL_DUPS      # Delete old recorded entry if new entry is a duplicate.
-setopt HIST_FIND_NO_DUPS         # Do not display a line previously found.
-setopt HIST_IGNORE_SPACE         # Don\'t record an entry starting with a space.
-setopt HIST_SAVE_NO_DUPS         # Don\'t write duplicate entries in the history file.
-setopt HIST_REDUCE_BLANKS        # Remove superfluous blanks before recording entry.
-# Clear screen by ctrl+q
-bindkey '^q' clear-screen
-
-# Bind Ctrl-W to kill-region
-bindkey "^w" kill-region
 bindkey -v
 VI_MODE_SET_CURSOR=true
 
-alias vim=nvim
-alias sudo='sudo '
-export EDITOR='nvim'
-export VISUAL='nvim'
-
-alias ls="ls --color=always"
-alias cgrep="grep --color=always"
-
-delzip() {
-   unzip -Z -1 "$@" |  xargs -I{} rm -rf {}
-}
-# mitmproxy
-export MITMPROXY_SSLKEYLOGFILE="~/.mitmproxy/sslkeylogfile.txt"
-
 [[ -f ~/.zsh/.mac_config.zsh ]] && source ~/.zsh/.mac_config.zsh
-if `which go &>/dev/null`; then
+if (( $+commands[go] )); then
-    export PATH="$PATH:$(go env GOPATH)/bin"
+    export GOPATH="$(go env GOPATH 2>/dev/null)"
-    export GOPATH=$(go env GOPATH)
+    [[ -n "$GOPATH" ]] && path+=("$GOPATH/bin")
 fi
 
+# Use safe wrappers after ~/.local/bin has been added to PATH.
+(( $+commands[safecp] )) && alias cp=safecp
+(( $+commands[safemv] )) && alias mv=safemv
+(( $+commands[safescp] )) && alias scp=safescp
+
 if [[ -f ~/.ssh/sudo_key ]]; then
-    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &> /dev/null
+    [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null
-    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l | grep -q `ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}'` || SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
+    SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add -l |
+        grep -q "$(ssh-keygen -lf ~/.ssh/sudo_key | awk '{print $2}')" ||
+        SSH_AUTH_SOCK=/tmp/sudo-agent.sock ssh-add ~/.ssh/sudo_key
 fi
-
-# Sudo workaround for neovim
 export SUDO_ASKPASS=$(command -v ssh-askpass)
 
-# Workaround for async issues https://github.com/romkatv/powerlevel10k/issues/1554
+if [[ -f ~/dotfiles/zsh/.p10k.mac.zsh ]]; then
-unset ZSH_AUTOSUGGEST_USE_ASYNC
+    p10k_config=~/dotfiles/zsh/.p10k.mac.zsh
-
+else
-# Fixate language
+    p10k_config=~/dotfiles/zsh/.p10k.zsh
-export LANG="en_US.UTF-8"
+fi
-export LC_CTYPE="en_US.UTF-8"
+source "${ZDOTDIR:-$HOME}/.zsh/lib/prompt.zsh"
-export TIME_STYLE="long-iso"
-
-# Powerlevel 10k
-# Remove padding on right side
-ZLE_RPROMPT_INDENT=0
-
-# To customize prompt, run `p10k configure` or edit ~/dotfiles/zsh/.p10k.zsh.
-function load_p10k() {
-    if test -f ~/dotfiles/zsh/.p10k.mac.zsh; then 
-        source ~/dotfiles/zsh/.p10k.mac.zsh
-    else
-        [[ ! -f ~/dotfiles/zsh/.p10k.zsh ]] || source ~/dotfiles/zsh/.p10k.zsh
-    fi
-}
-load_p10k
 
 alias screenshot_mode='powerlevel10k_plugin_unload; export PS1="$ "; python3 ~/.config/alacritty/screenshot_mode.py on'
 alias screenshot_mode_off='prompt_powerlevel9k_setup; python3 ~/.config/alacritty/screenshot_mode.py off'
-antidote update &> /dev/null &|
+antidote update &>/dev/null &|
 
