feat(scripts): add x-gitprofile for mise enter hook git-profile switching

Creates .mise.toml files with enter hooks that auto-switch git
profiles when entering project directories (e.g. ~/Code/ivuorinen,
~/Code/masf).

.claude/agents/code-reviewer.md

@@ -0,0 +1,14 @@
+---
+name: code-reviewer
+description: Reviews shell/fish/lua changes for correctness and style
+tools: [Read, Grep, Glob, Bash]
+---
+
+Review the changed files for:
+
+1. **Shell scripts**: POSIX compliance for /bin/sh scripts, proper quoting, shellcheck issues
+2. **Fish files**: fish syntax correctness, consistent function patterns
+3. **Lua files**: stylua compliance, Neovim API usage patterns
+4. **All**: EditorConfig compliance (2-space indent, LF endings)
+
+Report only high-confidence issues. Skip vendor files (fzf-tmux).

.claude/hooks/async-bats.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Async Bats runner: run matching test file when a script is edited.
+# Runs in background (async: true) — output appears on next turn.
+
+fp=$(jq -r '.tool_input.file_path // empty')
+[ -z "$fp" ] && exit 0
+
+name=$(basename "$fp")
+test_file="$CLAUDE_PROJECT_DIR/tests/${name}.bats"
+[ ! -f "$test_file" ] && exit 0
+
+echo "Running $test_file ..."
+"$CLAUDE_PROJECT_DIR/node_modules/.bin/bats" "$test_file"

.claude/hooks/log-failures.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# PostToolUseFailure logger: append tool failures to a local log file.
+
+log_file="$CLAUDE_PROJECT_DIR/.claude/hook-failures.log"
+
+entry=$(jq -c '{
+  time: (now | strftime("%Y-%m-%dT%H:%M:%SZ")),
+  tool: .tool_name,
+  error: .error
+}')
+
+echo "$entry" >> "$log_file"
+
+exit 0

.claude/hooks/notify-idle.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Notification hook: alert when Claude goes idle.
+# Uses pushover if available, falls back to macOS native notification.
+
+msg=$(jq -r '.message // "Claude is waiting for input"')
+
+if command -v pushover > /dev/null; then
+  pushover "Claude Code" "$msg"
+elif command -v osascript > /dev/null; then
+  osascript -e "display notification \"$msg\" with title \"Claude Code\""
+fi
+
+exit 0

.claude/hooks/post-edit-config-warn.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Post-edit: warn when formatter/linter configs are changed,
+# since they affect the entire repo's code style.
+
+fp=$(jq -r '.tool_input.file_path // empty')
+[ -z "$fp" ] || [ ! -f "$fp" ] && exit 0
+
+case "$(basename "$fp")" in
+  .editorconfig | biome.json | .prettierrc.json | .shellcheckrc | stylua.toml | .yamllint.yml)
+    echo "NOTE: Formatter/linter config changed ($fp)." >&2
+    echo "Run 'pre-commit run --all-files' to verify consistency." >&2
+    ;;
+esac
+
+exit 0

.claude/hooks/post-edit-dotbot-validate.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Post-edit: validate Dotbot install.conf.yaml files after editing.
+# Checks YAML syntax and verifies link targets exist.
+
+fp=$(jq -r '.tool_input.file_path // empty')
+[ -z "$fp" ] || [ ! -f "$fp" ] && exit 0
+
+case "$fp" in
+  *install.conf.yaml) ;;
+  *) exit 0 ;;
+esac
+
+# YAML syntax check
+if command -v yamllint > /dev/null; then
+  if ! output=$(yamllint -d relaxed "$fp" 2>&1); then
+    echo "Dotbot config YAML error in $fp:" >&2
+    echo "$output" >&2
+    exit 2
+  fi
+elif command -v python3 > /dev/null; then
+  if ! output=$(python3 -c "import yaml; yaml.safe_load(open('$fp'))" 2>&1); then
+    echo "Dotbot config YAML parse error in $fp:" >&2
+    echo "$output" >&2
+    exit 2
+  fi
+fi
+
+exit 0

.claude/hooks/post-edit-format.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Post-edit formatter: auto-format file based on extension.
+# Receives tool output JSON on stdin.
+
+fp=$(jq -r '.tool_input.file_path // empty')
+[ -z "$fp" ] || [ ! -f "$fp" ] && exit 0
+
+case "$fp" in
+  *.sh | */bin/*)
+    head -1 "$fp" | grep -qE '^#!.*(ba)?sh' \
+      && command -v shfmt > /dev/null \
+      && shfmt -i 2 -bn -ci -sr -fn -w "$fp"
+    ;;
+  *.fish)
+    command -v fish_indent > /dev/null && fish_indent -w "$fp"
+    ;;
+  *.lua)
+    command -v stylua > /dev/null && stylua "$fp"
+    ;;
+  *.md)
+    command -v biome > /dev/null && biome format --write "$fp" 2> /dev/null
+    command -v markdown-table-formatter > /dev/null \
+      && markdown-table-formatter "$fp" 2> /dev/null
+    ;;
+  *.yml | *.yaml)
+    command -v prettier > /dev/null && prettier --write "$fp" 2> /dev/null
+    ;;
+esac
+
+exit 0

.claude/hooks/pre-edit-block.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Pre-edit guard: block vendor/lock files and secrets.d real fish files.
+# Receives tool input JSON on stdin.
+
+fp=$(jq -r '.tool_input.file_path // empty')
+[ -z "$fp" ] && exit 0
+
+case "$fp" in
+  */fzf-tmux | */yarn.lock | */.yarn/*)
+    echo "BLOCKED: $fp is a vendor/lock file — do not edit directly" >&2
+    exit 2
+    ;;
+  */tools/dotbot/* | */tools/dotbot-include/* | */tools/antidote/*)
+    echo "BLOCKED: $fp is inside a git submodule — do not edit" >&2
+    exit 2
+    ;;
+  */config/tmux/plugins/*)
+    echo "BLOCKED: $fp is a tmux plugin submodule — do not edit" >&2
+    exit 2
+    ;;
+  */config/cheat/cheatsheets/community/* | */config/cheat/cheatsheets/tldr/*)
+    echo "BLOCKED: $fp is a cheat submodule — do not edit" >&2
+    exit 2
+    ;;
+  */secrets.d/*.fish)
+    case "$(basename "$fp")" in
+      *.example.fish | *.fish.example) exit 0 ;;
+    esac
+    echo "BLOCKED: do not edit $fp directly — it is gitignored." >&2
+    echo "Copy the matching .fish.example file and edit that locally." >&2
+    exit 2
+    ;;
+esac
+
+exit 0

.claude/hooks/session-start-context.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# SessionStart context: print branch, dirty file count, and last commit.
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+branch=$(git branch --show-current 2> /dev/null)
+dirty=$(git status --short 2> /dev/null | wc -l | tr -d ' ')
+last=$(git log -1 --oneline 2> /dev/null)
+
+echo "=== Dotfiles session context ==="
+echo "Branch : ${branch:-unknown}"
+echo "Dirty  : ${dirty} file(s)"
+echo "Last   : ${last}"
+
+exit 0

.claude/hooks/stop-lint-gate.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Stop gate: run yarn lint before Claude finishes.
+# Exit 2 sends feedback back and keeps Claude working.
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+output=$(yarn lint 2>&1)
+status=$?
+
+if [ $status -ne 0 ]; then
+  echo "Lint failed — fix before finishing:" >&2
+  echo "$output" >&2
+  exit 2
+fi
+
+exit 0

.claude/settings.json

@@ -1,12 +1,23 @@
 {
   "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/session-start-context.sh",
+            "statusMessage": "Loading project context..."
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
       {
         "matcher": "Edit|Write",
         "hooks": [
           {
             "type": "command",
-            "command": "fp=$(cat | jq -r '.tool_input.file_path // empty') && [ -n \"$fp\" ] && case \"$fp\" in */fzf-tmux|*/yarn.lock|*/.yarn/*) echo \"BLOCKED: $fp is a vendor/lock file — do not edit directly\" >&2; exit 2;; esac; exit 0"
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pre-edit-block.sh"
           }
         ]
       }
@@ -17,7 +28,57 @@
         "hooks": [
           {
             "type": "command",
-            "command": "fp=$(cat | jq -r '.tool_input.file_path // empty') && [ -n \"$fp\" ] && [ -f \"$fp\" ] && case \"$fp\" in *.sh|*/bin/*) head -1 \"$fp\" | grep -qE '^#!.*(ba)?sh' && command -v shfmt > /dev/null && shfmt -i 2 -bn -ci -sr -fn -w \"$fp\";; esac; exit 0"
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/post-edit-format.sh",
+            "statusMessage": "Formatting..."
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/post-edit-dotbot-validate.sh",
+            "statusMessage": "Validating Dotbot config..."
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/post-edit-config-warn.sh"
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/async-bats.sh",
+            "async": true,
+            "statusMessage": "Running tests..."
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/log-failures.sh",
+            "async": true
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "matcher": "idle_prompt",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/notify-idle.sh",
+            "async": true
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-lint-gate.sh",
+            "statusMessage": "Running lint gate..."
           }
         ]
       }

.claude/skills/dotbot-validate/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: dotbot-validate
+description: >-
+  Validate Dotbot install.conf.yaml files after editing.
+  Apply when writing or modifying any install.conf.yaml.
+user-invocable: false
+allowed-tools: Bash, Read
+---
+
+After editing any `install.conf.yaml` file, validate it:
+
+## 1. YAML syntax
+
+```bash
+yamllint -d relaxed <file>
+```
+
+If yamllint is not available, fall back to:
+
+```bash
+python3 -c "import yaml; yaml.safe_load(open('<file>'))"
+```
+
+## 2. Link target verification
+
+For each `link` entry, verify the source path exists relative
+to the repo root. Report any missing source files.
+
+## 3. Host-specific configs
+
+Files in `hosts/<hostname>/install.conf.yaml` overlay the
+global config. Verify that any `include` directives reference
+existing files.
+
+## Key locations
+
+- `install.conf.yaml` — global config
+- `hosts/*/install.conf.yaml` — per-host overlays

.claude/skills/fish-validate/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: fish-validate
+description: >-
+  Validate fish scripts after editing.
+  Apply when writing or modifying any .fish file
+  in config/fish/.
+user-invocable: false
+allowed-tools: Bash, Read
+---
+
+After editing any `.fish` file in `config/fish/`, validate it:
+
+## 1. Syntax check
+
+```bash
+fish --no-execute <file>
+```
+
+If syntax check fails, fix the issue before proceeding.
+
+## 2. Format check
+
+Run `fish_indent` to verify formatting:
+
+```bash
+fish_indent --check <file>
+```
+
+If formatting differs, apply it:
+
+```bash
+fish_indent -w <file>
+```
+
+## Key files to never validate
+
+- Files inside `config/fish/functions/` prefixed with `_tide_`
+  (managed by the tide prompt plugin)

.claude/skills/host-override/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: host-override
+description: >-
+  Create or extend host-specific config overlays
+  in hosts/<hostname>/ for machine-specific settings.
+user-invocable: true
+allowed-tools: Bash, Read, Write, Edit
+---
+
+When creating host-specific configuration overrides:
+
+## 1. Determine hostname
+
+```bash
+hostname -s
+```
+
+## 2. Directory structure
+
+Host overrides live in `hosts/<hostname>/` mirroring the
+global layout:
+
+```
+hosts/<hostname>/
+  base/           -> ~/.*
+  config/         -> ~/.config/
+  install.conf.yaml
+```
+
+## 3. Create install.conf.yaml
+
+If it doesn't exist, create `hosts/<hostname>/install.conf.yaml`
+following the Dotbot format. Use `include` to layer on top of
+the global config:
+
+```yaml
+- defaults:
+    link:
+      create: true
+      relink: true
+      force: true
+```
+
+## 4. Git config overrides
+
+The most common override is `hosts/<hostname>/config/git/overrides/config`.
+This is where host-specific git user, signing keys, and credential
+helpers go. Always `[include]` the shared config:
+
+```ini
+[include]
+  path = ~/.dotfiles/config/git/shared
+```
+
+## 5. Test
+
+Run `./install` to apply. Dotbot processes
+`hosts/<hostname>/install.conf.yaml` after the global config.

.claude/skills/lua-format/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: lua-format
+description: >-
+  Format Lua files after editing.
+  Apply when writing or modifying any .lua file.
+user-invocable: false
+allowed-tools: Bash
+---
+
+After editing any `.lua` file, format it with stylua:
+
+```bash
+stylua <file>
+```
+
+Project settings are in `stylua.toml` (90-char line length).
+
+If stylua is not available, skip formatting silently.
+
+## Files to never format
+
+- Files inside `config/nvim/` managed by plugins (lazy.nvim lockfile)

.claude/skills/new-fish-function/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: new-fish-function
+description: >-
+  Scaffold a new fish function in config/fish/functions/
+  with proper conventions and event handling.
+user-invocable: true
+allowed-tools: Bash, Read, Write, Edit
+---
+
+When creating a new fish function in `config/fish/functions/`:
+
+## 1. Create the function file
+
+Create `config/fish/functions/<name>.fish`:
+
+```fish
+function <name> --description '<one-line description>'
+  # Function logic here
+end
+```
+
+- One function per file, filename must match function name
+- Always include `--description`
+- Use `--argument-names` for named parameters
+
+## 2. Conventions
+
+- Do NOT use `_tide_` prefix (reserved for tide prompt plugin)
+- Use `--wraps` if the function wraps an existing command
+- For abbreviation-like functions, prefer fish abbreviations
+  in `config/fish/alias.fish` instead
+
+## 3. Validate
+
+Run the fish-validate skill checks:
+
+```bash
+fish --no-execute config/fish/functions/<name>.fish
+fish_indent --check config/fish/functions/<name>.fish
+```

.claude/skills/new-script/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: new-script
+description: >-
+  Scaffold a new helper script in local/bin/ with proper
+  boilerplate, msgr sourcing, and documentation tag.
+user-invocable: true
+allowed-tools: Bash, Read, Write, Edit
+---
+
+When creating a new script in `local/bin/`, follow this template:
+
+## 1. Script file
+
+Create `local/bin/<name>` with:
+
+```bash
+#!/usr/bin/env bash
+# @description <one-line description>
+
+set -euo pipefail
+
+# shellcheck source=msgr
+. "$(dirname "$0")/msgr"
+
+# Script logic here
+```
+
+- Use `msgr` functions for output: `msgr msg`, `msgr run`,
+  `msgr yay`, `msgr err`, `msgr warn`
+- The `@description` tag is required — `dfm scripts` discovers
+  scripts by it
+- POSIX scripts (`/bin/sh`) should NOT source msgr
+
+## 2. Make executable
+
+```bash
+chmod +x local/bin/<name>
+```
+
+## 3. Generate docs
+
+Run `dfm docs script <name>` or manually create `local/bin/<name>.md`
+with a usage summary.
+
+## 4. Validate
+
+Run the shell-validate skill checks (syntax + shellcheck).
+
+## Naming conventions
+
+- `x-` prefix for standalone utilities (e.g., `x-ssl-expiry-date`)
+- Short names for frequently used commands (e.g., `a`, `ad`, `ae`)
+- `git-` prefix for git subcommands (e.g., `git-dirty`)

.claude/skills/shell-validate/SKILL.md

@@ -1,11 +1,16 @@
 ---
 name: shell-validate
-description: Validate shell scripts after editing. Apply when writing or modifying any shell script in local/bin/ or scripts/.
+description: >-
+  Validate shell scripts after editing.
+  Apply when writing or modifying any shell script
+  in local/bin/ or scripts/.
 user-invocable: false
 allowed-tools: Bash, Read, Grep
 ---
 
-After editing any shell script in `local/bin/`, `scripts/`, or `config/` (files with a `#!` shebang or `# shellcheck shell=` directive), validate it:
+After editing any shell script in `local/bin/`, `scripts/`, or `config/`
+(files with a `#!` shebang or `# shellcheck shell=` directive),
+validate it:
 
 ## 1. Determine the shell
 
@@ -28,7 +33,9 @@ If syntax check fails, fix the issue before proceeding.
 
 ## 3. ShellCheck
 
-Run `shellcheck <file>`. The project `.shellcheckrc` already disables SC2039, SC2166, SC2154, SC1091, SC2174, SC2016. Only report and fix warnings that are NOT in that exclude list.
+Run `shellcheck <file>`. The project `.shellcheckrc` already
+disables SC2039, SC2166, SC2154, SC1091, SC2174, SC2016.
+Only report and fix warnings that are NOT in that exclude list.
 
 ## Key files to never validate (not shell scripts)
 

.claude/skills/yaml-validate/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: yaml-validate
+description: >-
+  Validate YAML files after editing.
+  Apply when writing or modifying any .yml or .yaml file.
+user-invocable: false
+allowed-tools: Bash, Read
+---
+
+After editing any YAML file, validate it:
+
+## 1. Syntax check
+
+Run yamllint on the file:
+
+```bash
+yamllint <file>
+```
+
+If yamllint is not available, fall back to:
+
+```bash
+python3 -c "import yaml; yaml.safe_load(open('<file>'))"
+```
+
+## 2. GitHub Actions workflows
+
+If the file is under `.github/workflows/`, also run:
+
+```bash
+actionlint <file>
+```
+
+If actionlint is not available, skip silently.
+
+## Files to skip
+
+- `config/gh/hosts.yml` — managed by `gh` CLI, not hand-edited

.editorconfig-checker.json

@@ -7,6 +7,7 @@
   "Exclude": [
     "base/plan",
     "config/fish/completions/.*",
+    "config/karabiner/.*",
     "config/fish/conf.d/.*",
     "config/fish/functions/.*",
     "config/fzf/key-bindings.fish",

.github/workflows/changelog.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Create changelog text
         id: changelog
-        uses: loopwerk/tag-changelog@941366edb8920e2071eae0449031830984b9f26e # v1.3.0
+        uses: loopwerk/tag-changelog@8dd150d55fbf1fe93e0ea00a29a6153aaeb81912 # v1.5.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config_file: .github/tag-changelog-config.js

.github/workflows/linters.yml

@@ -5,7 +5,7 @@ name: Lint Code Base
 # yamllint disable-line
 on:
   pull_request:
-    branches: [master, main]
+    branches: [main]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -36,4 +36,4 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run PR Lint
-        uses: ivuorinen/actions/pr-lint@309f4460ec2c6c1134ca09cb9b7410c9914f9f7d # v2026.02.18
+        uses: ivuorinen/actions/pr-lint@1da3a0e79fcd7da6bed9ee1979f1449ba11f58f9 # v2026.03.14

.github/workflows/new-release.yml

@@ -35,14 +35,14 @@ jobs:
       - name: Create changelog text
         if: steps.daily-version.outputs.created
         id: changelog
-        uses: loopwerk/tag-changelog@941366edb8920e2071eae0449031830984b9f26e # v1.3.0
+        uses: loopwerk/tag-changelog@8dd150d55fbf1fe93e0ea00a29a6153aaeb81912 # v1.5.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config_file: .github/tag-changelog-config.js
 
       - name: Create release
         if: steps.daily-version.outputs.created
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag_name: ${{ steps.daily-version.outputs.version }}

.github/workflows/sync-labels.yml

@@ -30,4 +30,4 @@ jobs:
       issues: write
 
     steps:
-      - uses: ivuorinen/actions/sync-labels@309f4460ec2c6c1134ca09cb9b7410c9914f9f7d # v2026.02.18
+      - uses: ivuorinen/actions/sync-labels@1da3a0e79fcd7da6bed9ee1979f1449ba11f58f9 # v2026.03.14

.github/workflows/update-submodules.yml

@@ -5,7 +5,7 @@ name: Update submodules
 on:
   schedule:
     # At 04:00 on Monday and Thursday.
-    - cron: "0 4 * * 1"
+    - cron: "0 4 * * 1,4"
   workflow_dispatch:
 
 concurrency:

.gitignore

@@ -25,8 +25,13 @@ config/alacritty/theme-active.toml
 config/cheat/cheatsheets/pure-bash-bible/*
 config/cheat/cheatsheets/tldr/*
 config/fish/completions/asdf.fish
+config/fish/completions/kubectl.fish
+config/fish/completions/orbctl.fish
 config/fish/fish_variables
 config/fish/fish_variables.*
+config/fish/secrets.d/*
+!config/fish/secrets.d/*.example
+!config/fish/secrets.d/README.md
 config/gh/hosts.yml
 config/git/credentials
 config/git/local.d/*
@@ -59,3 +64,9 @@ node_modules
 __pycache__
 ssh/local.d/*
 config/fish/fish_variables*
+
+# Allow .claude directory (overrides global **/.claude/* ignore)
+!.claude/
+!.claude/**
+.claude/**/*.log
+.claude/settings.local.json

.go-version

@@ -1 +0,0 @@
-1.25.5

.mise.toml

@@ -0,0 +1,4 @@
+[tools]
+node = "24.14.0"
+python = "3.14.3"
+go = "1.26.1"

.nvmrc

@@ -1 +0,0 @@
-24.13.1

.pre-commit-config.yaml

@@ -27,7 +27,7 @@ repos:
         name: Biome Check
         entry: yarn biome check --write --files-ignore-unknown=true --no-errors-on-unmatched
         language: system
-        files: \.(js|ts|jsx|tsx|json|md)$
+        files: \.(js|ts|jsx|tsx|json)$
       - id: markdown-table-formatter
         name: Markdown Table Formatter
         entry: yarn markdown-table-formatter
@@ -39,13 +39,13 @@ repos:
     hooks:
       - id: yamllint
 
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v4.0.0-alpha.8
+  - repo: local
     hooks:
       - id: prettier
+        name: Prettier (YAML)
+        entry: yarn prettier --write
+        language: system
         types_or: [yaml]
-        additional_dependencies:
-          - prettier@3.8.1
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
     rev: v0.11.0.1
@@ -64,7 +64,7 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/JohnnyMorganz/StyLua
-    rev: v2.3.1
+    rev: v2.4.0
     hooks:
       - id: stylua # or stylua-system / stylua-github
         exclude: hammerspoon\.types\.lua$
@@ -76,7 +76,7 @@ repos:
       - id: fish_indent
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
+    rev: v0.15.6
     hooks:
       - id: ruff-check
         args: [--fix]

.prettierignore

@@ -15,4 +15,4 @@ config/zsh
 local/bin/antigen.zsh
 local/bin/asdf
 tools
-docs/plans
+config/gh/hosts.yml

.python-version

@@ -1 +0,0 @@
-3.14.3

.serena/memories/project_overview.md

@@ -50,12 +50,11 @@ the primary installation framework to manage symlinks and setup configurations.
 
