Update Brewfile

Brewfile

@@ -24,7 +24,6 @@ brew "direnv"
 brew "dua-cli"
 brew "duck"
 brew "dust"
-brew "earthly"
 brew "espressif/eim/eim", trusted: true
 brew "esptool"
 brew "fish"

deploy_checkout.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: $(basename "$0") [--dry-run] user@host" >&2
+  exit 1
+}
+
+DRY_RUN=0
+REMOTE=
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      ;;
+    --)
+      shift
+      break
+      ;;
+    -*)
+      usage
+      ;;
+    *)
+      if [[ -n "${REMOTE}" ]]; then
+        usage
+      fi
+      REMOTE="$1"
+      shift
+      ;;
+  esac
+done
+
+if [[ $# -gt 0 || -z "${REMOTE}" ]]; then
+  usage
+fi
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+
+if ! git -C "$SCRIPT_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "Error: $SCRIPT_DIR is not inside a git repository." >&2
+  exit 1
+fi
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  archive_list="$(git -C "$SCRIPT_DIR" archive --format=tar HEAD | tar -tf - | sed 's#^\./##' | sed '/^$/d;/^\.$/d' | sort)"
+  remote_list="$(ssh "$REMOTE" 'if [ -d "$HOME/.skel" ]; then cd "$HOME/.skel" && find . | sed "s#^\./##" | sed "/^$/d;/^\.$/d" | sort; fi' || true)"
+
+  printf 'Would deploy HEAD from %s to %s:%s\n' "$SCRIPT_DIR" "$REMOTE" '$HOME/.skel'
+  printf 'Would replace remote ~/.skel with %s tracked paths\n' "$(printf '%s' "$archive_list" | awk 'NF { n++ } END { print n + 0 }')"
+  if [[ -n "$remote_list" ]]; then
+    printf 'Would remove %s existing remote paths not present in HEAD\n' "$(comm -13 <(printf '%s\n' "$archive_list") <(printf '%s\n' "$remote_list") | awk 'NF { n++ } END { print n + 0 }')"
+  else
+    printf 'Remote ~/.skel does not exist or is empty\n'
+  fi
+  exit 0
+fi
+
+git -C "$SCRIPT_DIR" archive --format=tar HEAD | \
+  ssh "$REMOTE" 'rm -rf "$HOME/.skel" && mkdir -p "$HOME/.skel" && tar -xf - -C "$HOME/.skel"'

dotfiles/profile

@@ -29,10 +29,7 @@ fi
 
 # Setup for libvirt
 if [ -z "${LIBVIRT_DEFAULT_URI:-}" ] ; then
-  if [ "$(id -u)" = "0" ] || (id -Gn 2>/dev/null | grep -q "\blibvirt\b") ; then
-    LIBVIRT_DEFAULT_URI="qemu:///system"
-    export LIBVIRT_DEFAULT_URI
-  fi
+    export LIBVIRT_DEFAULT_URI="qemu:///system"
 fi
 
 # Got rust? (gvim, etc.)

dotfiles/shenv

@@ -29,6 +29,9 @@ export WORKON_HOME="$HOME/.virtualenvs"
 # GPG full key id
 export GPG_ID=7FD58D9A196DCEEEAD671F94F4D7A7915DEA789B
 
+# Capture uname early
+_UNAME="$(uname)"
+
 # things we need in all interactive shells
 case "$-" in
   *i*)
@@ -86,7 +89,6 @@ case "$-" in
     ;;
 esac
 
-
 # Opt out of .net telemetry
 export DOTNET_CLI_TELEMETRY_OPTOUT=1
 
@@ -97,147 +99,164 @@ export LVM_SUPPRESS_FD_WARNINGS=1
 export EARTHLY_SSH_AUTH_SOCK=""
 
 # Handle SSH_AUTH_SOCK for tmux consistency
-_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
+case "$-" in
+  *i*)
+    _SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
 