-# This speeds up pasting w/ autosuggest
+[[ -d "$HOME/.lmstudio/bin" ]] && path+=("$HOME/.lmstudio/bin")
-# https://github.com/zsh-users/zsh-autosuggestions/issues/238
+[[ -d "$HOME/.runai/bin" ]] && path+=("$HOME/.runai/bin")
-pasteinit() {
+runai_bin="$HOME/.runai/bin/runai"
-  OLD_SELF_INSERT=${${(s.:.)widgets[self-insert]}[2,3]}
+runai_completion=${ZDOTDIR:-$HOME}/.cache/zsh/runai-completion.zsh
-  zle -N self-insert url-quote-magic # I wonder if you'd need `.url-quote-magic`?
+if [[ -x "$runai_bin" ]]; then
-}
+    if [[ ! -s "$runai_completion" || "$runai_bin" -nt "$runai_completion" ]]; then
+        runai_completion_tmp="$runai_completion.$$.tmp"
+        if "$runai_bin" --quiet completion zsh >| "$runai_completion_tmp"; then
+            command mv -f "$runai_completion_tmp" "$runai_completion"
+        else
+            command rm -f "$runai_completion_tmp"
+        fi
+    fi
+    [[ -s "$runai_completion" ]] && source "$runai_completion"
+fi
 
-pastefinish() {
+# Keep this last: activate must snapshot the fully built PATH for deactivate.
-  zle -N self-insert $OLD_SELF_INSERT
+typeset -U path PATH
-}
+[[ -z "${VIRTUAL_ENV:-}" ]] && unset VIRTUAL_ENV
-zstyle :bracketed-paste-magic paste-init pasteinit
+if [[ -n "$VIRTUAL_ENV" && -f "$VIRTUAL_ENV/bin/activate" ]]; then
-zstyle :bracketed-paste-magic paste-finish pastefinish
+    if [[ ":$PATH:" != *":$VIRTUAL_ENV/bin:"* ]]; then
-
+        source "$VIRTUAL_ENV/bin/activate"
-# https://github.com/zsh-users/zsh-autosuggestions/issues/351
+    fi
-ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)
+fi

zsh/lib/antidote.zsh

@@ -0,0 +1,12 @@
+# Callers set plugins_txt and static_file before sourcing this module.
+mkdir -p "${static_file:h}"
+if [[ ! -e ${ZDOTDIR:-$HOME}/.antidote ]]; then
+    git clone https://github.com/mattmc3/antidote.git "${ZDOTDIR:-$HOME}/.antidote"
+fi
+
+zstyle ':completion:*:ssh:*' hosts off
+zstyle ':completion:*:scp:*' hosts off
+zstyle ':completion:*:commands' rehash 1
+
+source "${ZDOTDIR:-$HOME}/.antidote/antidote.zsh"
+antidote load "$plugins_txt" "$static_file"

zsh/lib/interactive.zsh

@@ -0,0 +1,43 @@
+setopt interactivecomments
+
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY
+setopt INC_APPEND_HISTORY
+setopt SHARE_HISTORY
+setopt HIST_EXPIRE_DUPS_FIRST
+setopt HIST_IGNORE_DUPS
+setopt HIST_IGNORE_ALL_DUPS
+setopt HIST_FIND_NO_DUPS
+setopt HIST_IGNORE_SPACE
+setopt HIST_SAVE_NO_DUPS
+setopt HIST_REDUCE_BLANKS
+
+bindkey '^q' clear-screen
+(( $+commands[nvim] )) && alias vim=nvim
+(( $+commands[nvim] )) && export EDITOR=nvim VISUAL=nvim
+alias sudo='sudo '
+alias ls='ls --color=always'
+alias cgrep='grep --color=always'
+alias cdiff='git diff --color-words --no-index'
+
+delzip() {
+    unzip -Z -1 "$@" | xargs -I{} rm -rf {}
+}
+export MITMPROXY_SSLKEYLOGFILE='~/.mitmproxy/sslkeylogfile.txt'
+
+unset ZSH_AUTOSUGGEST_USE_ASYNC
+export LANG='en_US.UTF-8'
+export LC_CTYPE='en_US.UTF-8'
+export TIME_STYLE='long-iso'
+
+pasteinit() {
+    OLD_SELF_INSERT=${${(s.:.)widgets[self-insert]}[2,3]}
+    zle -N self-insert url-quote-magic
+}
+pastefinish() {
+    zle -N self-insert "$OLD_SELF_INSERT"
+}
+zstyle :bracketed-paste-magic paste-init pasteinit
+zstyle :bracketed-paste-magic paste-finish pastefinish
+ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(bracketed-paste)