 - **Platform**: Darwin (macOS) - Version 24.6.0
 - **Architecture**: Universal (Intel/Apple Silicon via Homebrew)
-- **Dependencies**: Git, Homebrew, Yarn, various CLI tools managed via asdf/aqua
+- **Dependencies**: Git, Homebrew, Yarn, various CLI tools managed via mise
 
 ## Development Environment
 
-- Node.js managed via nvm/asdf
-- Go version specified (.go-version)
-- Python version specified (.python-version)
+- Node.js, Go, Python, Ruby, Rust managed via mise
+- Version files (.nvmrc, .go-version, .python-version) consumed by mise via idiomatic_version_file
 - Package management via Yarn with lockfile
 - TypeScript support for configuration files

.serena/memories/project_structure.md

@@ -30,7 +30,7 @@ Configuration files for development tools and applications:
 - `starship.toml` - Starship prompt configuration
 - `shared.sh` - Cross-shell compatibility functions
 - `aerospace/`, `amethyst/`, `yabai/`, `skhd/` - Window managers
-- `direnv/`, `asdf/`, `aqua/` - Development environment tools
+- `direnv/`, `mise/`, `aqua/` - Development environment tools
 - `gpg-tui/`, `op/`, `gh/` - Security and CLI tools
 - Theme configurations: everforest color schemes across multiple tools
 
@@ -97,7 +97,7 @@ Installation and setup automation scripts
 - `.shellcheckrc` - ShellCheck configuration
 - `.mega-linter.yml` - MegaLinter configuration
 - `.luarc.json` - Lua language server configuration
-- `.nvmrc`, `.go-version`, `.python-version` - Version management
+- `.nvmrc`, `.go-version`, `.python-version` - Version files (consumed by mise)
 - Various ignore files (.gitignore, .prettierignore, .yamlignore, etc.)
 
 ## Testing Infrastructure

.serena/memories/suggested_commands.md

@@ -59,10 +59,11 @@ pre-commit run --all-files
 ## Version Management
 
 ```bash
-# Check current versions
-node --version        # Managed by nvm (.nvmrc: v20.18.1)
-go version           # Managed by asdf (.go-version)
-python --version     # Managed by asdf (.python-version)
+# Check current versions (all managed by mise)
+node --version        # mise (.nvmrc via idiomatic_version_file)
+go version           # mise (.go-version)
+python --version     # mise (.python-version)
+mise ls              # List all installed tool versions
 ```
 
 ## System Utilities (Darwin-specific)

.serena/project.yml

@@ -1,10 +1,4 @@
-# language of the project (csharp, python, rust, java, typescript, go, cpp, or ruby)
-#  * For C, use cpp
-#  * For JavaScript, use typescript
-# Special requirements:
-#  * csharp: Requires the presence of a .sln file in the project folder.
-language: bash
-
+---
 # whether to use the project's gitignore file to ignore files
 # Added on 2025-04-07
 ignore_all_files_in_gitignore: true
@@ -86,5 +80,81 @@ excluded_tools: []
 # initial prompt for the project. It will always be given to the LLM upon activating the project
 # (contrary to the memories, which are loaded on demand).
 initial_prompt: ""
-
+# the name by which the project can be referenced within Serena
 project_name: ".dotfiles"
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+fixed_tools: []
+
+# list of mode names to that are always to be included in the set of active modes
+# The full set of modes to be activated is base_modes + default_modes.
+# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this setting overrides the global configuration.
+# Set this to [] to disable base modes for this project.
+# Set this to a list of mode names to always include the respective modes for this project.
+base_modes:
+
+# list of mode names that are to be activated by default.
+# The full set of modes to be activated is base_modes + default_modes.
+# If the setting is undefined, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+default_modes:
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: utf-8
+
+# list of languages for which language servers are started; choose from:
+#   al                  bash                clojure             cpp                 csharp
+#   csharp_omnisharp    dart                elixir              elm                 erlang
+#   fortran             fsharp              go                  groovy              haskell
+#   java                julia               kotlin              lua                 markdown
+#   matlab              nix                 pascal              perl                php
+#   php_phpactor        powershell          python              python_jedi         r
+#   rego                ruby                ruby_solargraph     rust                scala
+#   swift               terraform           toml                typescript          typescript_vts
+#   vue                 yaml                zig
+#   (This list may be outdated. For the current list, see values of Language enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
+#   For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some languages require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple languages, the first language server that supports a given file will be used for that file.
+# The first language is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+languages:
+  - bash
+  - lua

AGENTS.md

@@ -1,55 +0,0 @@
-# Project guidelines
-
-This repository contains configuration files and helper scripts for managing
-a development environment.
-Dotbot drives installation, and host-specific folders under `hosts/` contain extra configs.
-
-## Setup
-
-1. Run `yarn install` to fetch linting tools and the Bats test framework.
-2. Re-run `yarn install` whenever `package.json` changes.
-3. Yarn is the package manager of choice; avoid `npm` commands.
-
-## Keeping the repository up to date
-
-1. Update submodules with `git submodule update --remote --merge`.
-2. Pull the latest changes and run `./install`.
-
-## Linting and tests
-
-- Format files with:
-
-  ```bash
-  yarn fix:prettier
-  yarn fix:markdown
-  ```
-
-- Shell scripts must pass `shellcheck`.
-
-  ```bash
-  find . -path ./node_modules -prune -o -name '*.sh' -print0 | xargs -0 shellcheck
-  ```
-
-- Ensure `.editorconfig` rules pass:
-
-  ```bash
-  tools/install-ec.sh
-  ec
-  ```
-
-- Execute tests with `yarn test` when code changes.
-
-## Debugging lint issues
-
-- `yarn lint:prettier` and `yarn lint:markdown` show formatting errors.
-- Ensure shell scripts have a shebang or `# shellcheck shell=bash` directive.
-- Consult `.shellcheckrc` for project specific checks.
-
-Scripts rely on helpers in `config/shared.sh` so they run under Bash, Zsh and Fish by default.
-
-## Commits and PRs
-
-- Use Semantic Commit messages: `type(scope): summary`.
-- Keep PR titles in the same format.
-
-<!-- vim: set ft=markdown spell spelllang=en_us cc=80 : -->