-# Helper to check if a path is our link or points to it
-_is_link_path() {
-  [ -z "$1" ] && return 1
-  _target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
-  [ "$1" = "${_target}" ] && { unset -v _target; return 0; }
-  if [ -L "$1" ] && command -v readlink >/dev/null 2>&1; then
-    _T=$(readlink "$1")
-    # Handle relative symlinks
-    case "${_T}" in /*) ;; *) _T="$(dirname "$1")/${_T}" ;; esac
-    [ "${_T}" = "${_target}" ] && { unset -v _target _T; return 0; }
-    unset -v _T
-  fi
-  unset -v _target
-  return 1
-}
-
-# Helper to check if an SSH socket is valid and useful via ssh-add return codes
-_is_valid_ssh_sock() {
-  [ -z "$1" ] && return 1
-  [ -S "$1" ] || return 1
-  if command -v ssh-add >/dev/null 2>&1; then
-    SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
-    case "$?" in
-      0|1) return 0 ;;
-      *)   return 1 ;;
-    esac
-  fi
-  return 0
-}
-
-# Function to get the path to the socket for the local ssh-agent
-get_local_ssh_agent_sock() {
-  _found=""
-  if [ "$(uname)" = "Darwin" ]; then
-    _found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
-  elif command -v systemctl >/dev/null 2>&1; then
-    # Query systemd socket units directly to avoid environment overrides.
-    for _u in ssh-agent.socket openssh-agent.socket gcr-ssh-agent.socket gpg-agent-ssh.socket; do
-      _p=$(systemctl --user show "${_u}" -p Listen 2>/dev/null | cut -d= -f2- | cut -d' ' -f1)
-      if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
-        _found="${_p}"
-        break
+    # Helper to check if a path is our link or points to it
+    _is_link_path() {
+      [ -z "$1" ] && return 1
+      _target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
+      [ "$1" = "${_target}" ] && { unset -v _target; return 0; }
+      if [ -L "$1" ] && command -v readlink >/dev/null 2>&1; then
+        _T=$(readlink "$1")
+        # Handle relative symlinks
+        case "${_T}" in /*) ;; *) _T="$(dirname "$1")/${_T}" ;; esac
+        [ "${_T}" = "${_target}" ] && { unset -v _target _T; return 0; }
+        unset -v _T
       fi
-    done
-    # Fallback to systemd environment
-    if [ -z "${_found}" ] || _is_link_path "${_found}" || ! _is_valid_ssh_sock "${_found}"; then
-      _found=$(systemctl --user show-environment 2>/dev/null | grep "^SSH_AUTH_SOCK=" | cut -d= -f2-)
-    fi
-  fi
+      unset -v _target
+      return 1
+    }
 
-  if [ -n "${_found}" ] && ! _is_link_path "${_found}" && _is_valid_ssh_sock "${_found}"; then
-    echo "${_found}"
-    unset -v _found _u _p
-    return 0
-  fi
+    # Helper to check if an SSH socket is valid and useful
+    _is_valid_ssh_sock() {
+      [ -z "$1" ] && return 1
+      [ -S "$1" ] || return 1
 
-  # Search common fallback paths
-  _u=$(id -u)
-  for _p in "/run/user/${_u}/keyring/ssh" "/run/user/${_u}/ssh-agent.socket" "/run/user/${_u}/openssh_agent" "/run/user/${_u}/gnupg/S.gpg-agent.ssh"; do
-    if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
-      echo "${_p}"
-      unset -v _found _u _p
+      if command -v nc >/dev/null 2>&1; then
+        # Use nc to quickly check if the socket is listening.
+        # We use -N to shutdown the socket after EOF on stdin (for OpenBSD netcat compatibility).
+        if echo '' | nc -w 1 -N -U "$1" >/dev/null 2>&1; then
+          return 0
+        fi
+      fi
+
+      if command -v ssh-add >/dev/null 2>&1; then
+        SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
+        case "$?" in
+          0|1) return 0 ;;
+          *)   return 1 ;;
+        esac
+      fi
+
+      if command -v nc >/dev/null 2>&1; then
+        return 1
+      fi
       return 0
-    fi
-  done
+    }
 