zsh/lib/prompt.zsh

@@ -0,0 +1,3 @@
+# Callers select p10k_config before sourcing this module.
+ZLE_RPROMPT_INDENT=0
+[[ -z "$p10k_config" || ! -f "$p10k_config" ]] || source "$p10k_config"

zsh/lib/updates.zsh

@@ -0,0 +1,67 @@
+# Background repository maintenance shared by desktop and server shells.
+
+update_dotfiles() {
+    local repo="$HOME/dotfiles"
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/dotfiles-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 15)
+    GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+        $TO git -C "$repo" fetch --quiet </dev/null 2>/dev/null || return
+    git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return
+    git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return
+    if git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null; then
+        local notice="⬆ dotfiles updated — run: exec zsh"
+        mkdir -p "$cache_dir" || return
+        print -r -- "$notice" >| "$notice_tmp" || return
+        mv -f "$notice_tmp" "$notice_file"
+        return
+    fi
+    local notice="⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
+    mkdir -p "$cache_dir" || return
+    print -r -- "$notice" >| "$notice_tmp" || return
+    mv -f "$notice_tmp" "$notice_file"
+}
+update_dotfiles &!
+
+check_tools_repo() {
+    local repo branch remote mergeref remote_sha local_sha cmd notice
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file="$cache_dir/tools-update-notice"
+    local notice_tmp="$notice_file.$$.tmp"
+    local -a TO; (( $+commands[timeout] )) && TO=(timeout -k 5 10)
+    for repo in /opt/tools "$HOME/tools" "$HOME/tools/tools-repo"; do
+        local -a g=(git -c 'safe.directory=*' -C "$repo")
+        $g rev-parse --is-inside-work-tree >/dev/null 2>&1 || continue
+        branch=$($g symbolic-ref --short HEAD 2>/dev/null) || return
+        remote=$($g config "branch.$branch.remote" 2>/dev/null) || return
+        mergeref=$($g config "branch.$branch.merge" 2>/dev/null) || return
+        remote_sha=$(GIT_SSH_COMMAND='ssh -o BatchMode=yes -o ConnectTimeout=5 -o ControlMaster=no -o ControlPath=none' \
+            $TO $g ls-remote "$remote" "$mergeref" </dev/null 2>/dev/null | awk '{print $1}')
+        local_sha=$($g rev-parse HEAD 2>/dev/null)
+        [[ -n "$remote_sha" && -n "$local_sha" ]] || return
+        [[ "$remote_sha" == "$local_sha" ]] && return
+        $g merge-base --is-ancestor "$remote_sha" HEAD 2>/dev/null && return
+        [[ -w "$repo/.git" ]] && cmd="git -C $repo pull" || cmd="sudo git -C $repo pull"
+        notice="⬆ tools: updates available in $repo — run: $cmd"
+        mkdir -p "$cache_dir" || return
+        print -r -- "$notice" >| "$notice_tmp" || return
+        mv -f "$notice_tmp" "$notice_file"
+        return
+    done
+}
+check_tools_repo &!
+
+show_update_notices() {
+    local cache_dir="${ZDOTDIR:-$HOME}/.cache/zsh"
+    local notice_file claimed_notice
+    for notice_file in "$cache_dir"/{dotfiles,tools}-update-notice; do
+        [[ -s "$notice_file" ]] || continue
+        claimed_notice="$notice_file.$$.show"
+        mv "$notice_file" "$claimed_notice" 2>/dev/null || continue
+        command cat "$claimed_notice"
+        command rm -f "$claimed_notice"
+    done
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook precmd show_update_notices