CLAUDE.md

@@ -50,12 +50,15 @@ yarn test              # Run all tests in tests/
 
 # Shell linting
 shellcheck <script>    # Lint shell scripts
+
+# Tooling maintenance
+npx @biomejs/biome migrate --write  # Update biome schema version
 ```
 
 ## Pre-commit Hooks
 
 Configured in `.pre-commit-config.yaml`: shellcheck, shfmt, biome,
-yamllint, prettier, actionlint, stylua, fish_syntax/fish_indent.
+yamllint, prettier, actionlint, stylua, fish_syntax/fish_indent, ruff.
 Run `pre-commit run --all-files` to check everything.
 
 ## Commit Convention
@@ -95,6 +98,13 @@ and most scripts in `local/bin/`.
 - `dfm scripts` — run scripts from `scripts/` (discovered via `@description` tags)
 - `dfm tests` — test visualization helpers
 
+### mise — Unified Tool Manager
+
+`config/mise/config.toml` manages language runtimes (Node LTS, Python 3,
+Go latest, Rust stable) and CLI tools (fd, ripgrep, eza, neovim, delta,
+zoxide, etc.). Activated via `eval "$(mise activate bash)"` in
+`config/exports`. Run `mise install` after adding new tools.
+
 ### Submodules
 
 External dependencies are git submodules (Dotbot, plugins,
@@ -121,7 +131,7 @@ These are layered on top of the global config during installation.
 - **Lua** (neovim config): Formatted with stylua (`stylua.toml`),
   90-char line length.
 - **JSON/JS/TS/Markdown**: Formatted with Biome (`biome.json`),
-  80-char width.
+  80-char width (Markdown uses 120-char override).
 - **YAML**: Formatted with Prettier (`.prettierrc.json`),
   validated with yamllint (`.yamllint.yml`).
 
@@ -140,18 +150,128 @@ SC2174 (mkdir -p -m), SC2016 (single-quote expressions).
 - **Vendor file**: `local/bin/fzf-tmux` is vendored from
   junegunn/fzf — do not modify.
 - **Fish config**: `config/fish/` has its own config chain
-  (`config.fish`, `exports.fish`, `alias.fish`) plus 80+ functions.
+  (`config.fish`, `exports.fish`, `alias.fish`) plus 60+ functions.
+- **gh CLI config**: `config/gh/hosts.yml` is managed by `gh` CLI
+  and excluded from prettier (see `.prettierignore`).
 - **Python**: Two scripts (`x-compare-versions.py`,
   `x-git-largest-files.py`) linted by Ruff (config in `pyproject.toml`).
+- **Fish secrets**: `config/fish/secrets.d/*.fish` files are auto-sourced
+  by `exports.fish`. Copy `github.fish.example` → `github.fish` for local
+  secrets. These files are gitignored; only `*.example` and `README.md`
+  are tracked.
 
 ## Claude Code Configuration
 
 - **Hooks** (`.claude/settings.json`):
-  - *PreToolUse*: Blocks edits to `fzf-tmux`, `yarn.lock`, `.yarn/`
-  - *PostToolUse*: Auto-runs `shfmt` on shell scripts after Edit/Write
+  - *PreToolUse*: Blocks edits to `fzf-tmux`, `yarn.lock`,
+    `.yarn/`, submodule paths, and real secrets.d files
+  - *PostToolUse*: Auto-formats files by extension
+    (shfmt, fish_indent, stylua, biome, prettier)
+  - *PostToolUse*: Validates Dotbot `install.conf.yaml`
+    after edits
+  - *PostToolUse*: Warns on formatter/linter config changes
+  - *Stop*: Runs `yarn lint` gate before finishing
 - **Skills** (`.claude/skills/`):
-  - `shell-validate`: Auto-validates shell scripts (syntax + shellcheck)
+  - `shell-validate`: Auto-validates shell scripts
+    (syntax + shellcheck)
+  - `fish-validate`: Auto-validates fish scripts
+    (syntax + fish_indent)
+  - `lua-format`: Auto-formats Lua files with stylua
+  - `yaml-validate`: Auto-validates YAML files
+    (yamllint + actionlint)
+  - `dotbot-validate`: Validates Dotbot install.conf.yaml
+  - `new-script`: Scaffolds helper scripts in local/bin/
+  - `new-fish-function`: Scaffolds fish functions
+  - `host-override`: Creates host-specific config overlays
+- **Subagents** (`.claude/agents/`):
+  - `code-reviewer`: Reviews shell/fish/lua changes
+- **Plugins** (required):
+  - `context-mode`: Context window protection — must be
+    installed for this repo. See routing rules below.
+  - `context7`: Live documentation lookup
 
 ## Package Manager
 
-Yarn (v4.12.0) is the package manager. Do not use npm.
+Yarn (v4+) is the package manager. Do not use npm.
+
+# context-mode — MANDATORY routing rules
+
+You have context-mode MCP tools available. These rules are NOT optional —
+they protect your context window from flooding. A single unrouted command
+can dump 56 KB into context and waste the entire session.
+
+## BLOCKED commands — do NOT attempt these
+
+### curl / wget — BLOCKED
+Any Bash command containing `curl` or `wget` is intercepted and replaced with an error message. Do NOT retry.
+Instead use:
+- `ctx_fetch_and_index(url, source)` to fetch and index web pages
+- `ctx_execute(language: "javascript", code: "const r = await fetch(...)")` to run HTTP calls in sandbox
+
+### Inline HTTP — BLOCKED
+Any Bash command containing `fetch('http`, `requests.get(`,
+`requests.post(`, `http.get(`, or `http.request(` is intercepted
+and replaced with an error message. Do NOT retry with Bash.
+Instead use:
+- `ctx_execute(language, code)` to run HTTP calls in sandbox — only stdout enters context
+
+### WebFetch — BLOCKED
+WebFetch calls are denied entirely. The URL is extracted and you are told to use `ctx_fetch_and_index` instead.
+Instead use:
+- `ctx_fetch_and_index(url, source)` then `ctx_search(queries)` to query the indexed content
+
+## REDIRECTED tools — use sandbox equivalents
+
+### Bash (>20 lines output)
+Bash is ONLY for: `git`, `mkdir`, `rm`, `mv`, `cd`, `ls`, `npm install`, `pip install`, and other short-output commands.
+For everything else, use:
+- `ctx_batch_execute(commands, queries)` — run multiple commands + search in ONE call
+- `ctx_execute(language: "shell", code: "...")` — run in sandbox, only stdout enters context
+
+### Read (for analysis)
+If you are reading a file to **Edit** it → Read is correct (Edit needs content in context).
+If you are reading to **analyze, explore, or summarize** →
+use `ctx_execute_file(path, language, code)` instead. Only your
+printed summary enters context. The raw file stays in the sandbox.
+
+### Grep (large results)
+Grep results can flood context.
+Use `ctx_execute(language: "shell", code: "grep ...")` to run
+searches in sandbox. Only your printed summary enters context.
+
+## Tool selection hierarchy
+
+1. **GATHER**: `ctx_batch_execute(commands, queries)` — Primary
+  tool. Runs all commands, auto-indexes output, returns search
+  results. ONE call replaces 30+ individual calls.
+2. **FOLLOW-UP**: `ctx_search(queries: ["q1", "q2", ...])` —
+  Query indexed content. Pass ALL questions as array in ONE call.
+3. **PROCESSING**: `ctx_execute(language, code)` |
+  `ctx_execute_file(path, language, code)` — Sandbox execution.
+  Only stdout enters context.
+4. **WEB**: `ctx_fetch_and_index(url, source)` then
+  `ctx_search(queries)` — Fetch, chunk, index, query.
+  Raw HTML never enters context.
+5. **INDEX**: `ctx_index(content, source)` — Store content in FTS5 knowledge base for later search.
+
+## Subagent routing
+
+When spawning subagents (Agent/Task tool), the routing block is
+automatically injected into their prompt. Bash-type subagents are
+upgraded to general-purpose so they have access to MCP tools.
+You do NOT need to manually instruct subagents about context-mode.
+
+## Output constraints
+
+- Keep responses under 500 words.
+- Write artifacts (code, configs, PRDs) to FILES — never return
+  them as inline text. Return only: file path + 1-line description.
+- When indexing content, use descriptive source labels so others can `ctx_search(source: "label")` later.
+
+## ctx commands
+
+| Command       | Action                                                                                |
+|---------------|---------------------------------------------------------------------------------------|
+| `ctx stats`   | Call the `ctx_stats` MCP tool and display the full output verbatim                    |
+| `ctx doctor`  | Call the `ctx_doctor` MCP tool, run the returned shell command, display as checklist  |
+| `ctx upgrade` | Call the `ctx_upgrade` MCP tool, run the returned shell command, display as checklist |

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.7/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -20,6 +20,7 @@
       "!!**/config/op/plugins/used_plugins",
       "!!**/config/tmux/plugins",
       "!!**/config/zsh",
+      "!!**/config/karabiner",
       "!!**/config/vim",
       "!!**/lazy-lock.json",
       "!!**/local/bin/antigen.zsh",

config/alias

@@ -33,6 +33,8 @@ alias .c='cd $HOME/Code'
 alias .d='cd $DOTFILES'
 alias .l='cd $HOME/.local'
 alias .o='cd $HOME/Code/ivuorinen/obsidian/'
+alias .s='cd $HOME/Code/s'
+alias .p='cd $HOME/Code/ivuorinen'
 
 # Shortcuts for listing
 alias ll="ls -la"

config/exports

@@ -14,7 +14,20 @@
 # if DOTFILES is not set, set it to the default location
 [ -z "${DOTFILES:-}" ] && export DOTFILES="$HOME/.dotfiles"
 
-export PATH="$XDG_BIN_HOME:$DOTFILES/local/bin:$XDG_DATA_HOME/bob/nvim-bin:$XDG_DATA_HOME/cargo/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+# Editor settings
+[ -z "${EDITOR:-}" ] && export EDITOR="nvim"
+[ -z "${VISUAL:-}" ] && export VISUAL="code"
+
+# Bootstrap: ensure local/bin is on PATH so x-path is available
+PATH="$DOTFILES/local/bin:$PATH"
+# Use x-path to deduplicate PATH entries (only if x-path is available)
+if command -v x-path &> /dev/null; then
+  # shellcheck source=../local/bin/x-path
+  source "$(command -v x-path)"
+  normalize_path_var
+  do_prepend "$XDG_BIN_HOME" "$DOTFILES/local/bin" "/opt/homebrew/bin" "/usr/local/bin"
+fi
+export PATH
 
 if ! command -v msg &> /dev/null; then
   # Function to print messages if VERBOSE is enabled
@@ -304,7 +317,7 @@ export ANTIDOTE_PLUGINS="$XDG_CONFIG_HOME/zsh/antidote_plugins"
 # https://docs.ansible.com/ansible/latest/reference_appendices/config.html
 msg "Setting up Ansible configuration"
 export ANSIBLE_HOME="$XDG_CONFIG_HOME/ansible"
-export ANSIBLE_CONFIG="$XDG_CONFIG_HOME/ansible.cfg"
+export ANSIBLE_CONFIG="$ANSIBLE_HOME/ansible.cfg"
 export ANSIBLE_GALAXY_CACHE_DIR="$XDG_CACHE_HOME/ansible/galaxy_cache"
 x-dc "$ANSIBLE_HOME"
 x-dc "$ANSIBLE_GALAXY_CACHE_DIR"
@@ -325,10 +338,25 @@ export AWS_CONFIGURE_OUTPUT=true
 export AWS_CONFIGURE_PROFILE=true
 export AWS_CONFIGURE_PROMPT=true
 export AWS_CONFIGURE_PROMPT_DEFAULT="default"
+export AWS_SESSION_TOKEN_FILE="${XDG_STATE_HOME}/aws/session_token"
+export AWS_CONFIGURE_SESSION=true
+export AWS_CONFIGURE_SESSION_DURATION=7200
+export AWS_CONFIGURE_SESSION_MFA=true
 
-# bob manages nvim versions
-msg "Setting up bob configuration"
-x-path-prepend "$XDG_DATA_HOME/bob/nvim-bin"
+# Mason (nvim package manager)
+msg "Setting up Mason configuration"
+export MASON_HOME="$XDG_DATA_HOME/nvim/mason"
+
+# Neovim environment variables
+msg "Setting up Neovim configuration"
+[ -z "${NVIM_STATE:-}" ] && export NVIM_STATE="$XDG_STATE_HOME/nvim"
+[ -z "${NVIM_CONFIG_HOME:-}" ] && export NVIM_CONFIG_HOME="$XDG_CONFIG_HOME/nvim"
+[ -z "${NVIM_DATA_HOME:-}" ] && export NVIM_DATA_HOME="$XDG_DATA_HOME/nvim"
+[ -z "${NVIM_CACHE_HOME:-}" ] && export NVIM_CACHE_HOME="$XDG_CACHE_HOME/nvim"
+[ -z "${NVIM_LOG_PATH:-}" ] && export NVIM_LOG_PATH="$NVIM_STATE/log"
+[ -z "${NVIM_SESSION_PATH:-}" ] && export NVIM_SESSION_PATH="$NVIM_STATE/session"
+[ -z "${NVIM_SHADA_PATH:-}" ] && export NVIM_SHADA_PATH="$NVIM_STATE/shada"
+[ -z "${NVIM_UNDO_PATH:-}" ] && export NVIM_UNDO_PATH="$NVIM_STATE/undo"
 
 # bkt (shell command caching tool) configuration
 msg "Setting up bkt configuration"
@@ -350,12 +378,21 @@ export COMPOSER_HOME="$XDG_STATE_HOME/composer"
 export COMPOSER_BIN="$COMPOSER_HOME/vendor/bin"
 export PATH="$COMPOSER_BIN:$PATH"
 
+# Yarn
+msg "Setting up Yarn configuration"
+export YARN_GLOBAL_FOLDER="$XDG_DATA_HOME/yarn"
+
 # docker, https://docs.docker.com/engine/reference/commandline/cli/
 msg "Setting up Docker configuration"
 export DOCKER_CONFIG="${XDG_CONFIG_HOME}/docker"
 x-dc "$DOCKER_CONFIG"
 # Docker: Disable snyk ad
 export DOCKER_SCAN_SUGGEST=false
+export DOCKER_HIDE_LEGACY_COMMANDS=true
+
+# direnv
+msg "Setting up direnv configuration"
+export DIRENV_LOG_FORMAT=""
 
 # fzf
 export FZF_BASE="${XDG_CONFIG_HOME}/fzf"
@@ -375,13 +412,6 @@ export GOBIN="$XDG_BIN_HOME"
 # Lando
 export PATH="$HOME/.lando/bin${PATH+:$PATH}" #landopath
 
-# NPM: Add npm packages to path
-msg "Setting up NPM configuration"
-x-have node && {
-  NVM_NODE_BIN_DIR="$(dirname "$(which node)")"
-  export PATH="$NVM_NODE_BIN_DIR:$PATH"
-}
-
 # oh-my-posh (omp) configuration
 msg "Setting up oh-my-posh configuration"
 export OHMYPOSH_CFG="$DOTFILES/config/omp/own.toml"
@@ -391,20 +421,21 @@ msg "Setting up 1Password CLI configuration"
 export OP_CACHE="$XDG_STATE_HOME/1password"
 
 # Python
-#
-# pyenv, python environments
 msg "Setting up Python configuration"
 export WORKON_HOME="$XDG_DATA_HOME/virtualenvs"
-export PYENV_ROOT="$XDG_STATE_HOME/pyenv"
 ## for MichaelAquilina/zsh-autoswitch-virtualenv
 export AUTOSWITCH_VIRTUAL_ENV_DIR="$WORKON_HOME"
-export PATH="$PYENV_ROOT/bin:$PYENV_ROOT/shims:$PATH"
-[[ -d $PYENV_ROOT/bin ]] && export PATH="$PYENV_ROOT/bin:$PATH"
-x-have pyenv && eval "$(pyenv init -)"
 
 # Rust / cargo
 msg "Setting up Rust/Cargo configuration"
-export RUST_WITHOUT=rust-docs
+export CARGO_HOME="$XDG_DATA_HOME/cargo"
+export CARGO_BIN_HOME="$XDG_BIN_HOME"
+export RUSTUP_HOME="$XDG_DATA_HOME/rustup"
+export RUST_WITHOUT="clippy,docs,rls"
+
+# Poetry
+msg "Setting up Poetry configuration"
+export POETRY_HOME="$XDG_DATA_HOME/poetry"
 
 # sonarlint
 # https://www.sonarlint.org/
@@ -433,6 +464,10 @@ export ZSH_TMUX_UNICODE=true
 export ZSH_TMUX_AUTOQUIT=false
 export ZSH_TMUX_DEFAULT_SESSION_NAME=main
 
+# tms (tmux session manager)
+msg "Setting up tms configuration"
+export TMS_CONFIG_FILE="$XDG_CONFIG_HOME/tms/config.toml"
+
 # wakatime, https://github.com/wakatime/wakatime-cli
 msg "Setting up Wakatime configuration"
 export WAKATIME_HOME="$XDG_STATE_HOME/wakatime"
@@ -442,12 +477,35 @@ x-dc "$WAKATIME_HOME"
 msg "Setting up LM Studio configuration"
 export PATH="$PATH:$HOME/.lmstudio/bin"
 
+# Screen
+msg "Setting up screen configuration"
+export SCREENRC="$XDG_CONFIG_HOME/misc/screenrc"
+
+# Zoxide
+msg "Setting up Zoxide configuration"
+export _ZO_DATA_DIR="$XDG_DATA_HOME/zoxide"
+export _ZO_EXCLUDE_DIRS="$XDG_DATA_HOME"
+
 # Misc
 msg "Setting up miscellaneous configuration"
 export ZSHZ_DATA="$XDG_STATE_HOME/z"
 export CHEAT_USE_FZF=true
 export SQLITE_HISTORY="${XDG_CACHE_HOME}/sqlite_history"
 
+# Additional PATH entries (aligned with fish config)
+[ -d "$XDG_DATA_HOME/mise/shims" ] && export PATH="$XDG_DATA_HOME/mise/shims:$PATH"
+[ -d "$YARN_GLOBAL_FOLDER/bin" ] && export PATH="$PATH:$YARN_GLOBAL_FOLDER/bin"
+[ -d "$MASON_HOME/bin" ] && export PATH="$PATH:$MASON_HOME/bin"
+[ -d "$HOME/.dotnet/tools" ] && export PATH="$PATH:$HOME/.dotnet/tools"
+[ -d "$POETRY_HOME/bin" ] && export PATH="$PATH:$POETRY_HOME/bin"
+[ -d "$HOME/.opencode/bin" ] && export PATH="$PATH:$HOME/.opencode/bin"
+
+# mise — unified tool version manager
+# https://mise.jdx.dev
+if command -v mise &> /dev/null; then
+  eval "$(mise activate bash)"
+fi
+
 if [ -f "$XDG_CONFIG_HOME/exports-secret" ]; then source "$XDG_CONFIG_HOME/exports-secret"; fi
 if [ -f "$XDG_CONFIG_HOME/exports-local" ]; then source "$XDG_CONFIG_HOME/exports-local"; fi
 # shellcheck source=./exports-lakka

config/fish/alias.fish

@@ -1,6 +1,9 @@
 # Set aliases for fish shell
 
-alias vim='vim -u "$XDG_CONFIG_HOME/vim/vimrc"'
+if type -q nvim
+    alias vim='nvim'
+    alias vi='nvim'
+end
 
 # eza aliases if eza is installed
 if type -q eza >/dev/null
@@ -30,6 +33,19 @@ if type -q eza >/dev/null
     function l --wraps='eza_git' --description eza
         eza_git $argv
     end
+else
+    function ls --description 'ls (system fallback)'
+        command ls $argv
+    end
+    function ll --description 'ls -lh (system fallback)'
+        command ls -lh $argv
+    end
+    function l --description 'ls (system fallback)'
+        command ls $argv
+    end
+    function lsa --description 'ls -lah (system fallback)'
+        command ls -lah $argv
+    end
 end
 
 # Edit fish alias file
@@ -92,5 +108,43 @@ function configure_tide \
         --transient=Yes
 end
 
+# Navigation aliases
+abbr --add .. 'cd ..'
+abbr --add ... 'cd ../..'
+abbr --add .... 'cd ../../..'
+
+# Interesting folders
+function .b --wraps='cd $XDG_BIN_HOME' --description 'cd $XDG_BIN_HOME'
+    cd $XDG_BIN_HOME $argv
+end
+
+function .l --wraps='cd ~/.local' --description 'cd ~/.local'
+    cd ~/.local $argv
+end
+
+function .o --wraps='cd ~/Code/ivuorinen/obsidian/' --description 'cd ~/Code/ivuorinen/obsidian/'
+    cd ~/Code/ivuorinen/obsidian/ $argv
+end
+
+# cd to git root directory
+function cdgr --description 'cd to git root'
+    if git rev-parse --is-inside-work-tree &>/dev/null
+        cd (git rev-parse --show-toplevel); or return $status
+    else
+        echo >&2 "Not in a git repository"
+        return 1
+    end
+end
+
+# Colored grep
+abbr --add grep 'grep --color'
+
+# Date helpers
+alias isodate="date +'%Y-%m-%d'"
+alias x-datetime="date +'%Y-%m-%d %H:%M:%S'"
+alias x-timestamp="date +'%s'"
+
 # Random abbreviations
-abbr --add stats onefetch --nerd-fonts --true-color never
+if type -q onefetch
+    abbr --add stats onefetch --nerd-fonts --true-color never
+end

config/fish/completions/phpenv.fish

@@ -2,21 +2,21 @@
 # Place in ~/.config/fish/completions/phpenv.fish
 
 # Complete main commands
-complete -c phpenv -f -n "__fish_use_subcommand" -a "install" -d "Install a PHP version"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "uninstall" -d "Uninstall a PHP version"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "use" -d "Use PHP version for current shell"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "local" -d "Set PHP version for current project"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "global" -d "Set global PHP version"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "list" -d "List installed PHP versions"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "ls" -d "List installed PHP versions"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "current" -d "Show current PHP version"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "which" -d "Show path to PHP binary"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "versions" -d "Show all available versions"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "doctor" -d "Check phpenv installation"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "config" -d "Manage configuration"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "extensions" -d "Manage PHP extensions"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "ext" -d "Manage PHP extensions"
-complete -c phpenv -f -n "__fish_use_subcommand" -a "help" -d "Show help"
+complete -c phpenv -f -n __fish_use_subcommand -a install -d "Install a PHP version"
+complete -c phpenv -f -n __fish_use_subcommand -a uninstall -d "Uninstall a PHP version"
+complete -c phpenv -f -n __fish_use_subcommand -a use -d "Use PHP version for current shell"
+complete -c phpenv -f -n __fish_use_subcommand -a local -d "Set PHP version for current project"
+complete -c phpenv -f -n __fish_use_subcommand -a global -d "Set global PHP version"
+complete -c phpenv -f -n __fish_use_subcommand -a list -d "List installed PHP versions"
