a boatload of changes/fixes

2025-04-25 15:35:21 -04:00 · 2025-02-07 11:09:17 -05:00 · 2025-02-07 11:09:17 -05:00 · 21da506122
commit 21da506122
parent bab66d06a5
22 changed files with 6572 additions and 483 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,13 @@
+# auto-generated files
+.zcompdump*
+.zcompcache*
+
+# compiled .zsh sources
+*.zwc
+
+# homebrew lockfile
+Brewfile.lock.json
+
 # oopsie proofing
 **/.ssh/known_hosts*
 *id_rsa*
--- a/147
+++ b/147
@ -3,6 +3,7 @@
 ###############################
 tap "1password/tap"
 tap "dart-lang/dart"
+tap "dopplerhq/cli"
 tap "hashicorp/tap"
 tap "homebrew/aliases"
 tap "homebrew/autoupdate"
@ -13,144 +14,144 @@ tap "homebrew/cask-fonts"
 tap "homebrew/cask-versions"
 tap "homebrew/core"
 tap "homebrew/services"
+tap "microsoft/git"
 tap "ngrok/ngrok"
 tap "planetscale/tap"
 tap "sass/sass"
-tap "sidneys/homebrew"

 ###############################
-#  Binaries                   #
+#  Formulae                   #
 ###############################

-# Perhaps most importantly...
+# perhaps most importantly...
 brew "zsh" unless OS.linux?

-# Better bash as a backup
+# modern bash as a backup
 brew "bash" unless OS.linux?

-# GNU utilities (those that come with macOS are outdated)
-brew "coreutils"
-brew "findutils"
-brew "gnu-indent"
+# correct Apple's GPL stubbornness...
+brew "coreutils" if OS.mac?
+brew "findutils" if OS.mac?
 brew "gnu-sed"
 brew "gnu-tar"
 brew "gnu-which"
-brew "gnupg"
+brew "gnupg" if OS.mac?
 brew "gnutls"
 brew "grep"
 brew "make"
-brew "moreutils"

-# More recent versions of some macOS tools
+# more recent versions of some other macOS tools/libraries
+brew "bzip2", link: true
 brew "curl", link: true
 brew "gcc"
-brew "gmp"
+brew "icu4c"
+brew "less"
+brew "libffi"
+brew "libxml2"
 brew "nano"
-brew "openssh"
+brew "ncurses"
+brew "openssh" unless OS.linux?
+brew "openssl@1.1" if OS.mac?
+brew "readline"
 brew "screen"
+brew "sqlite"
+brew "tcl-tk"
 brew "unzip", link: true
 brew "vim"  #, args: ["with-override-system-vi"]
+brew "wget"  #, args: ["with-iri"]
+brew "whois", link: true
+brew "zlib"

-# Other useful binaries
-brew "ack"
-brew "autoconf"
-brew "automake"
+# common binaries/libraries
 brew "ffmpeg"  #, args: ["with-libvpx"]
+brew "fx"
+brew "gettext"
+brew "groff"
+brew "guetzli"
+brew "htop" if OS.mac?
+brew "hyperfine"
 brew "imagemagick"  #, args: ["with-webp"]
 brew "jemalloc"
-brew "less"
+brew "jq"
 brew "libsass", args: ["HEAD"]
 brew "libyaml"
+brew "mhash"
 brew "mtr"
-brew "openssl@1.1" if OS.mac?
 brew "p7zip"
 brew "pkg-config"
-brew "readline"
-brew "sidneys/homebrew/unrar" if OS.mac?
-brew "ssh-copy-id", link: true
+brew "protobuf"
+brew "rlwrap"
+brew "rsync"
 brew "tmux"
 brew "tree"
-brew "wget"  #, args: ["with-iri"]
+brew "webp"
+brew "xz"
+brew "yq"
+brew "zopfli"

-# Git
+# Git (and GitHub/GitLab CLIs)
 brew "git"
 brew "git-lfs"
 brew "gh"
+brew "glab"