-  # Search /run/user/UID and /tmp for agent.* sockets
-  _search=""
-  for _d in "/run/user/${_u}" /tmp; do [ -d "${_d}" ] && _search="${_search} ${_d}"; done
-  if [ -n "${_search}" ]; then
-    for _p in $(find ${_search} -maxdepth 2 -type s -name 'agent.*' 2>/dev/null); do
-      if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
-        echo "${_p}"
-        unset -v _found _u _p _search _d
+    # Function to get the path to the socket for the local ssh-agent
+    get_local_ssh_agent_sock() {
+      _found=""
+      if [ "$(uname)" = "Darwin" ]; then
+        _found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
+      elif command -v systemctl >/dev/null 2>&1; then
+        # Query systemd socket units directly to avoid environment overrides.
+        for _u in ssh-agent.socket openssh-agent.socket gcr-ssh-agent.socket gpg-agent-ssh.socket; do
+          _p=$(systemctl --user show "${_u}" -p Listen 2>/dev/null | cut -d= -f2- | cut -d' ' -f1)
+          if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
+            _found="${_p}"
+            break
+          fi
+        done
+        # Fallback to systemd environment
+        if [ -z "${_found}" ] || _is_link_path "${_found}" || ! _is_valid_ssh_sock "${_found}"; then
+          _found=$(systemctl --user show-environment 2>/dev/null | grep "^SSH_AUTH_SOCK=" | cut -d= -f2-)
+        fi
+      fi
+
+      if [ -n "${_found}" ] && ! _is_link_path "${_found}" && _is_valid_ssh_sock "${_found}"; then
+        echo "${_found}"
+        unset -v _found _u _p
         return 0
       fi
-    done
-  fi
 
-  unset -v _found _u _p _search _d
-  return 1
-}
+      # Search common fallback paths
+      _u=$(id -u)
+      for _p in "/run/user/${_u}/keyring/ssh" "/run/user/${_u}/ssh-agent.socket" "/run/user/${_u}/openssh_agent" "/run/user/${_u}/gnupg/S.gpg-agent.ssh"; do
+        if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
+          echo "${_p}"
+          unset -v _found _u _p
+          return 0
+        fi
+      done
 
-# Function to reset SSH_AUTH_SOCK to the local ssh-agent
-reset_ssh_socket() {
-  _rss_sock=$(get_local_ssh_agent_sock)
-  if [ -n "${_rss_sock}" ]; then
-    _rss_link="${HOME}/.ssh/ssh_auth_sock"
-    mkdir -p "$(dirname "${_rss_link}")"
-    ln -sf "${_rss_sock}" "${_rss_link}"
-    export SSH_AUTH_SOCK="${_rss_link}"
-    if command -v systemctl >/dev/null 2>&1; then
-      systemctl --user set-environment SSH_AUTH_SOCK="${_rss_link}" 2>/dev/null
+      # Search /run/user/UID and /tmp for agent.* sockets
+      _search=""
+      for _d in "/run/user/${_u}" /tmp; do [ -d "${_d}" ] && _search="${_search} ${_d}"; done
+      if [ -n "${_search}" ]; then
+        for _p in $(find ${_search} -maxdepth 2 -type s -name 'agent.*' 2>/dev/null); do
+          if ! _is_link_path "${_p}" && _is_valid_ssh_sock "${_p}"; then
+            echo "${_p}"
+            unset -v _found _u _p _search _d
+            return 0
+          fi
+        done
+      fi
+
+      unset -v _found _u _p _search _d
+      return 1
+    }
+
+    # Function to reset SSH_AUTH_SOCK to the local ssh-agent
+    reset_ssh_socket() {
+      _rss_sock=$(get_local_ssh_agent_sock)
+      if [ -n "${_rss_sock}" ]; then
+        _rss_link="${HOME}/.ssh/ssh_auth_sock"
+        mkdir -p "$(dirname "${_rss_link}")"
+        ln -sf "${_rss_sock}" "${_rss_link}"
+        export SSH_AUTH_SOCK="${_rss_link}"
+        if command -v systemctl >/dev/null 2>&1; then
+          systemctl --user set-environment SSH_AUTH_SOCK="${_rss_link}" 2>/dev/null
+        fi
+        echo "Reset SSH_AUTH_SOCK to ${_rss_link} -> ${_rss_sock}"
+        unset -v _rss_sock _rss_link
+        return 0
+      else
+        echo "reset_ssh_socket: no valid local ssh-agent socket found." >&2
+        unset -v _rss_sock
+        return 1
+      fi
+    }
+
+    _CANDIDATE=""
+
+    # 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
+    # (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
+    # rewrites it to the stable symlink; the shell inherits the original raw path).
+    if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
+      _CANDIDATE="${SSH_AUTH_SOCK}"
     fi
-    echo "Reset SSH_AUTH_SOCK to ${_rss_link} -> ${_rss_sock}"
-    unset -v _rss_sock _rss_link
-    return 0
-  else
-    echo "reset_ssh_socket: no valid local ssh-agent socket found." >&2
-    unset -v _rss_sock
-    return 1
-  fi
-}
 