+complete -c phpenv -f -n __fish_use_subcommand -a ls -d "List installed PHP versions"
+complete -c phpenv -f -n __fish_use_subcommand -a current -d "Show current PHP version"
+complete -c phpenv -f -n __fish_use_subcommand -a which -d "Show path to PHP binary"
+complete -c phpenv -f -n __fish_use_subcommand -a versions -d "Show all available versions"
+complete -c phpenv -f -n __fish_use_subcommand -a doctor -d "Check phpenv installation"
+complete -c phpenv -f -n __fish_use_subcommand -a config -d "Manage configuration"
+complete -c phpenv -f -n __fish_use_subcommand -a extensions -d "Manage PHP extensions"
+complete -c phpenv -f -n __fish_use_subcommand -a ext -d "Manage PHP extensions"
+complete -c phpenv -f -n __fish_use_subcommand -a help -d "Show help"
 
 # Helper functions for completions
 function __phpenv_complete_installed_versions
@@ -26,13 +26,13 @@ end
 function __phpenv_complete_available_versions
     # Try to get dynamic versions first
     if command -q curl -a command -q jq; and functions -q __phpenv_parse_version_field
-        echo "latest"
-        echo "nightly"
+        echo latest
+        echo nightly
         echo "5.x"
         echo "7.x"
         echo "8.x"
-        __phpenv_parse_version_field "latest" "8.4"
-        __phpenv_parse_version_field "nightly" "8.5"
+        __phpenv_parse_version_field latest "8.4"
+        __phpenv_parse_version_field nightly "8.5"
         __phpenv_parse_version_field "5.x" "5.6"
         __phpenv_parse_version_field "7.x" "7.4"
         __phpenv_parse_version_field "8.x" "8.4"
@@ -64,18 +64,18 @@ complete -c phpenv -f -n "__fish_seen_subcommand_from uninstall use local global
     -a "(__phpenv_complete_installed_versions)" -d "Installed PHP version"
 
 # Add system option for use command
-complete -c phpenv -f -n "__fish_seen_subcommand_from use" -a "system" -d "Use system PHP"
+complete -c phpenv -f -n "__fish_seen_subcommand_from use" -a system -d "Use system PHP"
 
 # Complete binaries for which command
 complete -c phpenv -f -n "__fish_seen_subcommand_from which" -a "(__phpenv_complete_binaries)" -d "PHP binary"
 
 # Complete config subcommands
 complete -c phpenv -f -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from get set list" \
-    -a "get" -d "Get configuration value"
+    -a get -d "Get configuration value"
 complete -c phpenv -f -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from get set list" \
-    -a "set" -d "Set configuration value"
+    -a set -d "Set configuration value"
 complete -c phpenv -f -n "__fish_seen_subcommand_from config; and not __fish_seen_subcommand_from get set list" \
-    -a "list" -d "List all configuration"
+    -a list -d "List all configuration"
 
 # Complete config keys
 complete -c phpenv -f -n "__fish_seen_subcommand_from config; and __fish_seen_subcommand_from get set" \
@@ -91,27 +91,27 @@ complete -c phpenv -f \
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "install" -d "Install PHP extension"
+    -a install -d "Install PHP extension"
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "uninstall" -d "Uninstall PHP extension"
+    -a uninstall -d "Uninstall PHP extension"
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "remove" -d "Remove PHP extension"
+    -a remove -d "Remove PHP extension"
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "list" -d "List installed extensions"
+    -a list -d "List installed extensions"
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "ls" -d "List installed extensions"
+    -a ls -d "List installed extensions"
 complete -c phpenv -f \
     -n "__fish_seen_subcommand_from extensions ext" \
     -n "not __fish_seen_subcommand_from install uninstall remove list ls available" \
-    -a "available" -d "Show available extensions"
+    -a available -d "Show available extensions"
 
 # Complete extension names
 complete -c phpenv -f \

config/fish/conf.d/paths.fish

@@ -1,22 +0,0 @@
-function ___paths_plugin_set_colors
-    if not set -q ___paths_plugin_colors
-        set -Ux ___paths_plugin_colors 27e6ff 29e0ff 5cd8ff 77d0ff 8ac8ff 9cbfff afb5ff c5a7ff d99bfe ea8feb f684d5 fe7abd ff73a3 ff708a fa7070 ff708a ff73a3 fe7abd f684d5 ea8feb d99bfe c5a7ff afb5ff 9cbfff 8ac8ff 77d0ff 5cd8ff 29e0ff
-    end
-    return 0
-end
-
-function _paths_uninstall --on-event paths_uninstall
-    for i in ___paths_plugin_wrap_color ___paths_plugin_output ___paths_plugin_handle_found_item ___paths_plugin_handle_source ___paths_plugin_cycle_color
-        functions -e $i
-    end
-    set -e ___paths_plugin_colors
-    set -e ___paths_plugin_current_color
-end
-
-function _paths_install --on-event _paths_install
-    ___paths_plugin_set_colors
-end
-
-function _paths_update --on-event paths_update
-    ___paths_plugin_set_colors
-end

config/fish/conf.d/phpenv.fish

@@ -23,7 +23,7 @@ if not set -q PHPENV_AUTO_SWITCH
 end
 
 if not set -q PHPENV_DEFAULT_EXTENSIONS
-    set -g PHPENV_DEFAULT_EXTENSIONS "opcache"
+    set -g PHPENV_DEFAULT_EXTENSIONS opcache
 end
 
 # Initialize PATH on shell startup if global version is set (less aggressive)

config/fish/config.fish

@@ -2,6 +2,8 @@
 # │                     fish/config.fish                     │
 # ╰──────────────────────────────────────────────────────────╯
 
+set -g fish_greeting
+
 fish_config theme choose "Catppuccin Mocha"
 
 test -e "$HOME/.config/fish/alias.fish" &&
@@ -20,19 +22,17 @@ if status is-interactive
     type -q op; and test -e "$HOME/.config/op/plugins.sh" &&
         source "$HOME/.config/op/plugins.sh"
 
-    # version manager initializers
-    type -q rbenv; and source (rbenv init -|psub)
-    type -q pyenv; and source (pyenv init -|psub)
-    type -q pyenv; and source (pyenv virtualenv-init -|psub)
-    type -q goenv; and source (goenv init -|psub)
-    # type -q fnm; and fnm env --use-on-cd --shell fish | source
-    type -q load_nvm; and load_nvm >/dev/stderr
+    # mise version manager
+    type -q mise; and mise activate fish | source
 
     # Initialize other tools if available
     type -q zoxide; and zoxide init fish | source
 
     # Start tmux if not already running and not in SSH
-    #open-tmux # defined in functions/open-tmux.fish
+    #.t # defined in functions/.t.fish
+else
+    # Non-interactive shells (IDE subprocesses) use shims for tool discovery
+    type -q mise; and mise activate fish --shims | source
 end
 
 # Added by LM Studio CLI (lms)
@@ -47,3 +47,9 @@ fish_add_path $HOME/.opencode/bin
 # Added by OrbStack: command-line tools and integration
 # This won't be added again if you remove it.
 source ~/.orbstack/shell/init2.fish 2>/dev/null || :
+
+# Warn if GITHUB_TOKEN is not set
+if status is-interactive; and not set -q GITHUB_TOKEN
+    echo "Warning: GITHUB_TOKEN is not set" >&2
+end
+eval "$(/opt/homebrew/bin/brew shellenv fish)"

config/fish/exports.fish

@@ -17,13 +17,11 @@ set -q HOSTNAME; or set -x HOSTNAME (hostname -s)
 # Add local bin to path
 fish_add_path "$XDG_BIN_HOME"
 
-# Add cargo bin to path
-fish_add_path "$XDG_SHARE_HOME/cargo/bin"
+# Add mise shims to path
+fish_add_path "$XDG_DATA_HOME/mise/shims"
 
-# NPM/NVM configuration
-set -q NVM_DIR; or set -x NVM_DIR "$XDG_DATA_HOME/nvm"
-fish_add_path "$NVM_DIR/bin"
-fish_add_path "$XDG_CONFIG_HOME/nvm"
+# Add cargo bin to path
+fish_add_path "$XDG_DATA_HOME/cargo/bin"
 
 # Yarn configuration
 set -q YARN_GLOBAL_FOLDER; or set -x YARN_GLOBAL_FOLDER "$XDG_DATA_HOME/yarn"
@@ -33,6 +31,9 @@ fish_add_path "$YARN_GLOBAL_FOLDER/bin"
 set -q MASON_HOME; or set -x MASON_HOME "$XDG_DATA_HOME/nvim/mason"
 fish_add_path "$MASON_HOME/bin"
 
+# Add dotnet tools to path
+fish_add_path "$HOME/.dotnet/tools/"
+
 # Set Neovim environment variables
 test -z "$NVIM_STATE" && set -x NVIM_STATE "$XDG_STATE_HOME/nvim"
 test -z "$NVIM_CONFIG_HOME" && set -x NVIM_CONFIG_HOME "$XDG_CONFIG_HOME/nvim"
@@ -55,11 +56,14 @@ set -q AWS_CONFIG_FILE; or set -x AWS_CONFIG_FILE "$XDG_STATE_HOME/aws/config"
 set -q AWS_SHARED_CREDENTIALS_FILE; or set -x AWS_SHARED_CREDENTIALS_FILE "$XDG_STATE_HOME/aws/credentials"
 set -q AWS_SESSION_TOKEN; or set -x AWS_SESSION_TOKEN "$XDG_STATE_HOME/aws/session_token"
 set -q AWS_DATA_PATH; or set -x AWS_DATA_PATH "$XDG_DATA_HOME/aws"
+set -q AWS_DEFAULT_REGION; or set -x AWS_DEFAULT_REGION eu-west-1
 set -q AWS_DEFAULT_OUTPUT; or set -x AWS_DEFAULT_OUTPUT table
 set -q AWS_CONFIGURE_KEYS; or set -x AWS_CONFIGURE_KEYS true
 set -q AWS_CONFIGURE_SESSION; or set -x AWS_CONFIGURE_SESSION true
 set -q AWS_CONFIGURE_SESSION_DURATION; or set -x AWS_CONFIGURE_SESSION_DURATION 7200
 set -q AWS_CONFIGURE_SESSION_MFA; or set -x AWS_CONFIGURE_SESSION_MFA true
+set -q AWS_CONFIGURE_REGION; or set -x AWS_CONFIGURE_REGION true
+set -q AWS_CONFIGURE_OUTPUT; or set -x AWS_CONFIGURE_OUTPUT true
 set -q AWS_CONFIGURE_PROFILE; or set -x AWS_CONFIGURE_PROFILE true
 set -q AWS_CONFIGURE_PROMPT; or set -x AWS_CONFIGURE_PROMPT true
 set -q AWS_CONFIGURE_PROMPT_DEFAULT; or set -x AWS_CONFIGURE_PROMPT_DEFAULT true
@@ -84,14 +88,6 @@ x-dc "$DOCKER_CONFIG"
 set -q DOCKER_HIDE_LEGACY_COMMANDS; or set -x DOCKER_HIDE_LEGACY_COMMANDS true
 set -q DOCKER_SCAN_SUGGEST; or set -x DOCKER_SCAN_SUGGEST false
 
-# FNM / Node.js configuration
-set -q FNM_DIR; or set -x FNM_DIR "$XDG_DATA_HOME/fnm"
-fish_add_path "$FNM_DIR"
-set -q FNM_VERSION_FILE_STRATEGY; or set -x FNM_VERSION_FILE_STRATEGY recursive
-set -q FNM_USE_ON_CD; or set -x FNM_USE_ON_CD true
-set -q FNM_COREPACK_ENABLED; or set -x FNM_COREPACK_ENABLED true
-set -q FNM_RESOLVE_ENGINES; or set -x FNM_RESOLVE_ENGINES true
-
 # fzf configuration
 set -q FZF_BASE; or set -x FZF_BASE "$XDG_CONFIG_HOME/fzf"
 set -q FZF_DEFAULT_OPTS; or set -x FZF_DEFAULT_OPTS \
@@ -101,19 +97,15 @@ set -q FZF_DEFAULT_OPTS; or set -x FZF_DEFAULT_OPTS \
 set -q GNUPGHOME; or set -x GNUPGHOME "$XDG_DATA_HOME/gnupg"
 
 # Go configuration
-# set -q GOPATH; or set -x GOPATH "$XDG_DATA_HOME/go"
-set -q GOBIN; or set -x GOBIN "$XDG_BIN_HOME"
-
-set -q GOENV_ROOT; or set -x GOENV_ROOT "$XDG_DATA_HOME/goenv"
-set -q GOENV_RC_FILE; or set -x GOENV_RC_FILE "$XDG_CONFIG_HOME/goenv/goenvrc.fish"
+set -x GOPATH "$XDG_DATA_HOME/go"
+set -x GOBIN "$XDG_BIN_HOME"
+set -e GOROOT
 
 # 1Password configuration
 set -q OP_CACHE; or set -x OP_CACHE "$XDG_STATE_HOME/1password"
 
 # Python configuration
 set -q WORKON_HOME; or set -x WORKON_HOME "$XDG_DATA_HOME/virtualenvs"
-set -q PYENV_ROOT; or set -x PYENV_ROOT "$XDG_DATA_HOME/pyenv"
-fish_add_path "$PYENV_ROOT/bin"
 
 # Poetry configuration
 set -q POETRY_HOME; or set -x POETRY_HOME "$XDG_DATA_HOME/poetry"
@@ -125,7 +117,6 @@ set -q CARGO_BIN_HOME; or set -x CARGO_BIN_HOME "$XDG_BIN_HOME"
 set -q RUSTUP_HOME; or set -x RUSTUP_HOME "$XDG_DATA_HOME/rustup"
 set -x RUST_WITHOUT "clippy,docs,rls"
 fish_add_path "$CARGO_HOME/bin"
-fish_add_path "$XDG_SHARE_HOME/bob/nvim-bin"
 
 # screen configuration
 set -q SCREENRC; or set -x SCREENRC "$XDG_CONFIG_HOME/misc/screenrc"
@@ -163,6 +154,15 @@ x-dc "$WAKATIME_HOME"
 set -q _ZO_DATA_DIR; or set -x _ZO_DATA_DIR "$XDG_DATA_HOME/zoxide"
 set -q _ZO_EXCLUDE_DIRS; or set -x _ZO_EXCLUDE_DIRS "$XDG_DATA_HOME"
 
+# bkt (shell command caching tool) configuration
+set -q BKT_TTL; or set -x BKT_TTL 1m
+
+# Manpager
+set -q MANPAGER; or set -x MANPAGER "less -X"
+
+# Lando
+fish_add_path "$HOME/.lando/bin"
+
 # Miscellaneous configuration
 set -q CHEAT_USE_FZF; or set -x CHEAT_USE_FZF true
 set -q SQLITE_HISTORY; or set -x SQLITE_HISTORY "$XDG_CACHE_HOME/sqlite/sqlite_history"
@@ -180,6 +180,15 @@ if test -f "$DOTFILES/hosts/$HOSTNAME/config/fish/exports-secret.fish"
     source "$DOTFILES/hosts/$HOSTNAME/config/fish/exports-secret.fish"
 end
 
+# Source secret environment variables from secrets.d directory
+if test -d "$DOTFILES/config/fish/secrets.d"
+    for secret_file in "$DOTFILES/config/fish/secrets.d"/*.fish
+        if test -f "$secret_file"
+            source "$secret_file"
+        end
+    end
+end
+
 # Configure tide prompt
 set -gx tide_prompt_transient_enabled true
 set -gx tide_prompt_add_newline_before true

config/fish/fish_plugins

@@ -3,3 +3,4 @@ jethrokuan/z
 ivuorinen/phpenv.fish
 ilancosman/tide@v6
 catppuccin/fish
+edc/bass

config/fish/functions/.t.fish

@@ -1,7 +1,7 @@
 # Description: Open tmux session if not already open
 # Dependencies: tmux
-# Usage: open-tmux
-function open-tmux --wraps='tmux attach-session -t main || tmux new-session -s main' --description 'open tmux session'
+# Usage: .t
+function .t --wraps='tmux attach-session -t main || tmux new-session -s main' --description 'open tmux session'
     # Check if not in an SSH session and not already in a tmux session
     if test -z "$SSH_TTY"; and not set -q TMUX
         command tmux attach-session -t main || command tmux new-session -s main

config/fish/functions/load_nvm.fish

@@ -1,16 +0,0 @@
-function load_nvm --on-variable="PWD"
-    set -l default_node_version (nvm version default)
-    set -l node_version (nvm version)
-    set -l nvmrc_path (nvm_find_nvmrc)
-    if test -n "$nvmrc_path"
-        set -l nvmrc_node_version (nvm version (cat $nvmrc_path))
-        if test "$nvmrc_node_version" = N/A
-            nvm install (cat $nvmrc_path)
-        else if test "$nvmrc_node_version" != "$node_version"
-            nvm use $nvmrc_node_version
-        end
-    else if test "$node_version" != "$default_node_version"
-        echo "Reverting to default Node version"
-        nvm use default
-    end
-end

config/fish/functions/nvm.fish

@@ -1,3 +0,0 @@
-function nvm
-    bass source $NVM_DIR/nvm.sh --no-use ';' nvm $argv
-end

config/fish/functions/nvm_find_nvmrc.fish

@@ -1,3 +0,0 @@
-function nvm_find_nvmrc
-    bass source $NVM_DIR/nvm.sh --no-use ';' nvm_find_nvmrc
-end

config/fish/functions/paths.fish

@@ -1,175 +0,0 @@
-function ___paths_plugin_wrap_color
-    set_color normal
-    set_color "$argv[1]"
-    echo -n (set_color "$argv[1]")"$argv[2..]"
-    set_color normal
-end
-
-# duplicated in conf.d
-function ___paths_plugin_set_colors
-    if not set -q ___paths_plugin_colors
-        set -Ux ___paths_plugin_colors 27e6ff 29e0ff 5cd8ff 77d0ff 8ac8ff 9cbfff afb5ff c5a7ff d99bfe ea8feb f684d5 fe7abd ff73a3 ff708a fa7070 ff708a ff73a3 fe7abd f684d5 ea8feb d99bfe c5a7ff afb5ff 9cbfff 8ac8ff 77d0ff 5cd8ff 29e0ff
-    end
-    return 0
-end
-
-function ___paths_plugin_cycle_color
-    if not set -q ___paths_plugin_current_color
-        set -Ux ___paths_plugin_current_color 1
-    else if test $___paths_plugin_current_color -gt (count $___paths_plugin_colors)
-        set -Ux ___paths_plugin_current_color 1
-    end
-    echo $___paths_plugin_colors[$___paths_plugin_current_color]
-    set -Ux ___paths_plugin_current_color (math $___paths_plugin_current_color + 1)
-end
-
-function ___paths_plugin_handle_found_item -a testName outFlags
-    set -f flags (string split -n ' ' -- "$outFlags")
-    set -f options (fish_opt -s c -l clean)
-    set -a options (fish_opt -s s -l single)
-    set -a options (fish_opt -s k -l no-color)
-    set -a options (fish_opt -s n -l inline)
-    argparse $options -- $flags
-
-    set -f arrow "=>"
-    # check if file exists
-    if test -e "$testName"
-        set -f nameOut (string trim -- "$testName")
-        if not set -q _flag_c # is not clean
-            if test -L "$testName" # is symlink
-                set -f __linkname (readlink -f "$testName")
-                set __linkname (string trim -- "$__linkname")
-                set testName (string trim -- "$testName")
-                if not set -q _flag_k # is color
-                    set nameOut (___paths_plugin_wrap_color (___paths_plugin_cycle_color) $testName) (___paths_plugin_wrap_color "yellow" "$arrow") (___paths_plugin_wrap_color (___paths_plugin_cycle_color) $__linkname)
-                else # is color
-                    set nameOut (echo -n "$testName" "$arrow" "$__linkname")
-                end
-            else # is not symlink
-                if not set -q _flag_k # is color
-                    set testName (string trim -- "$testName")
-                    set nameOut (___paths_plugin_wrap_color (___paths_plugin_cycle_color) "$testName")
-                else
-                    set testName (string trim -- "$testName")
-                    set nameOut "$testName"
-                end
-            end
-
-            set nameOut (string trim -- "$nameOut")
-            # do the tick
-            if set -q _flag_k # is not color
-                set nameOut "- $nameOut"
-            else # is color
-                set nameOut (___paths_plugin_wrap_color "yellow" "-") "$nameOut"
-            end
-        end
-        set nameOut (string trim -- "$nameOut")
-        echo -n $nameOut
-    end
-end
-
-function paths --description "Reveal the executable matches in shell paths or fish autoload."
-    set -f options (fish_opt -s c -l clean)
-    set -a options (fish_opt -s s -l single)
-    set -a options (fish_opt -s k -l no-color)
-    set -a options (fish_opt -s q -l quiet)
-    set -a options (fish_opt -s n -l inline)
-    argparse $options -- $argv
-
-    if test (count $argv) -lt 1
-        echo "paths - executable matches in shell paths or fish autoload."
-        and echo "usage: paths [-c|-s|-k] <name>"
-        and echo -e "\t-c or --no-color: output without color"
-        and echo -e "\t-s or --single: output without color or headers, the first result"
-        and echo -e "\t-k or --clean: output without tick marks or headers"
-        # and echo -e "\t-n or --inline: output without endline"
-        and return 1
-    end
-
-    set -f foundStatus 1
-    set -f input (string trim -- $argv)
-    # deprecated
-    if set -q _flag_q
-        set _flag_c True
-    end
-
-    if set -q _flag_s
-        set _flag_k True
-        set _flag_c True
-    end
-
-    set -f outFlags ''
-    set -q _flag_n; and set -a outFlags -n
-    set -q _flag_c; and set -a outFlags -c
-    set -q _flag_k; and set -a outFlags -k
-    set -q _flag_s; and set -a outFlags -s
-    set outFlags (string split -n " " -- "$outFlags")
-    ___paths_plugin_set_colors
-    # loop over list of path lists
-    for pVar in VIRTUAL_ENV fisher_path fish_function_path fish_user_paths PATH
-        set -e acc
-        set -f acc ''
-        set -e hit
-        # see if variable is empty
-        if test -z "$pVar"
-            continue
-        end
-        set -f acc (begin
-            for t in $$pVar
-                for snit in "$t/$input.fish" "$t/$input"
-                    set -f found (___paths_plugin_handle_found_item "$snit" "$outFlags")
-                    set found (string trim -- "$found")
-                    if test -n "$found"
-                        set -f hit True
-                        echo "$found"
-                        if set -q _flag_s
-                            break
-                        end
-                    end
-                end
-                if set -q _flag_s
-                    if set -q hit
-                        break
-                    end
-                end
-            end
-        end)
-
-        # prepend source
-        if not set -q _flag_c
-            if set -q hit
-                set pVar (string trim -- "$pVar")
-                echo -e -n "$pVar\n"
-            end
-        end
-
-        if test -n "$acc"
-            set foundStatus 0
-            for fk in $acc