-# Mostly ordinary binaries
+# mostly development stuff
 brew "1password/tap/1password-cli" if OS.mac?
-brew "angular-cli"
 brew "asciinema"
 brew "aws-shell"
 brew "awscli"
-brew "carthage"
-brew "cocoapods"
+brew "carthage" if OS.mac?
+brew "cocoapods" if OS.mac?
 brew "composer"
+brew "croc"
 brew "dart-lang/dart/dart"
 brew "deno"
+brew "dive"
 brew "doctl"
-brew "fx"
+brew "dopplerhq/cli/doppler"
+brew "fnm"
 brew "go"
-brew "guetzli"
 brew "hashicorp/tap/packer"
 brew "hashicorp/tap/terraform"
 brew "hashicorp/tap/vault"
-brew "htop"
 brew "httpie"
 brew "httrack"
 brew "hugo", args: ["HEAD"]
-brew "ipinfo-cli"
-brew "iproute2mac"
-brew "jq"
-brew "mariadb"
+brew "iproute2mac" if OS.mac?
+brew "mariadb" unless OS.linux?
 brew "mas" if OS.mac?
-brew "mhash"
 brew "mkcert"
-brew "mysql-client"
-brew "ncurses"
+brew "mysql-client" unless OS.linux?
 brew "neofetch"
+brew "neonctl"
 brew "netcat"
-brew "openjdk"
+brew "openjdk", link: true
 brew "openvpn"
-brew "optipng"
 brew "pandoc"
-brew "php"
+brew "php" unless OS.linux?
 brew "planetscale/tap/pscale"
-brew "pngcrush"
-brew "postgresql"
-brew "protobuf"
-brew "pyenv" unless OS.linux?
+brew "postgresql" unless OS.linux?
+brew "pyenv"
+brew "pyenv-virtualenv"
 # brew "python"
-# brew "python@3"
+# brew "python@2"
 brew "qemu"
-brew "rbenv" unless OS.linux?
-brew "rclone"
-brew "rlwrap"
-brew "ruby-build" unless OS.linux?
+brew "rbenv"
 # brew "ruby"
+brew "ruby-build"
 brew "rust"
 brew "s3cmd"
 brew "sass/sass/dart-sass-embedded"
 brew "sass/sass/sass"
-brew "serverless"
 brew "shellcheck"
-brew "shfmt"
-brew "sqlite"
-brew "subversion"
-brew "svn"
+brew "tea"
 brew "tor"
 brew "torsocks"
-brew "volta" unless OS.linux?
-brew "whois", link: true
-brew "wireguard-tools"
 brew "wp-cli"
-brew "xz"
 # brew "youtube-dl"
-brew "yq"
 brew "yt-dlp"
-brew "zopfli"

-# Pentesting tools
+# infosec & pentesting
 brew "aircrack-ng"
 brew "apktool"
 brew "bettercap"
@ -162,6 +163,7 @@ brew "geoip"
 brew "hashcat"
 brew "httpx"
 brew "hydra"
+brew "ipinfo-cli"
 brew "john"
 brew "knock"
 brew "massdns"
@ -208,10 +210,9 @@ cask "1password"
 cask "authy"
 cask "gpg-suite"
 cask "little-snitch"
+# cask "microsoft/git/git-credential-manager-core"
 cask "tailscale"
 cask "tunnelblick"
-cask "yubico-authenticator"
-cask "yubico-yubikey-manager"

 # Development/Work
 cask "adobe-creative-cloud"
@ -221,7 +222,8 @@ cask "eclipse-java"
 cask "github"
 cask "google-cloud-sdk", args: { appdir: "~/Applications" }
 cask "imageoptim"
-cask "iterm2"
+# cask "iterm2"
+cask "iterm2-beta"
 cask "jetbrains-toolbox"
 cask "microsoft-office"
 cask "ngrok/ngrok/ngrok"
@ -234,7 +236,9 @@ cask "visual-studio-code"

 # Virtual Machines (& Docker)
 cask "docker"
+# cask "multipass"
 cask "parallels"
+cask "vagrant"
 # cask "virtualbox"
 cask "virtualbox-beta"  # supports M1!