-_CANDIDATE=""
+    # 2. Only look for a system agent if the stable link is already broken. If the link is
+    # valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
+    # updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
+    if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
+      _CANDIDATE=$(get_local_ssh_agent_sock)
+    fi
 
-# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
-# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
-# rewrites it to the stable symlink; the shell inherits the original raw path).
-if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
-  _CANDIDATE="${SSH_AUTH_SOCK}"
-fi
+    # 3. Sync the stable link if we found a valid "real" socket.
+    if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
+      mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
+      ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
+      export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
+      # Update systemd if present to keep everything in sync
+      if command -v systemctl >/dev/null 2>&1; then
+        systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
+      fi
+    elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
+      # If we found nothing better but the link is valid, use it.
+      export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
+    fi
 
-# 2. Only look for a system agent if the stable link is already broken. If the link is
-# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
-# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
-if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
-  _CANDIDATE=$(get_local_ssh_agent_sock)
-fi
-
-# 3. Sync the stable link if we found a valid "real" socket.
-if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
-  mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
-  ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
-  export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
-  # Update systemd if present to keep everything in sync
-  if command -v systemctl >/dev/null 2>&1; then
-    systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
-  fi
-elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
-  # If we found nothing better but the link is valid, use it.
-  export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
-fi
-
-unset _SSH_AUTH_LINK _CANDIDATE
+    unset _SSH_AUTH_LINK _CANDIDATE
+    ;;
+esac
 
 # Setup XDG-like dirs on MacOS
 # Based on https://leebyron.com/til/mac-xdg/
-if [ "$(uname)" = "Darwin" ] ; then
+if [ "${_UNAME}" = "Darwin" ] ; then
   export XDG_BIN_HOME="${XDG_BIN_HOME:-$HOME/.local/bin}"
   export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/Library/Caches}"
   export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
@@ -246,10 +265,12 @@ if [ "$(uname)" = "Darwin" ] ; then
   export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-$TMPDIR/runtime-$(id -u)}"
   export XDG_STATE_HOME="${XDG_STATE_HOME:-$HOME/.local/state}"
   export PATH="${HOME}/bin/macos:${PATH}"
-elif [ "$(uname)" = "Linux" ] ; then
+elif [ "${_UNAME}" = "Linux" ] ; then
   export PATH="${HOME}/bin/linux:${PATH}"
 fi
 
+unset _UNAME
+
 if test -e "$HOME/.localenv"; then
   # shellcheck source=/dev/null
   . "$HOME/.localenv"

dotfiles/zshrc

@@ -1,8 +1,11 @@
 # For interactive shells
 [[ -n "$ZSH_PROFILE" ]] && {
   zmodload zsh/datetime
-  zshrc_start_time=$EPOCHREALTIME
   zmodload zsh/zprof
+  export PS4='+[%D{%f} / %D{%s.%N}] %N:%i> '
+  exec 3>&2 2>/tmp/zsh_startup.log
+  set -x
+  zshrc_start_time=$EPOCHREALTIME
 }
 HISTFILE=~/.zhistory
 HISTSIZE=10000
@@ -129,7 +132,12 @@ case $TERM in
       else
         # this will also work in tmux but is not what we want
         # Set the terminal title to include the command being run
-        print -Pn "\e]0;%n@%m: %~ ($cmd)\a"
+        # Skip adding (cmd) in iTerm2 — shell integration already injects the job name
+        if [[ -z "$ITERM_SESSION_ID" ]]; then
+          print -Pn "\e]0;%n@%m: %~ ($cmd)\a"
+        else
+          print -Pn "\e]0;%n@%m: %~\a"
+        fi
       fi
     }
     # Add the hooks to zsh
@@ -298,6 +306,8 @@ typeset -U PATH
 
 if [[ -n "$ZSH_PROFILE" ]]; then
   zshrc_end_time=$EPOCHREALTIME
+  set +x
+  exec 2>&3 3>&-
   # Calculation in ms using zsh floating point math
   elapsed_ms=$(( (zshrc_end_time - zshrc_start_time) * 1000 ))
   printf "zshrc done: %.0fms\n" "$elapsed_ms"