-                echo $fk
-                if set -q _flag_s
-                    # stop after one
-                    return $foundStatus
-                end
-            end
-        end
-    end
-
-    # check
-    set -l built (type --type $input 12&>/dev/null)
-    if test -n "$built"
-        and test "$built" = builtin
-        set $foundStatus 0
-        if not set -q _flag_c
-            echo -e -n "builtin\n"
-            if set -q _flag_k
-                echo - "$input"
-            else # is color
-                echo (___paths_plugin_wrap_color "yellow" "-") (___paths_plugin_wrap_color (___paths_plugin_cycle_color) "$input")
-            end
-        else
-            echo "$input"
-        end
-    end
-    return $foundStatus
-end

config/fish/functions/phpenv.fish

@@ -103,7 +103,7 @@ end
 
 function __phpenv_find_version_file -a phpenv_filename
     set -l phpenv_dir (pwd)
-    while test "$phpenv_dir" != "/"
+    while test "$phpenv_dir" != /
         if test -f "$phpenv_dir/$phpenv_filename"
             echo "$phpenv_dir/$phpenv_filename"
             return
@@ -130,13 +130,13 @@ function __phpenv_parse_composer_version
     end
 
     set -l phpenv_platform_php (jq -r '.config.platform.php // empty' composer.json 2>/dev/null)
-    if test $status -eq 0 -a -n "$phpenv_platform_php" -a "$phpenv_platform_php" != "null"
+    if test $status -eq 0 -a -n "$phpenv_platform_php" -a "$phpenv_platform_php" != null
         echo $phpenv_platform_php
         return
     end
 
     set -l phpenv_require_php (jq -r '.require.php // empty' composer.json 2>/dev/null)
-    if test $status -eq 0 -a -n "$phpenv_require_php" -a "$phpenv_require_php" != "null"
+    if test $status -eq 0 -a -n "$phpenv_require_php" -a "$phpenv_require_php" != null
         __phpenv_parse_semver_constraint $phpenv_require_php
         return
     end
@@ -196,7 +196,7 @@ set -g __phpenv_version_cache_time 0
 
 function __phpenv_get_version_info
     set -l current_time (date +%s)
-    set -l cache_duration 300  # 5 minutes
+    set -l cache_duration 300 # 5 minutes
 
     # Return cached version if still valid
     if test -n "$__phpenv_version_cache"
@@ -236,12 +236,12 @@ end
 # Check if Ondřej PPA is configured on the system
 function __phpenv_has_ondrej_ppa
     if test -d /etc/apt/sources.list.d
-        if grep -rq "ondrej/php" /etc/apt/sources.list.d/ 2>/dev/null
+        if grep -rq ondrej/php /etc/apt/sources.list.d/ 2>/dev/null
             return 0
         end
     end
     if test -f /etc/apt/sources.list
-        if grep -q "ondrej/php" /etc/apt/sources.list 2>/dev/null
+        if grep -q ondrej/php /etc/apt/sources.list 2>/dev/null
             return 0
         end
     end
@@ -262,34 +262,34 @@ function __phpenv_get_provider
     end
 
     # macOS always uses Homebrew
-    if test (uname -s) = "Darwin"
-        echo "homebrew"
+    if test (uname -s) = Darwin
+        echo homebrew
         return 0
     end
 
     # Linux: check for apt with Ondřej PPA first
-    if test (uname -s) = "Linux"
+    if test (uname -s) = Linux
         if command -q apt-get; and __phpenv_has_ondrej_ppa
-            echo "apt"
+            echo apt
             return 0
         end
 
         # Fall back to Homebrew (Linuxbrew) if available
         if command -q brew
-            echo "homebrew"
+            echo homebrew
             return 0
         end
 
         # If apt is available but no PPA yet, still use apt provider
         # (it will prompt to add the PPA when needed)
         if command -q apt-get
-            echo "apt"
+            echo apt
             return 0
         end
     end
 
     # Default fallback
-    echo "homebrew"
+    echo homebrew
     return 0
 end
 
@@ -319,7 +319,7 @@ function __phpenv_provider_homebrew_ensure_source
     end
 
     # Check and add required taps only if missing
-    set -l required_taps "shivammathur/php" "shivammathur/extensions"
+    set -l required_taps shivammathur/php shivammathur/extensions
     for tap in $required_taps
         if not brew tap | grep -qx $tap 2>/dev/null
             if not brew tap $tap 2>/dev/null
@@ -343,7 +343,7 @@ function __phpenv_provider_homebrew_list_installed
                     continue
                 end
 
-                if test "$phpenv_basename" = "php"
+                if test "$phpenv_basename" = php
                     set -l phpenv_latest (__phpenv_parse_version_field "latest" "8.4")
                     set -a phpenv_versions $phpenv_latest
                 else if echo $phpenv_basename | grep -qE '^php@[0-9]+\.[0-9]+$'
@@ -375,7 +375,7 @@ function __phpenv_provider_homebrew_list_available
             continue
         end
 
-        if test "$phpenv_clean_name" = "php"
+        if test "$phpenv_clean_name" = php
             set -a phpenv_versions "$phpenv_latest_version (latest)"
         else if echo $phpenv_clean_name | grep -qE '^php@[0-9]+\.[0-9]+$'
             set -l phpenv_version (echo $phpenv_clean_name | sed 's/php@//')
@@ -502,7 +502,7 @@ function __phpenv_provider_homebrew_ext_list -a phpenv_version
         for phpenv_ext_dir in $phpenv_cellar_path/*@$phpenv_version
             if test -d $phpenv_ext_dir
                 set -l phpenv_ext_name (basename $phpenv_ext_dir | sed "s/@$phpenv_version//")
-                if test "$phpenv_ext_name" != "php"
+                if test "$phpenv_ext_name" != php
                     echo $phpenv_ext_name
                 end
             end
@@ -574,7 +574,7 @@ function __phpenv_provider_apt_ensure_source
     echo ""
     read -P "Add ppa:ondrej/php? [y/N] " -l confirm
 
-    if test "$confirm" = "y" -o "$confirm" = "Y"
+    if test "$confirm" = y -o "$confirm" = Y
         echo "Adding ppa:ondrej/php..."
         if command -q add-apt-repository
             if sudo add-apt-repository -y ppa:ondrej/php
@@ -603,8 +603,7 @@ function __phpenv_provider_apt_list_installed
         return 1
     end
 
-    dpkg -l 'php[0-9]*-cli' 2>/dev/null | grep '^ii' | \
-        sed -E 's/^ii\s+php([0-9]+\.[0-9]+)-cli.*/\1/' | sort -V | uniq
+    dpkg -l 'php[0-9]*-cli' 2>/dev/null | grep '^ii' | sed -E 's/^ii\s+php([0-9]+\.[0-9]+)-cli.*/\1/' | sort -V | uniq
 end
 
 function __phpenv_provider_apt_list_available
@@ -613,8 +612,7 @@ function __phpenv_provider_apt_list_available
         return
     end
 
-    apt-cache search '^php[0-9]+\.[0-9]+-cli$' 2>/dev/null | \
-        sed -E 's/^php([0-9]+\.[0-9]+)-cli.*/\1/' | sort -V | uniq
+    apt-cache search '^php[0-9]+\.[0-9]+-cli$' 2>/dev/null | sed -E 's/^php([0-9]+\.[0-9]+)-cli.*/\1/' | sort -V | uniq
 end
 
 function __phpenv_provider_apt_get_php_path -a phpenv_version
@@ -644,7 +642,7 @@ function __phpenv_provider_apt_get_php_path -a phpenv_version
             set -l temp_link "$target.$fish_pid"
             ln -s "$source" "$temp_link" 2>/dev/null
             and mv -f "$temp_link" "$target" 2>/dev/null
-        else if test "$binary" = "phar"; and test -x "/usr/bin/phar$phpenv_version"
+        else if test "$binary" = phar; and test -x "/usr/bin/phar$phpenv_version"
             set -l temp_link "$target.$fish_pid"
             ln -s "/usr/bin/phar$phpenv_version" "$temp_link" 2>/dev/null
             and mv -f "$temp_link" "$target" 2>/dev/null
@@ -819,8 +817,7 @@ function __phpenv_provider_apt_ext_list -a phpenv_version
     # Filter out core packages (cli, common, etc.)
     set -l core_packages cli common opcache fpm cgi phpdbg
 
-    dpkg -l "php$phpenv_version-*" 2>/dev/null | grep '^ii' | awk '{print $2}' | \
-        sed "s/php$phpenv_version-//" | while read ext
+    dpkg -l "php$phpenv_version-*" 2>/dev/null | grep '^ii' | awk '{print $2}' | sed "s/php$phpenv_version-//" | while read ext
         # Skip core packages
         set -l is_core 0
         for core in $core_packages
@@ -837,9 +834,7 @@ end
 
 function __phpenv_provider_apt_ext_available -a phpenv_version
     # List available extensions from apt cache
-    apt-cache search "^php$phpenv_version-" 2>/dev/null | \
-        sed "s/php$phpenv_version-//" | awk '{print $1}' | \
-        grep -v -E '^(cli|common|fpm|cgi|phpdbg|dev)$' | sort | uniq
+    apt-cache search "^php$phpenv_version-" 2>/dev/null | sed "s/php$phpenv_version-//" | awk '{print $1}' | grep -v -E '^(cli|common|fpm|cgi|phpdbg|dev)$' | sort | uniq
 end
 
 function __phpenv_provider_apt_get_path_pattern
@@ -979,9 +974,9 @@ end
 function __phpenv_resolve_version_alias -a phpenv_version
     switch $phpenv_version
         case latest
-            __phpenv_parse_version_field "latest" "8.4"
+            __phpenv_parse_version_field latest "8.4"
         case nightly
-            __phpenv_parse_version_field "nightly" "8.5"
+            __phpenv_parse_version_field nightly "8.5"
         case '8.x'
             __phpenv_parse_version_field "8.x" "8.4"
         case '7.x'
@@ -997,7 +992,7 @@ function __phpenv_get_formula_name -a phpenv_version
     set -l phpenv_latest_version (__phpenv_parse_version_field "latest" "8.4")
 
     if test "$phpenv_version" = "$phpenv_latest_version"
-        echo "shivammathur/php/php"
+        echo shivammathur/php/php
     else
         echo "shivammathur/php/php@$phpenv_version"
     end
@@ -1140,7 +1135,7 @@ function __phpenv_use
     set -l phpenv_version $argv[1]
 
     # Handle special case: restore system PHP
-    if test "$phpenv_version" = "system"
+    if test "$phpenv_version" = system
         __phpenv_restore_system_path
         echo "Restored system PHP"
         return 0
@@ -1157,7 +1152,7 @@ function __phpenv_use
     end
 
     if not __phpenv_is_version_installed $phpenv_version
-        if test "$(__phpenv_config_get auto-install)" = "true"
+        if test "$(__phpenv_config_get auto-install)" = true
             __phpenv_install $phpenv_version
         else
             echo "PHP $phpenv_version is not installed. Install with: phpenv install $phpenv_version"
@@ -1179,7 +1174,7 @@ function __phpenv_local -a phpenv_version
         return 1
     end
 
-    echo $phpenv_version > .php-version
+    echo $phpenv_version >.php-version
     echo "Set local PHP version to $phpenv_version"
 end
 
@@ -1272,7 +1267,7 @@ function __phpenv_get_tap_versions
             continue
         end
 
-        if test "$phpenv_clean_name" = "php"
+        if test "$phpenv_clean_name" = php
             set -a phpenv_versions "$phpenv_latest_version (latest)"
         else if echo $phpenv_clean_name | grep -qE '^php@[0-9]+\.[0-9]+$'
             set -l phpenv_version (echo $phpenv_clean_name | sed 's/php@//')
@@ -1310,7 +1305,7 @@ function __phpenv_doctor
 
     # Show provider information
     set -l provider (__phpenv_get_provider)
-    set -l provider_source "auto-detected"
+    set -l provider_source auto-detected
     if set -q PHPENV_PROVIDER; and test -n "$PHPENV_PROVIDER"
         set provider_source "PHPENV_PROVIDER override"
     end
@@ -1429,7 +1424,7 @@ function __phpenv_config_get -a phpenv_key
         end
     end
 
-    if test "$argv[2]" = "--verbose"
+    if test "$argv[2]" = --verbose
         if test -n "$phpenv_value"
             echo "$phpenv_key = $phpenv_value (from $phpenv_source)"
         else
@@ -1581,19 +1576,18 @@ function __phpenv_get_tap_formulas -a tap_name
         return 1
     end
 
-    brew tap-info $tap_name --json 2>/dev/null | \
-        jq -r '.[]|(.formula_names[]?)' 2>/dev/null
+    brew tap-info $tap_name --json 2>/dev/null | jq -r '.[]|(.formula_names[]?)' 2>/dev/null
 end
 
 function __phpenv_get_available_extensions
-    __phpenv_get_tap_formulas "shivammathur/extensions"
+    __phpenv_get_tap_formulas shivammathur/extensions
 end
 
 function __phpenv_extension_available -a phpenv_extension phpenv_version
     set -l phpenv_available_extensions (__phpenv_get_available_extensions)
 
     if test -z "$phpenv_available_extensions"
-        return 0  # Assume available if can't check
+        return 0 # Assume available if can't check
     end
 
     for phpenv_ext_formula in $phpenv_available_extensions
@@ -1695,7 +1689,7 @@ function __phpenv_auto_switch --on-variable PWD
     end
 
     set -l phpenv_auto_switch (__phpenv_config_get auto-switch)
-    if test "$phpenv_auto_switch" = "false"
+    if test "$phpenv_auto_switch" = false
         return 0
     end
 
@@ -1718,7 +1712,7 @@ function __phpenv_auto_switch --on-variable PWD
         set -g PHPENV_LAST_SWITCH_TIME $phpenv_current_time
     else
         set -l phpenv_auto_install (__phpenv_config_get auto-install)
-        if test "$phpenv_auto_install" = "true"
+        if test "$phpenv_auto_install" = true
             echo "Auto-installing PHP $phpenv_new_version..."
             if phpenv install "$phpenv_new_version"
                 set -g PHPENV_LAST_SWITCH_TIME $phpenv_current_time
@@ -1771,7 +1765,7 @@ function __phpenv_help
 end
 
 function __phpenv_validate_boolean -a phpenv_value
-    test "$phpenv_value" = "true" -o "$phpenv_value" = "false"
+    test "$phpenv_value" = true -o "$phpenv_value" = false
 end
 
 function __phpenv_validate_version -a phpenv_version

config/fish/secrets.d/README.md

@@ -0,0 +1,72 @@
+# Fish Shell Secrets Directory
+
+This directory contains sensitive environment variables like API tokens and credentials.
+
+## Usage
+
+1. Copy an example file (e.g., `github.fish.example`) to remove the `.example` suffix:
+
+    ```bash
+    cp github.fish.example github.fish
+    ```
+
+2. Edit the file and replace placeholder values with your actual secrets:
+
+    ```bash
+    $EDITOR github.fish
+    ```
+
+3. Reload your fish shell or source the exports:
+
+    ```fish
+    source ~/.config/fish/exports.fish
+    ```
+
+## Adding New Secret Files
+
+Create a new `.fish` file in this directory with your environment variables:
+
+```fish
+# Example: openai.fish
+set -x OPENAI_API_KEY "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+```
+
+Common secret patterns:
+
+- `github.fish` - GitHub Personal Access Token (`GITHUB_TOKEN`)
+- `aws.fish` - AWS credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`)
+- `openai.fish` - OpenAI API key (`OPENAI_API_KEY`)
+- `anthropic.fish` - Anthropic API key (`ANTHROPIC_API_KEY`)
+
+## Security Best Practices
+
+- **Never commit actual secrets** - Only `.example` files are tracked by git
+- **Use specific permissions** - Consider `chmod 600` for secret files
+- **Rotate credentials regularly** - Update tokens when compromised
+- **Use environment-specific files** - Separate dev/staging/prod credentials
+- **Check before committing** - Run `git status` to verify secrets aren't staged
+
+## How It Works
+
+The `exports.fish` file automatically sources all `*.fish` files from this directory:
+
+```fish
+if test -d "$DOTFILES/config/fish/secrets.d"
+    for secret_file in "$DOTFILES/config/fish/secrets.d"/*.fish
+        if test -f "$secret_file"
+            source "$secret_file"
+        end
+    end
+end
+```
+
+Files ending in `.example` are ignored by the loader but tracked by git as templates.
+
+## Backward Compatibility
+
+This directory supplements the existing `exports-secret.fish` pattern. Both methods work:
+
+- **Legacy**: `config/fish/exports-secret.fish` (single file, still supported)
+- **New**: `config/fish/secrets.d/*.fish` (multiple files, recommended)
+
+Use whichever approach fits your workflow best.

config/fish/secrets.d/github.fish.example

@@ -0,0 +1,5 @@
+# GitHub Personal Access Token
+# Copy this file to github.fish (remove .example) and set your token
+# Generate token at: https://github.com/settings/tokens
+
+set -x GITHUB_TOKEN "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

config/fish/themes/Catppuccin Frappe.theme

@@ -58,3 +58,32 @@ fish_pager_color_progress 737994
 fish_pager_color_prefix f4b8e4
 fish_pager_color_completion c6d0f5
 fish_pager_color_description 737994
+
+[unknown]
+# preferred_background: 303446
+fish_color_normal c6d0f5
+fish_color_command 8caaee
+fish_color_param eebebe
+fish_color_keyword ca9ee6
+fish_color_quote a6d189
+fish_color_redirection f4b8e4
+fish_color_end ef9f76
+fish_color_comment 838ba7
+fish_color_error e78284
+fish_color_gray 737994
+fish_color_selection --background=414559
+fish_color_search_match --background=414559
+fish_color_option a6d189
+fish_color_operator f4b8e4
+fish_color_escape ea999c
+fish_color_autosuggestion 737994
+fish_color_cancel e78284
+fish_color_cwd e5c890
+fish_color_user 81c8be
+fish_color_host 8caaee
+fish_color_host_remote a6d189
+fish_color_status e78284
+fish_pager_color_progress 737994
+fish_pager_color_prefix f4b8e4
+fish_pager_color_completion c6d0f5
+fish_pager_color_description 737994

config/fish/themes/Catppuccin Macchiato.theme

@@ -58,3 +58,32 @@ fish_pager_color_progress 6e738d
 fish_pager_color_prefix f5bde6
 fish_pager_color_completion cad3f5
 fish_pager_color_description 6e738d
+
+[unknown]
+# preferred_background: 24273a
+fish_color_normal cad3f5
+fish_color_command 8aadf4
+fish_color_param f0c6c6
+fish_color_keyword c6a0f6
+fish_color_quote a6da95
+fish_color_redirection f5bde6
+fish_color_end f5a97f
+fish_color_comment 8087a2
+fish_color_error ed8796
+fish_color_gray 6e738d
+fish_color_selection --background=363a4f
+fish_color_search_match --background=363a4f
+fish_color_option a6da95
+fish_color_operator f5bde6
+fish_color_escape ee99a0
+fish_color_autosuggestion 6e738d
+fish_color_cancel ed8796
+fish_color_cwd eed49f
+fish_color_user 8bd5ca
+fish_color_host 8aadf4
+fish_color_host_remote a6da95
+fish_color_status ed8796
+fish_pager_color_progress 6e738d
+fish_pager_color_prefix f5bde6
+fish_pager_color_completion cad3f5
+fish_pager_color_description 6e738d

config/fish/themes/Catppuccin Mocha.theme

@@ -58,3 +58,32 @@ fish_pager_color_progress 6c7086
 fish_pager_color_prefix f5c2e7
 fish_pager_color_completion cdd6f4
 fish_pager_color_description 6c7086
+
+[unknown]
+# preferred_background: 1e1e2e
+fish_color_normal cdd6f4
+fish_color_command 89b4fa
+fish_color_param f2cdcd
+fish_color_keyword cba6f7
+fish_color_quote a6e3a1
+fish_color_redirection f5c2e7
+fish_color_end fab387
+fish_color_comment 7f849c
+fish_color_error f38ba8
+fish_color_gray 6c7086
+fish_color_selection --background=313244
+fish_color_search_match --background=313244
+fish_color_option a6e3a1
+fish_color_operator f5c2e7
+fish_color_escape eba0ac
+fish_color_autosuggestion 6c7086
+fish_color_cancel f38ba8
+fish_color_cwd f9e2af
+fish_color_user 94e2d5
+fish_color_host 89b4fa
+fish_color_host_remote a6e3a1
+fish_color_status f38ba8
+fish_pager_color_progress 6c7086
+fish_pager_color_prefix f5c2e7
+fish_pager_color_completion cdd6f4
+fish_pager_color_description 6c7086

config/gh/hosts.yml

@@ -1,6 +1,5 @@
----
 github.com:
-  git_protocol: https
-  users:
-    ivuorinen:
-  user: ivuorinen
+    git_protocol: ssh
+    users:
+        ivuorinen:
+    user: ivuorinen

config/git/ignore

@@ -7,6 +7,7 @@
 *-secret
 __secret
 __ignored
+__ignored/*
 __test_*.php
 __test_*.txt
 __test.php

config/git/overrides/.gitignore

@@ -1,2 +1,3 @@
 !.gitkeep
 config
+ignore

config/git/shared

@@ -19,8 +19,8 @@
 	logs = log --graph --pretty=format:'%C(magenta)%h%Creset -%C(red)%d%Creset %s %C(dim green)(%cr) %C(cyan)<%an>%Creset' --abbrev-commit
 	nah = !git reset --hard && git clean -df