@ -253,9 +257,6 @@ cask "skype"
 cask "slack"
 cask "zoomus"

-# Gaming
-cask "steam"
-
 # Pentesting
 cask "burp-suite"
 cask "charles"
@ -267,19 +268,17 @@ cask "wireshark"
 cask "firefox"
 cask "firefox-developer-edition"
 cask "google-chrome"
-cask "safari-technology-preview"
 cask "tor-browser"

 ###############################
 #  Drivers                    #
 ###############################

-cask "homebrew/cask-drivers/hp-easy-start"
-cask "homebrew/cask-drivers/logitech-camera-settings"
 cask "homebrew/cask-drivers/logi-options-plus"
-cask "homebrew/cask-drivers/logitech-unifying"
-cask "homebrew/cask-drivers/razer-synapse"
+cask "homebrew/cask-drivers/philips-hue-sync"
 cask "homebrew/cask-drivers/sonos"
+cask "homebrew/cask-drivers/yubico-authenticator"
+cask "homebrew/cask-drivers/yubico-yubikey-manager"

 ###############################
 #  Fonts                      #
@ -288,14 +287,12 @@ cask "homebrew/cask-drivers/sonos"
 # Monospace
 cask "homebrew/cask-fonts/font-cascadia-code"
 cask "homebrew/cask-fonts/font-hack"
-cask "homebrew/cask-fonts/font-ibm-plex-mono"
 cask "homebrew/cask-fonts/font-roboto-mono"
 cask "homebrew/cask-fonts/font-sf-mono"
 cask "homebrew/cask-fonts/font-sf-mono-for-powerline"
 cask "homebrew/cask-fonts/font-source-code-pro"

 # Sans/Serif
-cask "homebrew/cask-fonts/font-comic-neue"
 cask "homebrew/cask-fonts/font-inter"
 cask "homebrew/cask-fonts/font-open-sans"
 cask "homebrew/cask-fonts/font-roboto"
--- a/bash/.bash_profile
+++ b/bash/.bash_profile
@ -0,0 +1,49 @@
+# super minimal bash setup for fallback, debugging, miscellaneous tasks, etc.
+
+# disable unnecessary history
+set +o history
+export SHELL_SESSION_HISTORY=0
+
+# hide macOS zsh default warning
+export BASH_SILENCE_DEPRECATION_WARNING=1
+
+# set PATH, MANPATH, etc., for Homebrew
+if [[ -x /opt/homebrew/bin/brew ]]; then
+  # macOS on Apple Silicon
+  eval "$(/opt/homebrew/bin/brew shellenv)"
+elif [[ -x /usr/local/bin/brew ]]; then
+  # macOS on Intel
+  eval "$(/usr/local/bin/brew shellenv)"
+elif [[ -x "$HOME/.linuxbrew/bin/brew" ]]; then
+  # Linux, user install
+  eval "$("$HOME/.linuxbrew/bin/brew" shellenv)"
+elif [[ -x /home/linuxbrew/.linuxbrew/bin/brew ]]; then
+  # Linux, system install
+  eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+fi
+
+# fnm
+if command -v fnm &>/dev/null; then
+  eval "$(fnm env --use-on-cd --shell bash)"
+fi
+
+# rbenv
+if command -v rbenv &>/dev/null; then
+  eval "$(rbenv init - --no-rehash bash)"
+fi
+
+# pyenv
+if command -v pyenv &>/dev/null; then
+  eval "$(pyenv init - --no-rehash bash)"
+
+  # pyenv-virtualenv
+  export PYENV_VIRTUALENV_DISABLE_PROMPT=1
+  if command -v pyenv-virtualenv-init &>/dev/null; then
+    eval "$(pyenv virtualenv-init -)"
+  fi
+fi
+
+# pyenv-virtualenv
+if command -v pyenv-virtualenv-init &>/dev/null; then
+  eval "$(pyenv virtualenv-init -)"
+fi
--- a/docker/daemon.json
+++ b/docker/daemon.json
@ -5,8 +5,17 @@
      "enabled": true
    }
  },
+  "dns": [
+    "1.1.1.1",
+    "1.0.0.1"
+  ],
  "experimental": true,
  "features": {
    "buildkit": true
+  },
+  "log-driver": "json-file",
+  "log-opts": {
+    "max-size": "10m",
+    "max-file": "5"
  }
 }
--- a/git/.gitconfig
+++ b/git/.gitconfig
@ -1,7 +1,7 @@
 [core]
 	editor = code --wait
 	pager = delta
-	excludesfile = ~/.gitignore_global
+	excludesfile = ~/.gitignore