 	recent = "!r() { count=$1; git for-each-ref --sort=-committerdate refs/heads --format='%(HEAD)%(color:yellow)%(refname:short)|%(color:bold green)%(committerdate:relative)|%(color:blue)%(subject)|%(color:magenta)%(authorname)%(color:reset)' --color=always --count=${count:=10} | column -ts'|';}; r"
-	reset-origin = !git fetch origin && git reset --hard origin/master && git clean -f -d
-	reset-upstream = !git fetch upstream && git reset --hard upstream/master && git clean -f -d
+	reset-origin = !git fetch origin && git reset --hard origin/HEAD && git clean -f -d
+	reset-upstream = !git fetch upstream && git reset --hard upstream/HEAD && git clean -f -d
 	rl = reflog --format='%C(auto)%h %<|(20)%gd %C(blue)%cr%C(reset) %gs (%s)'
 	tagdate = log --date-order --graph --tags --simplify-by-decoration --pretty=format:\"%ai %h %d\"
 	undo = reset --soft HEAD^

config/goenv/goenvrc

@@ -1,6 +0,0 @@
-# Detect shell
-if [ -n "$BASH_VERSION" ] || [ -n "$ZSH_VERSION" ]; then
-  export GOENV_PATH_ORDER=front
-  export GOENV_PREPEND_GOPATH=true
-  export GOENV_AUTO_INSTALL=true
-fi

config/goenv/goenvrc.fish

@@ -1,3 +0,0 @@
-set -gx GOENV_PATH_ORDER front
-set -gx GOENV_PREPEND_GOPATH true
-set -gx GOENV_AUTO_INSTALL true

config/homebrew/Brewfile

@@ -1,6 +1,8 @@
 tap "1password/tap"
 tap "anchore/grype"
+tap "caarlos0/tap"
 tap "cormacrelf/tap"
+tap "dagger/tap"
 tap "ddosify/tap"
 tap "dm3ch/tap"
 tap "doron-cohen/tap"
@@ -8,8 +10,7 @@ tap "gesquive/tap"
 tap "github/gh"
 tap "golangci/tap"
 tap "homebrew/autoupdate"
-tap "homebrew/bundle"
-tap "homebrew/services"
+tap "ivuorinen/tap"
 tap "jesseduffield/lazygit"
 tap "k8sgpt-ai/k8sgpt"
 tap "keith/formulae"
@@ -24,26 +25,6 @@ tap "snyk/tap"
 tap "tabbyml/tabby"
 tap "teamookla/speedtest"
 tap "xwmx/taps"
-# Run your GitHub Actions locally
-brew "act"
-# Simple, modern, secure file encryption
-brew "age"
-# Mozilla CA certificate store
-brew "ca-certificates"
-# Mozilla CA bundle for Python
-brew "certifi"
-# Cryptography and SSL/TLS Toolkit
-brew "openssl@3"
-# Cryptographic recipes and primitives for Python
-brew "cryptography"
-# YAML Parser
-brew "libyaml"
-# Display directories as trees (with optional color/HTML output)
-brew "tree"
-# Automate deployment, configuration, and upgrading
-brew "ansible"
-# Checks ansible playbooks for practices and behaviour
-brew "ansible-lint"
 # Generic-purpose lossless compression algorithm by Google
 brew "brotli"
 # Library and utilities for processing GIFs
@@ -54,6 +35,8 @@ brew "highway"
 brew "imath"
 # JPEG image codec that aids compression and decompression
 brew "jpeg-turbo"
+# Library for manipulating PNG images
+brew "libpng"
 # Zstandard is a real-time compression algorithm
 brew "zstd"
 # New file format for still image compression
@@ -62,6 +45,10 @@ brew "jpeg-xl"
 brew "aom"
 # Apache Portable Runtime library
 brew "apr"
+# Mozilla CA certificate store
+brew "ca-certificates"
+# Cryptography and SSL/TLS Toolkit
+brew "openssl@3"
 # Companion library to apr, the Apache Portable Runtime library
 brew "apr-util"
 # Password hashing library and CLI utility
@@ -80,18 +67,12 @@ brew "pkgconf"
 brew "autogen"
 # Tool for generating GNU Standards-compliant Makefiles
 brew "automake"
-# Official Amazon AWS command-line interface
-brew "awscli"
 # GNU internationalization (i18n) and localization (l10n) library
 brew "gettext"
+# Text-based UI library
+brew "ncurses"
 # Bourne-Again SHell, a UNIX command interpreter
 brew "bash"
-# Clone of cat(1) with syntax highlighting and Git integration
-brew "bat"
-# GNU File, Shell, and Text utilities
-brew "coreutils"
-# Bash Automated Testing System
-brew "bats-core"
 # Parser generator
 brew "bison"
 # Freely available high-quality data compressor
@@ -102,47 +83,27 @@ brew "freetype"
 brew "fontconfig"
 # Core application library for C
 brew "glib"
-# Binary installation for rust projects
-brew "cargo-binstall"
-# Multi-platform support library with a focus on asynchronous I/O
-brew "libuv"
-# Open-source, cross-platform JavaScript runtime environment
-brew "node", link: false
-# CLI tool for analyzing Claude Code usage from local JSONL files
-brew "ccusage"
-# JSON Schema CLI
-brew "check-jsonschema"
-# Prevent cloud misconfigurations during build-time for IaC tools
-brew "checkov"
-# Human-friendly and fast alternative to cut and (sometimes) awk
-brew "choose-rust"
-# Cross-platform make
-brew "cmake"
+# Mozilla CA bundle for Python
+brew "certifi"
+# GNU File, Shell, and Text utilities
+brew "coreutils"
+# Cryptographic recipes and primitives for Python
+brew "cryptography"
 # Get a file from an HTTP, HTTPS or FTP server
 brew "curl"
-# Network authentication protocol
-brew "krb5"
 # OpenType text shaping engine
 brew "harfbuzz"
 # OWASP dependency-check
 brew "dependency-check"
 # Lightweight DNS forwarder and DHCP server
 brew "dnsmasq"
+# .NET Core
+brew "dotnet@8", link: true
 # Spellchecker wrapping library
 brew "enchant"
-# Command-line tool to interact with exercism.io
-brew "exercism"
 # Perl lib for reading and writing EXIF metadata
 brew "exiftool"
-# Validating, recursive, caching DNS resolver
-brew "unbound"
-# GNU Transport Layer Security (TLS) Library
-brew "gnutls"
-# Secure hashing function
-brew "libb2"
-# Framework for layout and rendering of i18n text
-brew "pango"
-# Play, record, convert, and stream audio and video
+# Play, record, convert, and stream select audio and video codecs
 brew "ffmpeg"
 # Banner-like program prints strings as ASCII art
 brew "figlet"
@@ -154,78 +115,74 @@ brew "flock"
 brew "freetds"
 # Monitor a directory for changes and run a shell command
 brew "fswatch"
-# Command-line fuzzy finder written in Go
-brew "fzf"
 # Graphics library to dynamically manipulate images
 brew "gd"
-# Disk usage analyzer with console interface written in Go
-brew "gdu"
-# GitHub command-line tool
-brew "gh"
+# Conversion library
+brew "libiconv"
 # Distributed revision control system
 brew "git"
-# Enable transparent encryption/decryption of files in a git repo
-brew "git-crypt"
 # Small git utilities
 brew "git-extras"
-# Browse your latest git branches, formatted real fancy
-brew "git-recent"
-# Render markdown on the CLI
-brew "glow"
 # GNU implementation of the famous stream editor
 brew "gnu-sed"
-# GNU Pretty Good Privacy (PGP) package
+# Validating, recursive, caching DNS resolver
+brew "unbound"
+# GNU Transport Layer Security (TLS) Library
+brew "gnutls"
+# GNU Privacy Guard (OpenPGP)
 brew "gnupg"
-# Go version management
-brew "goenv"
 # Library access to GnuPG
 brew "gpgme"
 # Manage your GnuPG keys with ease!
 brew "gpg-tui"
 # Image manipulation
 brew "netpbm"
+# Framework for layout and rendering of i18n text
+brew "pango"
 # Library to render SVG files using Cairo
 brew "librsvg"
 # Graph visualization software from AT&T and Bell Labs
 brew "graphviz"
 # GNU grep, egrep and fgrep
 brew "grep"
-# Vulnerability scanner for container images and filesystems
-brew "grype"
 # Popular GNU data compression program
 brew "gzip"
+# Secure hashing function
+brew "libb2"
 # Improved top (interactive process viewer)
 brew "htop"
 # Portable abstraction of the hierarchical topology of modern architectures
 brew "hwloc"
 # ISO/IEC 23008-12:2017 HEIF file format decoder and encoder
 brew "libheif"
-# Tools and libraries to manipulate images in many formats
+# Tools and libraries to manipulate images in select formats
 brew "imagemagick"
 # Modular IRC client
 brew "irssi"
 # Image manipulation library
 brew "jpeg"
-# Lightweight and flexible command-line JSON processor
-brew "jq"
 # JSON parser for C
 brew "json-c"
-# Crawling and spidering framework
-brew "katana"
-# Style and grammar checker
-brew "languagetool"
-# Tool to detect/remediate misconfig and security risks of GitHub/GitLab assets
-brew "legitify"
+# Code coverage tester for compiled programs, Python, and shell scripts
+brew "kcov"
+# Network authentication protocol
+brew "krb5"
 # BSD-style licensed readline alternative
 brew "libedit"
-# Conversion library
-brew "libiconv"
+# Postgres C API library
+brew "libpq"
 # Version of the SSL/TLS protocol forked from OpenSSL
 brew "libressl"
+# Multi-platform support library with a focus on asynchronous I/O
+brew "libuv"
 # Linguistic software and Finnish dictionary
 brew "libvoikko"
 # GNOME XML library
 brew "libxml2"
+# YAML Parser
+brew "libyaml"
+# C library for reading, creating, and modifying zip archives
+brew "libzip"
 # Package manager for the Lua programming language
 brew "luarocks"
 # LZMA-based compression program similar to gzip or bzip2
@@ -244,8 +201,6 @@ brew "nginx"
 brew "nmap"
 # Libraries for security-enabled client and server applications
 brew "nss"
-# Command-line Git information tool
-brew "onefetch"
 # General-purpose speech recognition model
 brew "openai-whisper"
 # Open source suite of directory software
@@ -255,55 +210,33 @@ brew "ossp-uuid"
 # General-purpose scripting language
 brew "php", link: false
 # General-purpose scripting language
+brew "php@8.1"
+# General-purpose scripting language
 brew "php@8.2", link: true
 # General-purpose scripting language
 brew "php@8.3"
-# Pins GitHub Actions to full hashes and versions
-brew "pinact"
-# Python version management
-brew "pyenv"
-# Migrate pip packages from one Python version to another
-brew "pyenv-pip-migrate"
-# Pyenv plugin to manage virtualenv
-brew "pyenv-virtualenv"
+# Execute binaries from Python packages in isolated environments
+brew "pipx"
+# Easily download, build, install, upgrade, and uninstall Python packages
+brew "python-setuptools"
 # Interpreted, interactive, object-oriented programming language
 brew "python@3.11"
-# Install various Ruby versions and implementations
-brew "ruby-build"
-# Ruby version manager
-brew "rbenv"
+# Interpreted, interactive, object-oriented programming language
+brew "python@3.13"
 # Generate C-based recognizers from regular expressions
 brew "re2c"
-# Rust toolchain installer
-brew "rustup"
-# Static analysis and lint tool, for (ba)sh scripts
-brew "shellcheck"
-# User interface to the TELNET protocol
-brew "telnet"
 # Send macOS User Notifications from the command-line
 brew "terminal-notifier"
 # Tool which checks for the support of TLS/SSL ciphers and flaws
 brew "testssl"
-# Terraform version manager inspired by rbenv
-brew "tfenv"
-# Linter for Terraform files
-brew "tflint"
-# Static analysis security scanner for your terraform code
-brew "tfsec"
 # Terminal multiplexer
 brew "tmux"
-# Extremely fast Python package installer and resolver, written in Rust
-brew "uv"
-# Tool for creating isolated virtual python environments
-brew "virtualenv"
-# Command-line interface to the WakaTime api
-brew "wakatime-cli"
+# Display directories as trees (with optional color/HTML output)
+brew "tree"
 # Executes a program periodically, showing output fullscreen
 brew "watch"
 # Internet file retriever
 brew "wget"
-# Check your $HOME for unwanted files and directories
-brew "xdg-ninja", args: ["HEAD"]
 # General-purpose lossless data-compression library
 brew "zlib"
 # Watcher for macOS 10.14+ light/dark mode changes
@@ -314,34 +247,50 @@ brew "doron-cohen/tap/antidot"
 brew "gesquive/tap/git-user"
 # Simple hotkey-daemon for macOS.
 brew "koekeishiya/formulae/skhd"
-# Automated code review tool integrated with any code analysis tools regardless of programming language.
-brew "reviewdog/tap/reviewdog"
-# Igbinary PHP extension
-brew "shivammathur/extensions/igbinary@8.3"
+# Imagick PHP extension
+brew "shivammathur/extensions/imagick@8.1"
+# Imagick PHP extension
+brew "shivammathur/extensions/imagick@8.2"
 # Imagick PHP extension
 brew "shivammathur/extensions/imagick@8.3"
+# Imagick PHP extension
+brew "shivammathur/extensions/imagick@8.4"
 # Mcrypt PHP extension
 brew "shivammathur/extensions/mcrypt@8.3"
 # Msgpack PHP extension
 brew "shivammathur/extensions/msgpack@8.3"
 # PCOV PHP extension
+brew "shivammathur/extensions/pcov@8.1"
+# PCOV PHP extension
+brew "shivammathur/extensions/pcov@8.2"
+# PCOV PHP extension
 brew "shivammathur/extensions/pcov@8.3"
 # Redis PHP extension
-brew "shivammathur/extensions/redis@8.3"
+brew "shivammathur/extensions/phpredis@8.3"
 # Uuid PHP extension
 brew "shivammathur/extensions/uuid@8.3"
+# Xdebug PHP extension
+brew "shivammathur/extensions/xdebug@8.1"
+# Xdebug PHP extension
+brew "shivammathur/extensions/xdebug@8.2"
+# Xdebug PHP extension
+brew "shivammathur/extensions/xdebug@8.4"
+# Xdebug PHP extension
+brew "shivammathur/extensions/xdebug@8.5"
 # Yaml PHP extension
 brew "shivammathur/extensions/yaml@8.3"
 # General-purpose scripting language
-brew "shivammathur/php/php-debug"
+brew "shivammathur/php/php-debug", link: false
+# General-purpose scripting language
+brew "shivammathur/php/php@8.1-debug"
 # General-purpose scripting language
 brew "shivammathur/php/php@8.2-debug"
-# Find & fix known vulnerabilities in open-source dependencies
-brew "snyk/tap/snyk"
-# Tabby: AI Coding Assistant
-brew "tabbyml/tabby/tabby"
+# General-purpose scripting language
+brew "shivammathur/php/php@8.4"
 # Command-line interface for 1Password
 cask "1password-cli"
+# Semantic code analysis engine
+cask "codeql"
 # Universal database tool and SQL client
 cask "dbeaver-community"
 # Database version management tool
@@ -407,6 +356,8 @@ cask "thonny"
 cask "todoist-app"
 # Configuration application for the Ultimate Hacking Keyboard
 cask "uhk-agent"
+# Google Chromium, sans integration with Google
+cask "ungoogled-chromium"
 # Open-source code editor
 cask "visual-studio-code"
 # Multimedia player
@@ -415,7 +366,7 @@ cask "vlc"
 cask "voikkospellservice"
 # GPU-accelerated cross-platform terminal emulator and multiplexer
 cask "wezterm"
-# Application for generating TOTP and HOTP codes
+# Full-featured companion app to the YubiKey
 cask "yubico-authenticator"
 # Multiplayer code editor
 cask "zed"

config/husky/init.sh

@@ -1,4 +1,2 @@
 #!/usr/bin/env bash
-
-[[ -z "$NVM_DIR" ]] && export NVM_DIR="$HOME/.config/nvm"
-[[ -s "$NVM_DIR/nvm.sh" ]] && \. "$NVM_DIR/nvm.sh" # This loads nvm
+eval "$(mise activate --shims)"

config/karabiner/karabiner.json

@@ -1,68 +1,68 @@
 {
-  "profiles": [
-    {
-      "complex_modifications": {
-        "rules": [
-          {
-            "description": "Change right_command+hjkl to arrow keys",
-            "manipulators": [
-              {
-                "from": {
-                  "key_code": "h",
-                  "modifiers": {
-                    "mandatory": ["right_command"],
-                    "optional": ["any"]
-                  }
-                },
-                "to": [{ "key_code": "left_arrow" }],
-                "type": "basic"
-              },
-              {
-                "from": {
-                  "key_code": "j",
-                  "modifiers": {
-                    "mandatory": ["right_command"],
-                    "optional": ["any"]
-                  }
-                },
-                "to": [{ "key_code": "down_arrow" }],
-                "type": "basic"
-              },
-              {
-                "from": {
-                  "key_code": "k",
-                  "modifiers": {
-                    "mandatory": ["right_command"],
-                    "optional": ["any"]
-                  }
-                },
-                "to": [{ "key_code": "up_arrow" }],
-                "type": "basic"
-              },
-              {
-                "from": {
-                  "key_code": "l",
-                  "modifiers": {
-                    "mandatory": ["right_command"],
-                    "optional": ["any"]
-                  }
-                },
-                "to": [{ "key_code": "right_arrow" }],
-                "type": "basic"
-              }
-            ]
-          }
-        ]
-      },
-      "name": "Default profile",
-      "selected": true,
-      "simple_modifications": [
+    "profiles": [
         {
-          "from": { "key_code": "caps_lock" },
-          "to": [{ "key_code": "f18" }]
+            "complex_modifications": {
+                "rules": [
+                    {
+                        "description": "Change right_command+hjkl to arrow keys",
+                        "manipulators": [
+                            {
+                                "from": {
+                                    "key_code": "h",
+                                    "modifiers": {
+                                        "mandatory": ["right_command"],
+                                        "optional": ["any"]
+                                    }
+                                },
+                                "to": [{ "key_code": "left_arrow" }],
+                                "type": "basic"
+                            },
+                            {
+                                "from": {
+                                    "key_code": "j",
+                                    "modifiers": {
+                                        "mandatory": ["right_command"],
+                                        "optional": ["any"]
+                                    }
+                                },
+                                "to": [{ "key_code": "down_arrow" }],
+                                "type": "basic"
+                            },
+                            {
+                                "from": {
+                                    "key_code": "k",
+                                    "modifiers": {
+                                        "mandatory": ["right_command"],
+                                        "optional": ["any"]
+                                    }
+                                },
+                                "to": [{ "key_code": "up_arrow" }],
+                                "type": "basic"
+                            },
+                            {
+                                "from": {
+                                    "key_code": "l",
+                                    "modifiers": {
+                                        "mandatory": ["right_command"],
+                                        "optional": ["any"]
+                                    }
+                                },
+                                "to": [{ "key_code": "right_arrow" }],
+                                "type": "basic"
+                            }
+                        ]
+                    }
+                ]
+            },
+            "name": "Default profile",
+            "selected": true,
+            "simple_modifications": [
+                {
+                    "from": { "key_code": "caps_lock" },
+                    "to": [{ "key_code": "f18" }]
+                }
+            ],
+            "virtual_hid_keyboard": { "keyboard_type_v2": "iso" }
         }
-      ],
-      "virtual_hid_keyboard": { "keyboard_type_v2": "iso" }
-    }
-  ]
+    ]
 }

config/mise/config.toml

@@ -0,0 +1,122 @@
+[tools]
+# Language runtimes
+node = "lts"
+python = "3"
+go = "latest"
+rust = "stable"
+
+# Pre-built binaries via aqua registry
+fd = "latest"
+ripgrep = "latest"
+eza = "latest"
+bottom = "latest"
+zoxide = "latest"
+tree-sitter = "latest"
+neovim = "latest" # Neovim editor binary
+delta = "latest"
+difftastic = "latest"
+
+# GitHub releases (no aqua entry)
+"github:dimo414/bkt" = "latest"
+"github:jrmoulton/tmux-sessionizer" = "latest"