 	# Make `git rebase` safer on macOS
 	# More info: <http://www.git-tower.com/blog/make-git-rebase-safe-on-osx/>
@ -9,7 +9,17 @@
 [user]
 	email = jake@jarv.is
 	name = Jake Jarvis
-	signingkey = 3BC6E5776BF379D36F6714802B0C9CF251E69A39
+	signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeuNlSZmqygM4XN7++pmfrNUsFzAjlxaYHoO/JXVdT5
+[credential "https://github.com"]
+	helper = 
+	helper = !/opt/homebrew/bin/gh auth git-credential
+[credential "https://gist.github.com"]
+	helper = 
+	helper = !/opt/homebrew/bin/gh auth git-credential
+[gpg]
+	format = ssh
+[gpg "ssh"]
+	program = /Applications/1Password.app/Contents/MacOS/op-ssh-sign
 [init]
 	defaultBranch = main
 [push]
@ -39,10 +49,6 @@
 	aliases = config --get-regexp alias
 	contributors = shortlog --summary --numbered
 	new = !git init && git symbolic-ref HEAD refs/heads/main
-# [credential]
-# 	helper = osxkeychain
-# [gpg]
-# 	program = /usr/local/MacGPG2/bin/gpg
 [github]
 	user = jakejarvis
 [hub]
--- a/git/.gitignore_global
+++ b/git/.gitignore_global
@ -32,5 +32,5 @@ Temporary Items
 # Misc
 .wakatime-project

-
-.sentryclirc
+# allow
+!.gitkeep
--- a/install.sh
+++ b/install.sh
@ -6,21 +6,21 @@ echo "🙏 Deep breaths, everything will (probably) be fine!"
 echo ""

 # location of the *full repo* (defaults to ~/.dotfiles)
-DOTFILES_PATH="${DOTFILES_PATH:="$HOME/.dotfiles"}"
+DOTFILES="${DOTFILES:-"$HOME/.dotfiles"}"
 # location of this script (should be right next to all the other files, but we handle that next if it's not)
 INSTALLER_PATH="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"

-# if this is a codespace, link automatically cloned dotfiles repo to the expected DOTFILES_PATH
+# if this is a codespace, link automatically cloned dotfiles repo to the expected DOTFILES
 # https://docs.github.com/en/codespaces/troubleshooting/troubleshooting-personalization-for-codespaces#troubleshooting-dotfiles
 if [[ "$CODESPACES" = "true" ]] && [[ -d /workspaces/.codespaces/.persistedshare/dotfiles ]]; then
-  ln -sf /workspaces/.codespaces/.persistedshare/dotfiles "$DOTFILES_PATH"
+  ln -sf /workspaces/.codespaces/.persistedshare/dotfiles "$DOTFILES"
 fi

 # clone this repo if this script is all by itself and/or we're not in the expected location
-if [[ "$INSTALLER_PATH" != "$DOTFILES_PATH" ]] && [[ ! -d "$DOTFILES_PATH" ]]; then
-  git clone https://github.com/jakejarvis/dotfiles.git "$DOTFILES_PATH"
+if [[ "$INSTALLER_PATH" != "$DOTFILES" ]] && [[ ! -d "$DOTFILES" ]]; then
+  git clone https://github.com/jakejarvis/dotfiles.git "$DOTFILES"

-  echo "Successfully cloned the full repo to '$DOTFILES_PATH'"
+  echo "Successfully cloned the full repo to '$DOTFILES'"
  echo "Run install.sh from that directory to continue. Exiting now..."
  exit 0
 fi
@ -29,48 +29,50 @@ fi
 if [[ ! -d ~/.config ]]; then
  mkdir -p ~/.config
 fi
-ln -sf "$DOTFILES_PATH/zsh/.zshrc" ~/.zshrc
-ln -sf "$DOTFILES_PATH/zsh/.zprofile" ~/.zprofile
-ln -sf "$DOTFILES_PATH/git/.gitconfig" ~/.gitconfig
-ln -sf "$DOTFILES_PATH/git/.gitignore_global" ~/.gitignore_global
-ln -sf "$DOTFILES_PATH/starship/config.toml" ~/.config/starship.toml
+if [[ ! -d ~/.ssh ]]; then
+  mkdir -p ~/.ssh && chmod 700 ~/.ssh
+fi
+ln -sf "$DOTFILES/zsh/.zshrc" ~/.zshrc
+ln -sf "$DOTFILES/zsh/.zprofile" ~/.zprofile
+ln -sf "$DOTFILES/bash/.bash_profile" ~/.bash_profile
+ln -sf "$DOTFILES/ssh/.ssh/config" ~/.ssh/config
+ln -sf "$DOTFILES/git/.gitconfig" ~/.gitconfig
+ln -sf "$DOTFILES/git/.gitignore_global" ~/.gitignore
+ln -sf "$DOTFILES/starship/config.toml" ~/.config/starship.toml