+
+# Go-compiled tools (no registry binary available)
+"go:github.com/joshmedeski/sesh/v2" = "latest"
+"go:github.com/dotzero/git-profile" = "latest"
+
+# Registry shorthands (aqua binaries)
+yamlfmt = "latest"
+cheat = "latest"
+glow = "latest"
+fzf = "latest"
+gum = "latest"
+
+# npm-based tools
+editorconfig-checker = "latest"
+"npm:github-release-notes" = "latest"
+"npm:neovim" = "latest" # Node.js client for Neovim's RPC API (required by plugins)
+"npm:corepack" = "latest"
+
+# Python tools (via pipx backend)
+"pipx:detect-secrets" = "latest"
+"pipx:git-filter-repo" = "latest"
+yamllint = "latest"
+ansible = "latest"
+"pipx:ansible-lint" = "latest"
+ruff = "latest"
+"pipx:openapi-python-client" = "latest"
+"pipx:python-lsp-server[websockets]" = "latest"
+
+# .NET tools (via dotnet backend)
+"dotnet:coverlet.console" = "latest"
+"dotnet:csharpier" = "latest"
+"dotnet:ilspycmd" = "latest"
+"dotnet:dotnet-ef" = "latest"
+
+# DevOps & security tools
+act = "latest"
+age = "latest"
+aws-cli = "latest"
+checkov = "latest"
+grype = "latest"
+pinact = "latest"
+snyk = "latest"
+cosign = "latest"
+gitleaks = "latest"
+syft = "latest"
+
+# Dev tools (pre-built binaries)
+gitui = "latest"
+lazygit = "latest"
+bat = "latest"
+bats = "latest"
+choose = "latest"
+cmake = "latest"
+gdu = "latest"
+github-cli = "latest"
+jq = "latest"
+hadolint = "latest"
+hugo = "latest"
+just = "latest"
+yq = "latest"
+"github:exercism/cli" = "latest"
+"github:projectdiscovery/katana" = "latest"
+"github:Legit-Labs/legitify" = "latest"
+shellcheck = "latest"
+shfmt = "latest"
+stylua = "latest"
+actionlint = "latest"
+"aqua:mpalmer/action-validator" = "latest"
+oh-my-posh = "latest"
+"github:o2sh/onefetch" = "latest"
+"github:wakatime/wakatime-cli" = "latest"
+
+# Terraform (replaces tfenv)
+terraform = "latest"
+tflint = "latest"
+tfsec = "latest"
+
+# Other useful tools
+uv = "latest"
+
+[settings]
+trusted_config_paths = [
+  "~/Code/ivuorinen",
+  "~/Code/s",
+  "~/Code/masf",
+]
+# Respect .nvmrc, .python-version, .ruby-version, etc. in other projects.
+# This repo uses .mise.toml at the repo root for pinned versions.
+idiomatic_version_file = true
+idiomatic_version_file_enable_tools = [
+  "node", "python", "ruby", "go", "java",
+  "terraform", "yarn", "bun", "deno", "dotnet",
+]
+
+# Generate mise.lock for reproducible installs
+lockfile = true
+
+# Save disk space — don't keep downloaded archives or failed installs
+always_keep_download = false
+always_keep_install = false
+experimental = true

config/nvim/init.lua

@@ -2,7 +2,7 @@
 -- │            ivuorinen's Neovim configuration             │
 -- ╰─────────────────────────────────────────────────────────╯
 
--- ── Install lazylazy ────────────────────────────────────────────────
+-- ── Install lazy ────────────────────────────────────────────────────
 -- https://github.com/folke/lazy.nvim
 local lazypath = vim.fn.stdpath 'data' .. '/lazy/lazy.nvim'
 if not (vim.uv or vim.loop).fs_stat(lazypath) then
@@ -27,8 +27,12 @@ if not (vim.uv or vim.loop).fs_stat(lazypath) then
 end
 vim.opt.rtp:prepend(lazypath)
 
--- ── Add ~/.local/bin to the PATH ────────────────────────────────────
-vim.fn.setenv('PATH', vim.fn.expand '$HOME/.local/bin' .. ':' .. vim.fn.expand '$PATH')
+-- ── Add mise shims and ~/.local/bin to the PATH ───────────────────────
+vim.env.PATH = vim.env.HOME
+  .. '/.local/share/mise/shims:'
+  .. vim.env.HOME
+  .. '/.local/bin:'
+  .. vim.env.PATH
 
 require 'options'
 require 'autogroups'
@@ -53,7 +57,7 @@ require('lazy').setup(
       path = '~/Code/nvim', -- Load wip plugins from this path
     },
     install = {
-      colorscheme = { vim.g.colors_theme },
+      colorscheme = { 'catppuccin' },
     },
     profiling = {
       loader = true,
@@ -61,8 +65,6 @@ require('lazy').setup(
   }
 )
 
--- require('nvm-default').setup()
-
 require 'keymaps'
 
 -- vim: set ts=2 sts=2 sw=2 wrap et :

config/nvim/lua/keymaps.lua

@@ -28,7 +28,6 @@ K.d('<C-k>', { 'n', 'v' }, ":m '<-2<CR>gv=gv", 'Move Block Up')
 K.d('<C-j>', { 'n', 'v' }, ":m '>+1<CR>gv=gv", 'Move Block Down')
 
 -- ── Other operations ────────────────────────────────────────────────
-K.nl('o', function() require('snacks').gitbrowse() end, 'Open repo in browser')
 K.n('<C-s>', ':w!<cr>', { desc = 'Save', noremap = true })
 K.n('<esc><esc>', ':nohlsearch<cr>', { desc = 'Clear Search Highlighting' })
 
@@ -59,7 +58,6 @@ K.ld('cci', 'n', function() b().lsp_incoming_calls() end, 'Incoming calls')
 K.ld('cco', 'n', function() b().lsp_outgoing_calls() end, 'Outgoing calls')
 K.ld('cd', 'n', function() b().lsp_definitions() end, 'Definitions')
 K.ld('cf', { 'n', 'x' }, ':lua vim.lsp.buf.format()<CR>', 'Format')
-K.ld('cg', 'n', ':lua require("neogen").generate()<CR>', 'Generate annotations')
 K.ld('ci', 'n', function() b().lsp_implementations() end, 'Implementations')
 K.ld('cp', 'n', function() b().lsp_type_definitions() end, 'Type Definition')
 K.ld('cr', 'n', vim.lsp.buf.rename, 'Rename')

config/nvim/lua/nvm-default/init.lua

@@ -1,120 +0,0 @@
--- Get nvm default version and use it in node_host_prog
--- and g.copilot_node_command.
---
--- This module automatically configures Neovim to use the default Node.js version
--- from NVM. It requires a working NVM installation and 'default' alias to be set,
--- and also neovim npm package to be installed.
---
--- You can install the neovim package by running:
--- npm i --global neovim
---
--- Usage:
---   require('nvm-default').setup({
---     add_to_path = true,        -- optional: add NVM bin directory to PATH
---     nvm_path = "~/.nvm",      -- optional: custom NVM installation path
---     notify_level = "info"     -- optional: notification level
---   })
-
-local M = {}
-
-M.name = 'nvm-default.nvim'
-M.version = '0.1.0' -- x-release-please-version
-
--- Helper function to run a shell command
----@param cmd string Run a shell command
----@return string? Return the result of the command
-local function run_command(cmd)
-  local result = vim.fn.system(cmd)
-  return vim.v.shell_error == 0 and result:gsub('%s+$', '') or nil
-end
-
--- Helper function to show a notification
----@param msg string Show a message
----@param level "info"|"warn"|"error"|"trace" Notification level
-local function n(msg, level)
-  if msg == nil then msg = M.name .. ': No message provided' end
-  if level == nil then level = 'trace' end
-
-  local log_level = vim.log.levels.INFO
-
-  if level == 'info' then
-    log_level = vim.log.levels.INFO
-  elseif level == 'warn' then
-    log_level = vim.log.levels.WARN
-  elseif level == 'error' then
-    log_level = vim.log.levels.ERROR
-  elseif level == 'trace' then
-    log_level = vim.log.levels.TRACE
-  end
-
-  vim.notify(M.name .. ': ' .. msg, log_level)
-end
-
----@class NvmDefaultOptions
----@field add_to_path boolean Add found NVM bin directory to PATH
----@field nvm_path string Where nvm installation is located
----@field notify_level number|"info"|"warn"|"error"|"trace" Notification level filter
-
--- Default options
----@type NvmDefaultOptions
-M.defaults = {
-  add_to_path = vim.g.nvm_default_add_to_path or true,
-  nvm_path = vim.fn.expand(os.getenv 'NVM_DIR' or '~/.nvm'),
-  notify_level = vim.g.nvm_default_notify_level or 'info',
-}
-
--- Fetch the NVM default version or fallback to node version
----@param opts? NvmDefaultOptions Plugin options
-function M.setup(opts)
-  local options = vim.tbl_deep_extend('force', M.defaults, opts or {})
-
-  local nvm_path = options.nvm_path
-  local node_version = run_command(
-    string.format('. %s/nvm.sh && nvm version default', nvm_path)
-  ) or run_command(string.format('. %s/nvm.sh && nvm version node', nvm_path)) or nil
-
-  if node_version and node_version:match '^v' then
-    -- Set vim.g.node_host_prog and vim.g.copilot_node_command
-    local current_nvm_version_path =
-      string.format('%s/versions/node/%s', nvm_path, node_version)
-    local current_nvm_node_bin_path = string.format('%s/bin', current_nvm_version_path)
-    local current_nvm_node_bin = string.format('%s/node', current_nvm_node_bin_path)
-    local neovim_node_host_bin_path =
-      string.format('%s/neovim-node-host', current_nvm_node_bin_path)
-
-    -- Collect missing files and directories errors for error output
-    local missing = {}
-
-    -- If node_dir isn't there, stop and show error
-    if not vim.fn.isdirectory(current_nvm_version_path) then
-      table.insert(missing, 'Node.js directory: ' .. current_nvm_version_path)
-    end
-
-    -- If node_bin isn't there, stop and show error
-    if not vim.fn.filereadable(current_nvm_node_bin) then
-      table.insert(missing, 'Node.js binary: ' .. current_nvm_node_bin)
-    end
-
-    if not vim.fn.filereadable(neovim_node_host_bin_path) then
-      table.insert(missing, 'Neovim host binary: ' .. neovim_node_host_bin_path)
-    end
-
-    if #missing > 0 then
-      n('Missing required files:\n- ' .. table.concat(missing, '\n- '), 'error')
-      return
-    end
-
-    -- Add to PATH if requested. Can be turned off by setting if it messes with
-    -- other tools.
-    if options.add_to_path then
-      vim.env.PATH = current_nvm_node_bin_path .. ':' .. vim.env.PATH
-    end
-
-    vim.g.node_host_prog = neovim_node_host_bin_path
-    vim.g.copilot_node_command = current_nvm_node_bin
-  else
-    n('Unable to determine the Node.js version from nvm.', 'error')
-  end
-end
-
-return M

config/nvim/lua/options.lua

@@ -13,10 +13,6 @@ local a = vim.api -- A table to store API functions
 g.mapleader = ' ' -- Space as the leader key
 g.maplocalleader = ' ' -- Space as the local leader key
 
--- g.colors_theme = 'onedark' -- Set the colorscheme
--- g.colors_variant_light = 'tokyonight-day' -- Set the light variant
--- g.colors_variant_dark = 'tokyonight-storm' -- Set the dark variant
-
 g.editorconfig = true -- Make sure editorconfig support is enabled
 g.loaded_perl_provider = 0 -- Disable perl provider
 g.loaded_ruby_provider = 0 -- Disable ruby provider

config/nvim/lua/plugins/blink.lua

@@ -1,6 +1,6 @@
 return {
   -- Performant, batteries-included completion plugin for Neovim
-  -- https:/github.com/saghen/blink.cmp
+  -- https://github.com/saghen/blink.cmp
   {
     'saghen/blink.cmp',
     version = '*',

config/nvim/lua/plugins/code.lua

@@ -24,7 +24,14 @@ return {
   -- https://github.com/fatih/vim-go
   {
     'fatih/vim-go',
-    config = function() end,
+    ft = 'go',
+    config = function()
+      vim.g.go_def_mode = 'gopls'
+      vim.g.go_info_mode = 'gopls'
+      vim.g.go_fmt_autosave = 0
+      vim.g.go_imports_autosave = 0
+      vim.g.go_mod_fmt_autosave = 0
+    end,
   },
 
   -- Clarify and beautify your comments using boxes and lines.

config/nvim/lua/plugins/lsp.lua

@@ -223,7 +223,7 @@ return {
               vim.env.VIMRUNTIME,
             }
             client.config.settings.Lua.runtime = { version = 'LuaJIT' }
-            client.notify(
+            client:notify(
               'workspace/didChangeConfiguration',
               { settings = client.config.settings }
             )

config/nvim/lua/plugins/ui.lua

@@ -89,15 +89,12 @@ return {
     'f-person/auto-dark-mode.nvim',
     opts = {
       update_interval = 1000,
+      -- stylua: ignore
       set_dark_mode = function()
         vim.api.nvim_set_option_value('background', 'dark', {})
-        -- vim.cmd.colorscheme(vim.g.colors_variant_dark)
-        -- vim.cmd 'colorscheme rose-pine'
       end,
       set_light_mode = function()
         vim.api.nvim_set_option_value('background', 'light', {})
-        -- vim.cmd.colorscheme(vim.g.colors_variant_light)
-        -- vim.cmd 'colorscheme rose-pine-dawn'
       end,
     },
   },

config/nvim/lua/utils.lua

@@ -100,5 +100,6 @@ function GetIntelephenseLicense()
   local f = assert(io.open(p, 'rb'))
   local content = f:read '*a'
   f:close()
-  return string.gsub(content, '%s+', '')[1] or nil
+  local stripped = string.gsub(content, '%s+', '')
+  return stripped == '' and nil or stripped
 end

config/nvm/default-packages

@@ -1,5 +0,0 @@
-# $NVM_DIR/default-packages
-
-yarn
-neovim
-corepack

config/sesh/sesh.toml

@@ -8,8 +8,11 @@
 #
 # Smart session manager for the terminal
 # https://github.com/joshmedeski/sesh
+#:schema https://github.com/joshmedeski/sesh/raw/main/sesh.schema.json
 
 strict_mode = false
+dir_length = 2  # Uses last 2 directories: "projects/sesh" instead of just "sesh"
+cache = true
 
 # [marker]
 # inactivity_threshold = 10    # Seconds before alerts start
@@ -52,3 +55,7 @@ disable_startup_command = true
 name = "Downloads"
 path = "~/Downloads"
 startup_command = "lsa"
+
+[[session]]
+name = "Code/ivuorinen"
+path = "~/Code/ivuorinen/"

config/shared.sh

@@ -71,7 +71,6 @@ x-set-env XDG_BIN_HOME "$HOME/.local/bin"
 x-path-prepend "/usr/local/bin"
 x-path-prepend "/opt/homebrew/bin"
 x-path-prepend "$XDG_DATA_HOME/cargo/bin"
-x-path-prepend "$XDG_DATA_HOME/bob/nvim-bin"
 x-path-prepend "$DOTFILES/local/bin"
 x-path-prepend "$XDG_BIN_HOME"
 

config/tmux/tmux.conf

@@ -16,6 +16,7 @@
 # -u : Unset the specified option.
 
 set -as terminal-features ",xterm-256color:RGB:clipboard:usstyle:strikethrough:overline"
+set -g allow-passthrough on             # Let apps query outer terminal (OSC 11 for fish theme detection)
 
 set -s escape-time 0                    # Address vim mode switching delay
 set -s set-clipboard on                 # System clipboard via OSC 52

config/vim/vimrc

@@ -3,6 +3,9 @@
 "
 " vim: ts=2 sw=2 expandtab
 " vint: +ProhibitAbbreviationOption +ProhibitSetNoCompatible
+
+" mise — add shims to PATH for tool discovery
+let $PATH = $HOME . '/.local/bin:' . $HOME . '/.local/share/mise/shims:' . $PATH
 "*****************************************************************************
 "" Vim-Plug core
 "*****************************************************************************

config/wezterm/wezterm.lua

@@ -10,7 +10,7 @@ config.color_scheme_dirs = {
 }
 
 -- Font and font size
-config.font_size = 16
+config.font_size = 12
 config.font = wezterm.font_with_fallback {
   {
     family = 'Monaspace Argon NF',
@@ -48,9 +48,9 @@ config.window_background_opacity = 0.97
 config.window_decorations = 'RESIZE'
 config.macos_window_background_blur = 10
 config.window_padding = {
-  left = 5,
-  right = 5,
-  top = 5,
+  left = 10,
+  right = 10,
+  top = 10,
   bottom = 5,
 }
 

config/zsh/antidote.zsh

@@ -18,7 +18,6 @@
 # Plugin configurations
 zstyle ':antidote:bundle' use-friendly-names 'yes'
 zstyle ':omz:update' mode reminder
-zstyle ':omz:plugins:nvm' autoload yes
 
 # Pure prompt settings
 export PURE_PROMPT_SYMBOL='➜'

config/zsh/antidote_plugins.txt

@@ -24,14 +24,10 @@ ohmyzsh/ohmyzsh path:plugins/fzf
 ohmyzsh/ohmyzsh path:plugins/git
 ohmyzsh/ohmyzsh path:plugins/golang
 ohmyzsh/ohmyzsh path:plugins/gpg-agent
-ohmyzsh/ohmyzsh path:plugins/nvm
 ohmyzsh/ohmyzsh path:plugins/python
 # ohmyzsh/ohmyzsh path:plugins/tmux
 ohmyzsh/ohmyzsh path:plugins/z
 
-# Automatically activate nvm if .nvmrc file is present
-ivuorinen/nvm-auto-use
-
 # Add core plugins that make Zsh a bit more like Fish
 zdharma-continuum/fast-syntax-highlighting
 

config/zsh/p10k.zsh

@@ -61,7 +61,7 @@
     vcs                       # git status
     # command_execution_time    # previous command duration
     go
-    nvm
+    asdf
     aws
     # =========================[ Line #2 ]=========================
     newline                   # \n
@@ -121,8 +121,8 @@
   # Don't show context unless root or in SSH.
   # typeset -g POWERLEVEL9K_CONTEXT_{DEFAULT,SUDO}_CONTENT_EXPANSION=
 
-  # aws, go and nvm versions colors.
-  typeset -g POWERLEVEL9K_{AWS,GO,NVM}_FOREGROUND=$grey
+  # aws, go and asdf versions colors.
+  typeset -g POWERLEVEL9K_{AWS,GO,ASDF}_FOREGROUND=$grey
 
   # Show previous command duration only if it's >= 86400s = 24h.
   typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_THRESHOLD=86400

config/zsh/plugins/nvm-auto-use/nvm-auto-use.plugin.zsh

@@ -1,26 +0,0 @@
-# shellcheck disable=SC1071,SC1103,SC2148
-# Source: https://github.com/nvm-sh/nvm#zsh
-# place this after nvm initialization!
-autoload -U add-zsh-hook
-
-load-nvmrc() {
-  local nvmrc_path
-  nvmrc_path="$(nvm_find_nvmrc)"
-
-  if [ -n "$nvmrc_path" ]; then
-    local nvmrc_node_version
-    nvmrc_node_version=$(nvm version "$(cat "${nvmrc_path}")")
-
-    if [ "$nvmrc_node_version" = "N/A" ]; then
-      nvm install
-    elif [ "$nvmrc_node_version" != "$(nvm version)" ]; then
-      nvm use
-    fi
-  elif [ -n "$(PWD=$OLDPWD nvm_find_nvmrc)" ] && [ "$(nvm version)" != "$(nvm version default)" ]; then
-    echo "Reverting to nvm default version"
-    nvm use default
-  fi
-}
-
-add-zsh-hook chpwd load-nvmrc
-load-nvmrc

hosts/s/config/git/overrides/config

@@ -2,6 +2,9 @@
 [include]
 	path = ~/.dotfiles/config/git/shared
 
+[core]
+	excludesfile = ~/.config/git/overrides/ignore
+
 [gpg]
 	format = ssh
 
@@ -19,8 +22,8 @@
 
 [credential "https://github.com"]
 	helper =
-	helper = !/opt/homebrew/bin/gh auth git-credential
+	helper = !gh auth git-credential
 
 [credential "https://gist.github.com"]
 	helper =
-	helper = !/opt/homebrew/bin/gh auth git-credential
+	helper = !gh auth git-credential

hosts/s/config/git/overrides/ignore

@@ -0,0 +1,31 @@
+.DS_Store
+.idea
+.run
+*.cache
+*~
+
+*-secret
+__secret
+__ignored
+__test_*.php
+__test_*.txt
+__test.php
+_theme
+*.sql.gz
+*.WordPress.*.xml
+cachegrind.out.*
+composer.phar
+wp_*.sh
+auth.json
+dfm.sh
+.scannerwork
+.phpactor.json
+.zsh_history
+
+**/.claude/*
+**/.serena/*
+**/docs/plans/*
+**/docs/superpowers/*
+CLAUDE.md
+TODO.md
+specs.md

install.conf.yaml

@@ -40,7 +40,7 @@
       glob: true
       relink: true
       path: config/*
-      exclude: [config/nvm, config/fzf, config/op]
+      exclude: [config/fzf, config/op]
     # 1Password CLI plugins
     ~/.config/op/plugins.sh:
       relink: true
@@ -68,6 +68,11 @@
       glob: true
       mode: 0600
       path: ssh/*
+    # mise → asdf compatibility (tools expecting ~/.asdf find mise data)
+    ~/.asdf:
+      path: ~/.local/share/mise
+      relink: true
+      force: true
 
 - shell:
     # Add Git submodules and remove old ones

local/bin/dfm

@@ -73,21 +73,19 @@ section_install()
   MENU=(
     "all:Installs everything in the correct order"
     "apt-packages:Install apt packages (Debian/Ubuntu)"
-    "cargo:Install rust/cargo packages"
     "cheat-databases:Install cheat external cheatsheet databases"
     "composer:Install composer"
     "dnf-packages:Install dnf packages (Fedora/RHEL)"
     "fonts:Install programming fonts"
     "gh:Install GitHub CLI Extensions"
     "git-crypt:Install git-crypt from source"
-    "go:Install Go Packages"
     "imagick:Install ImageMagick CLI"
     "macos:Setup nice macOS defaults"
-    "npm-packages:Install NPM Packages"
+    "mise:Install tools via mise (runtimes + CLI tools)"
+    "mise-cleanup:Remove old version manager installations (--dry-run supported)"
     "ntfy:Install ntfy notification tool"
-    "nvm-latest:Install latest lts node using nvm"
-    "nvm:Install Node Version Manager (nvm)"
-    "python-packages:Install Python packages via uv"
+    "python-libs:Install Python libraries (libtmux, pynvim)"
+    "shellspec:Install shellspec testing framework"
     "xcode-cli-tools:Install Xcode CLI tools (macOS)"
     "z:Install z"
   )
@@ -106,13 +104,10 @@ section_install()
       $0 brew install
       $0 install fonts
 
-      # Tier 2: Language packages (depend on runtimes from Tier 1)
-      $0 install cargo
-      $0 install go
-      $0 install composer
-      $0 install nvm
-      $0 install npm-packages
-      $0 install python-packages
+      # Tier 2: Runtimes and CLI tools via mise, then remaining installers
+      $0 install mise || exit 1
+      $0 install composer || exit 1
+      $0 install python-libs || exit 1
 
       # Tier 3: Tool-dependent installers
       $0 install cheat-databases
@@ -121,6 +116,7 @@ section_install()
       $0 install ntfy
 
       # Tier 4: Independent utilities
+      $0 install shellspec
       $0 install z
 
       msgr msg "Reloading configurations again..."
@@ -129,12 +125,6 @@ section_install()
       msgr yay "All done!"
       ;;
 
-    cargo)
-      msgr run "Installing cargo packages..."
-      bash "$DOTFILES/scripts/install-cargo-packages.sh" \
-        && msgr yay "cargo packages installed!"
-      ;;
-
     cheat-databases)
       msgr run "Installing cheat databases..."
       for database in "$DOTFILES"/scripts/install-cheat-*.sh; do
@@ -161,12 +151,6 @@ section_install()
         && msgr yay "github cli extensions installed!"
       ;;
 
-    go)
-      msgr run "Installing Go Packages..."
-      bash "$DOTFILES/scripts/install-go-packages.sh" \
-        && msgr yay "go packages installed!"
-      ;;
-
     imagick)
       msgr run "Downloading and installing ImageMagick CLI..."
       curl -L https://imagemagick.org/archive/binaries/magick > "$XDG_BIN_HOME/magick" \
@@ -180,33 +164,30 @@ section_install()
         && msgr yay "macOS defaults set!"
       ;;
 
-    nvm)
-      msgr run "Installing nvm..."
-      local NVM_VERSION
-      NVM_VERSION=$(x-gh-get-latest-version nvm-sh/nvm)
-      msgr ok "Latest nvm version: $NVM_VERSION"
-      local NVM_INSTALL="https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh"
-      local NVM_CURL="curl -o- \"$NVM_INSTALL\" | bash"
-      PROFILE=/dev/null bash -c "$NVM_CURL"
-      $0 install nvm-latest
-      msgr yay "nvm installed!"
-      ;;
-
-    nvm-latest)
-      msgr run "Installing latest lts node..."
-      if [ -n "$NVM_DIR" ]; then
-        [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+    mise)
+      msgr run "Installing tools via mise..."
+      if ! command -v mise &> /dev/null; then
+        msgr nested "Installing mise..."
+        curl -fsSL https://mise.run | sh || {
+          msgr err "Failed to install mise"
+          exit 1
+        }
+        export PATH="${XDG_BIN_HOME:-$HOME/.local/bin}:$PATH"
       fi
-      nvm install --lts --latest-npm --default
-      git checkout "$DOTFILES/base/zshrc"
-      git checkout "$DOTFILES/base/bashrc"
-      msgr yay "latest lts node installed!"
+      mise install --yes || {
+        msgr err "mise install failed"
+        exit 1
+      }
+      mise reshim || {
+        msgr err "mise reshim failed"
+        exit 1
+      }
+      msgr yay "mise tools installed!"
       ;;
 
-    npm-packages)
-      msgr run "NPM Packages install started..."
-      bash "$DOTFILES/scripts/install-npm-packages.sh" \
-        && msgr yay "NPM Packages have been installed!"
+    mise-cleanup)
+      msgr run "Cleaning up old version manager installations..."
+      bash "$DOTFILES/scripts/cleanup-old-version-managers.sh" "${@:2}"
       ;;
 
     apt-packages)
@@ -233,10 +214,10 @@ section_install()
         && msgr yay "ntfy installed!"
       ;;
 
-    python-packages)
-      msgr run "Installing Python packages..."
+    python-libs)
+      msgr run "Installing Python libraries..."
       bash "$DOTFILES/scripts/install-python-packages.sh" \
-        && msgr yay "Python packages installed!"
+        && msgr yay "Python libraries installed!"
       ;;
 
     xcode-cli-tools)
@@ -245,6 +226,12 @@ section_install()
         && msgr yay "Xcode CLI tools installed!"
       ;;
 
+    shellspec)
+      msgr run "Installing shellspec..."
+      bash "$DOTFILES/scripts/install-shellspec.sh" \
+        && msgr yay "shellspec has been installed!"
+      ;;
+
     z)
       msgr run "Installing z..."
       bash "$DOTFILES/scripts/install-z.sh" \
@@ -281,8 +268,11 @@ section_brew()
       ;;
 
     update)
-      brew update && brew outdated && brew upgrade && brew cleanup
-      msgr yay "Done!"
+      if brew update && brew outdated && brew upgrade && brew cleanup; then
+        msgr yay "Done!"
+      else
+        msgr err "brew update failed"
+      fi
       ;;
 
     updatebundle)
@@ -541,9 +531,9 @@ section_dotfiles()
   case "$1" in
     fmt)
       msgr run "Running all formatters"
-      $0 dotfiles yamlfmt
-      $0 dotfiles shfmt
-      msgr run_done "...done!"
+      $0 dotfiles yamlfmt \
+        && $0 dotfiles shfmt \
+        && msgr run_done "...done!"
       ;;
 
     reset_all)
@@ -557,11 +547,14 @@ section_dotfiles()
         ~/.local/share/nvim \
         ~/.local/state/nvim \
         ~/.cache/nvim \
-        ~/.config/nvim
-      msgr ok "Deleted old nvim files (share, state and cache + config)"
-      ln -s "$DOTFILES/config/nvim" ~/.config/nvim
-      msgr ok "Linked nvim and astronvim"
-      x-have npm && $0 install npm
+        ~/.config/nvim \
+        && msgr ok "Deleted old nvim files (share, state and cache + config)"
+      ln -s "$DOTFILES/config/nvim" ~/.config/nvim \
+        && msgr ok "Linked nvim and astronvim"
+      $0 install mise || {
+        msgr err "Failed to install mise tools"
+        exit 1
+      }
       msgr ok "Installed packages"
       msgr run_done "nvim reset!"
       ;;
@@ -585,8 +578,8 @@ section_dotfiles()
         --language-dialect bash \
         --func-next-line --list --write \
         --indent 2 --case-indent --space-redirects \
-        --binary-next-line {} \;
-      msgr yay "dotfiles have been shfmt formatted!"
+        --binary-next-line {} \; \
+        && msgr yay "dotfiles have been shfmt formatted!"
       ;;
 
     *) menu_builder "$USAGE_PREFIX" "${MENU[@]}" ;;

local/bin/x-gitprofile

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# @description Set up mise enter hooks for git-profile auto-switching
+set -euo pipefail
+
+DEFAULTS=(
+  "home:$HOME/Code/ivuorinen"
+  "masf:$HOME/Code/masf"
+)
+
+write_hook()
+{
+  local profile="$1" dir="$2"
+  mkdir -p "$dir"
+  cat > "$dir/.mise.toml" << EOF
+[hooks]
+enter = "git profile use $profile"
+EOF
+  echo "Set git profile '$profile' for $dir"
+}
+
+if [[ $# -eq 0 ]]; then
+  for entry in "${DEFAULTS[@]}"; do
+    write_hook "${entry%%:*}" "${entry#*:}"
+  done
+elif [[ $# -eq 2 ]]; then
+  write_hook "$1" "$2"
+else
+  echo "Usage: x-gitprofile [<profile> <dir>]"
+  echo "  No args: set up defaults (home, masf)"
+  echo "  With args: create .mise.toml in <dir>"
+  exit 1
+fi

local/bin/x-visit-folders

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+#
+# Register level-1 subdirectories with zoxide so they appear
+# in `z` completions.
+# Usage: x-visit-folders [options] [directory]
+#
+# Example: x-visit-folders ~/Code/ivuorinen
+#
+# Copyright (c) 2026 Ismo Vuorinen. All Rights Reserved.
+# Licensed under the MIT license.
+#
+# @description Register level-1 subdirectories with zoxide
+
+set -euo pipefail
+
+# Enable verbosity with VERBOSE=1
+VERBOSE="${VERBOSE:-0}"
+DRY_RUN=0
+
+# Function to print usage information
+usage()
+{
+  echo "Usage: $0 [options] [directory]"
+  echo ""
+  echo "Options:"
+  echo "  -h, --help     Show this help message"
+  echo "  -v, --verbose  Print each directory as it is visited"
+  echo "  -n, --dry-run  List directories without adding them"
+  local code="${1:-1}"
+  exit "$code"
+}
+
+# Function to print messages if VERBOSE is enabled
+# $1 - message (string)
+msg()
+{
+  [[ "$VERBOSE" -eq 1 ]] && echo "$1"
+}
+
+# Function to print error messages and exit
+# $1 - error message (string)
+msg_err()
+{
+  echo "(!) ERROR: $1" >&2
+  exit 1
+}
+
+# Function to register a directory with zoxide
+# $1 - directory path (string)
+visit_dir()
+{
+  if zoxide add "$1" 2> /dev/null; then
+    msg "Added: $1"
+  else
+    msg "zoxide add failed for: $1"
+  fi
+}
+
+# Main function
+main()
+{
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      -h | --help) usage 0 ;;
+      -v | --verbose) VERBOSE=1 ;;
+      -n | --dry-run) DRY_RUN=1 ;;
+      -*)
+        msg_err "Unknown option: $1"
+        ;;
+      *)
+        break
+        ;;
+    esac
+    shift
+  done
+
+  local target="${1:-.}"
+
+  if [[ ! -d "$target" ]]; then
+    msg_err "Not a directory: $target"
+  fi
+
+  target="$(cd "$target" && pwd)"
+
+  local count=0
+  for dir in "$target"/*/; do
+    [[ -d "$dir" ]] || continue
+    local name
+    name="$(basename "$dir")"
+    [[ "$name" == .* ]] && continue
+
+    if [[ "$DRY_RUN" -eq 1 ]]; then
+      echo "(dry-run) $dir"
+    else
+      visit_dir "$dir"
+    fi
+    count=$((count + 1))
+  done
+
+  echo "Visited $count directories."
+}
+
+main "$@"

local/bin/x-visit-folders.md

@@ -0,0 +1,23 @@
+# x-visit-folders
+
+Register level-1 subdirectories with zoxide so they appear in
+`z` completions.
+
+## Usage
+
+```bash
+x-visit-folders [options] [directory]
+```
+
+- `directory` – target directory (defaults to current directory)
+- `-n`, `--dry-run` – list directories without adding them
+- `-v`, `--verbose` – print each directory as it is visited
+- `-h`, `--help` – show usage information
+
+## Example
+
+```bash
+x-visit-folders ~/Code/ivuorinen
+```
+
+<!-- vim: set ft=markdown spell spelllang=en_us cc=80 : -->

package.json

@@ -34,13 +34,16 @@
   },
   "homepage": "https://github.com/ivuorinen/dotfiles#readme",
   "devDependencies": {
-    "@biomejs/biome": "^2.3.1",
-    "@types/node": "^24.0.1",
-    "bats": "^1.12.0",
-    "editorconfig-checker": "^6.1.0",
+    "@biomejs/biome": "^2.4.4",
+    "@types/node": "^25.3.2",
+    "bats": "^1.13.0",
+    "editorconfig-checker": "^6.1.1",
     "markdown-table-formatter": "^1.7.0",
     "prettier": "^3.8.1",
-    "typescript": "^5.8.3"
+    "typescript": "^5.9.3"
+  },
+  "resolutions": {
+    "minimatch": "^10.2.4"
   },
   "packageManager": "yarn@4.12.0"
 }

scripts/cleanup-old-version-managers.md

@@ -0,0 +1,20 @@
+# cleanup-old-version-managers
+
+Remove old version manager installations that have been replaced by mise.
+
+## Usage
+
+```bash
+scripts/cleanup-old-version-managers.sh [--dry-run]
+```
+
+## What it does
+
+1. Removes data directories for nvm, fnm, pyenv, goenv, and bob-nvim.
+2. Removes cargo-installed tool binaries now managed by mise.
+3. Removes go-installed tool binaries from `$GOPATH/bin`.
+4. Uninstalls Homebrew packages replaced by mise (if brew is available).
+
+Mason binaries (`$XDG_DATA_HOME/nvim/mason/`) are not touched.
+
+Pass `--dry-run` to preview what would be removed without making changes.

scripts/cleanup-old-version-managers.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# @description Remove old version manager installations replaced by mise.
+# This script targets specific known directories — NOT which/command -v,
+# because nvim's Mason installs some of the same tool names.
+#
+# Ensure DOTFILES is set even when script is invoked directly
+if [[ -z "${DOTFILES:-}" ]]; then
+  DOTFILES="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  export DOTFILES
+fi
+# shellcheck source=shared.sh
+source "$DOTFILES/config/shared.sh"
+
+DRY_RUN=""
+if [[ $# -gt 0 ]]; then
+  if [[ "$1" = "--dry-run" ]]; then
+    DRY_RUN="--dry-run"
+  else
+    echo "Usage: $0 [--dry-run]" >&2
+    exit 1
+  fi
+fi
+
+remove_dir()
+{
+  local dir="$1" label="$2"
+  if [[ ! -d "$dir" ]]; then
+    msgr ok "$label not found (already clean): $dir"
+    return 0
+  fi
+  if [[ "$DRY_RUN" = "--dry-run" ]]; then
+    msgr warn "[DRY RUN] Would remove $label: $dir"
+  else
+    msgr run "Removing $label: $dir"
+    rm -rf "$dir"
+    msgr run_done "Removed $label"
+  fi
+  return 0
+}
+
+remove_file()
+{
+  local file="$1" label="$2"
+  [[ ! -f "$file" ]] && return 0
+  if [[ "$DRY_RUN" = "--dry-run" ]]; then
+    msgr warn "[DRY RUN] Would remove $label: $file"
+  else
+    rm -f "$file"
+    msgr run_done "Removed $label: $file"
+  fi
+  return 0
+}
+
+msgr msg "Cleaning up old version manager installations..."
+msgr msg "Mason binaries in \$XDG_DATA_HOME/nvim/mason/ will NOT be touched."
+
+# --- Version manager data directories ---
+
+# nvm (Node Version Manager)
+remove_dir "$XDG_DATA_HOME/nvm" "nvm data"
+
+# fnm (Fast Node Manager)
+remove_dir "$XDG_DATA_HOME/fnm" "fnm data"
+
+# pyenv
+remove_dir "$XDG_DATA_HOME/pyenv" "pyenv data"
+
+# goenv
+remove_dir "$XDG_DATA_HOME/goenv" "goenv data"
+
+# bob-nvim (neovim version manager — mise manages neovim now)
+remove_dir "$XDG_DATA_HOME/bob" "bob-nvim data"
+
+# --- Cargo-installed tool binaries ---
+# These were installed via `cargo install` into $CARGO_HOME/bin.
+# mise now manages them via ubi/cargo backends into its own install dirs.
+# Only remove from the OLD cargo bin location, not from XDG_BIN_HOME.
+
+CARGO_BIN="${XDG_DATA_HOME}/cargo/bin"
+CARGO_MANAGED_TOOLS=(
+  bkt btm difft eza fd rg
+  tree-sitter tmux-sessionizer zoxide bob
+  cargo-install-update cargo-cache
+)
+for tool in "${CARGO_MANAGED_TOOLS[@]}"; do
+  remove_file "$CARGO_BIN/$tool" "cargo-installed $tool"
+done
+
+# --- Go-installed tool binaries ---
+# go install puts binaries in $GOBIN (= $XDG_BIN_HOME) or $GOPATH/bin.
+# Only remove from $GOPATH/bin if it differs from XDG_BIN_HOME.
+GO_BIN="${XDG_DATA_HOME}/go/bin"
+GO_MANAGED_TOOLS=(
+  yamlfmt cheat glow fzf gum sesh git-profile
+)
+if [[ "$GO_BIN" != "$XDG_BIN_HOME" ]] && [[ -d "$GO_BIN" ]]; then
+  for tool in "${GO_MANAGED_TOOLS[@]}"; do
+    remove_file "$GO_BIN/$tool" "go-installed $tool"
+  done
+fi
+
+# --- npm global binaries ---
+# These were installed via `npm install -g` into the nvm/fnm node prefix.
+# Since we removed nvm/fnm data dirs above, these are already gone.
+
+# --- Python tools via uv tool ---
+# uv tool binaries go to ~/.local/bin/ (XDG_BIN_HOME).
+# mise pipx backend installs to a different location.
+# We leave XDG_BIN_HOME alone and let mise take precedence via PATH.
+
+# --- Homebrew-installed version managers ---
+# These will be removed when `brew bundle cleanup` runs after Brewfile update.
+if command -v brew &> /dev/null; then
+  BREW_REMOVE=(
+    pyenv pyenv-pip-migrate pyenv-virtualenv goenv cargo-binstall
+    act age ansible ansible-lint awscli bat bats-core checkov
+    choose-rust cmake gdu gh grype jq onefetch pinact shellcheck
+    tfenv tflint tfsec uv virtualenv wakatime-cli
+  )
+  for pkg in "${BREW_REMOVE[@]}"; do
+    if brew list "$pkg" &> /dev/null; then
+      if [[ "$DRY_RUN" = "--dry-run" ]]; then
+        msgr warn "[DRY RUN] Would brew uninstall $pkg"
+      else
+        msgr run "Uninstalling brew package: $pkg"
+        msgr warn "Note: $pkg may have dependents"
+        if brew uninstall "$pkg"; then
+          msgr run_done "Uninstalled $pkg"
+        else
+          msgr err "Failed to uninstall $pkg"
+        fi
+      fi
+    fi
+  done
+
+  # Clean up orphaned dependencies left after the removals above
+  if [[ "$DRY_RUN" = "--dry-run" ]]; then
+    msgr warn "[DRY RUN] Would run: brew autoremove"
+  else
+    msgr run "Removing orphaned brew dependencies..."
+    brew autoremove
+    msgr run_done "Orphaned dependencies removed"
+  fi
+fi
+
+msgr yay "Cleanup complete! Run 'mise install' to set up tools via mise."

scripts/install-cargo-packages.md

@@ -1,21 +0,0 @@
-# install-cargo-packages
-
-Install Rust packages defined in the script.
-
-## Usage
-
-```bash
-scripts/install-cargo-packages.sh
-```
-
-## What it does
-
-1. If `cargo-install-update` is available, updates all existing packages first
-    and tracks which packages are already installed.
-2. Installs each package from the inline list using `cargo install`,
-    skipping any already handled by the update step.
-    Builds run in parallel using available CPU cores (minus two).
-3. Runs package-specific post-install steps.
-4. Cleans the cargo cache with `cargo cache --autoclean`.
-
-To add or remove packages, edit the `packages` array in `scripts/install-cargo-packages.sh`.

scripts/install-cargo-packages.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# @description Install cargo/rust packages.
-#
-# shellcheck source=shared.sh
-source "$DOTFILES/config/shared.sh"
-
-msgr run "Starting to install rust/cargo packages"
-
-# Track packages already managed by cargo install-update
-declare -A installed_packages
-
-# If we have cargo install-update, use it first
-if command -v cargo-install-update &> /dev/null; then
-  msgr run "Updating cargo packages with cargo install-update"
-  # Show output in real-time (via stderr) while capturing it for parsing
-  update_output=$(cargo install-update -a 2>&1 | tee /dev/stderr)
-  msgr run_done "Done with cargo install-update"
-
-  # Parse installed package names from the update output
-  while IFS= read -r pkg_name; do
-    [[ -n "$pkg_name" ]] && installed_packages["$pkg_name"]=1
-  done < <(echo "$update_output" | awk '/v[0-9]+\.[0-9]+/ { print $1 }')
-fi
-
-# Cargo packages to install
-packages=(
-  cargo-update     # A cargo subcommand for checking and applying updates to installed executables
-  cargo-cache      # Cargo cache management utility
-  tree-sitter-cli  # An incremental parsing system for programming tools
-  bkt              # A subprocess caching utility
-  difftastic       # A structural diff that understands syntax
-  fd-find          # A simple, fast and user-friendly alternative to 'find'
-  ripgrep          # Recursively searches directories for a regex pattern while respecting your gitignore
-  bob-nvim         # A version manager for neovim
-  bottom           # A cross-platform graphical process/system monitor
-  eza              # A modern alternative to ls
-  tmux-sessionizer # A tool for opening git repositories as tmux sessions
-  zoxide           # A smarter cd command
-)
-
-# Number of jobs to run in parallel, this helps to keep the system responsive
-BUILD_JOBS=$(nproc --ignore=2 2> /dev/null || sysctl -n hw.ncpu 2> /dev/null || echo 1)
-
-# Function to install cargo packages
-install_packages()
-{
-  for pkg in "${packages[@]}"; do
-    # Skip packages already handled by cargo install-update
-    if [[ -n "${installed_packages[$pkg]+x}" ]]; then
-      msgr ok "Skipping $pkg (already installed)"
-      continue
-    fi
-
-    msgr run "Installing cargo package $pkg"
-    cargo install --jobs "$BUILD_JOBS" "$pkg"
-    msgr run_done "Done installing $pkg"
-    echo ""
-  done
-  return 0
-}
-
-# Function to perform additional steps for installed cargo packages
-post_install_steps()
-{
-  msgr run "Now doing the next steps for cargo packages"
-
-  # use bob to install latest stable nvim
-  if command -v bob &> /dev/null; then
-    bob use stable && x-path-append "$XDG_DATA_HOME/bob/nvim-bin"
-  fi
-
-  msgr run "Removing cargo cache"
-  cargo cache --autoclean
-  msgr "done" "Done removing cargo cache"
-  return 0
-}
-
-# Install cargo packages and run post-install steps
-main()
-{
-  install_packages
-  msgr "done" "Installed cargo packages!"
-  post_install_steps
-  return 0
-}
-
-main "$@"