 # this file will be sourced by .zshrc for more sensitive variables/settings
 touch ~/.zshrc.local

 # prepare zinit manually
-ZINIT_HOME="$HOME/.local/share/zinit/zinit.git"
+ZINIT_HOME="${ZINIT_HOME:-"${XDG_DATA_HOME:-"${HOME}/.local/share"}/zinit/zinit.git"}"
 if [[ ! -d "$ZINIT_HOME" ]]; then
  mkdir -p "$(dirname "$ZINIT_HOME")"
  git clone https://github.com/zdharma-continuum/zinit.git "$ZINIT_HOME"
 fi

 # the remainder of the setup tasks are OS-specific
-if [[ "$OSTYPE" = "darwin"* ]]; then
+if [[ "$OSTYPE" = darwin* ]]; then
  # final symlinks
-  if [[ ! -d ~/.ssh ]]; then
-    mkdir -p ~/.ssh && chmod 700 ~/.ssh
-  fi
-  ln -sf "$DOTFILES_PATH/ssh/.ssh/config" ~/.ssh/config
-  ln -sf "$DOTFILES_PATH/nano/brew.nanorc" ~/.nanorc
-  ln -sf "$DOTFILES_PATH/Brewfile" ~/Brewfile
+  ln -sf "$DOTFILES/nano/brew.nanorc" ~/.nanorc
+  ln -sf "$DOTFILES/Brewfile" ~/Brewfile

  # suppress terminal login banners
  touch ~/.hushlogin

-  # shellcheck disable=SC1090,SC1091
-  source "$DOTFILES_PATH/macos/macos.sh"
-elif [[ "$OSTYPE" = "linux-gnu"* ]]; then
-  # final symlinks
-  ln -sf "$DOTFILES_PATH/nano/default.nanorc" ~/.nanorc
+  # disable bash session restoration
+  touch ~/.bash_sessions_disable

-  # shellcheck disable=SC1090,SC1091
-  source "$DOTFILES_PATH/linux/linux.sh"
+  source "$DOTFILES/macos/macos.sh"
+elif [[ "$OSTYPE" = linux-gnu* ]]; then
+  # final symlinks
+  ln -sf "$DOTFILES/nano/default.nanorc" ~/.nanorc
+
+  source "$DOTFILES/linux/linux.sh"
 else
  echo "I don't recognize this OS... skipping extra steps."
 fi

 # wow
 echo ""
-echo "🎉 It actually worked!"
+echo "🤯 It actually worked!"
 echo "Log out and log back in (or just restart) to finish installing all ZSH features."
--- a/iterm/com.googlecode.iterm2.plist
+++ b/iterm/com.googlecode.iterm2.plist
--- a/iterm/default.json
+++ b/iterm/default.json
@ -1,5 +1,5 @@
 {
-  "ASCII Ligatures" : true,
+  "Custom Directory" : "No",
  "Working Directory" : "\/Users\/jake",
  "Prompt Before Closing 2" : false,
  "Selected Text Color" : {
@ -56,7 +56,9 @@
    "slogin",
    "telnet"
  ],
+  "Scrollback With Status Bar" : true,
  "Scrollback Lines" : 0,
+  "Scrollback in Alternate Screen" : true,
  "Draw Powerline Glyphs" : false,
  "Status Bar Layout" : {
    "components" : [
@ -70,9 +72,9 @@
            "iTermStatusBarSpringComponentSizeMultipleKey" : 1
          },
          "layout advanced configuration dictionary value" : {
-            "auto-rainbow style" : 0,
            "algorithm" : 1,
-            "remove empty components" : false
+            "remove empty components" : false,
+            "auto-rainbow style" : 0
          }
        }
      }
@ -138,8 +140,11 @@
    },
    {
      "notes" : "Paths",
+      "precision" : "normal",
      "regex" : "\\~?\/?([[:letter:][:number:]._-]+\/+)+[[:letter:][:number:]._-]+\/?",
-      "precision" : "normal"
+      "actions" : [
+
+      ]
    },
    {
      "notes" : "Quoted string",
@ -188,108 +193,108 @@
  "Title Components" : 2,
  "Keyboard Map" : {
    "0x5e-0x60000" : {
-      "Action" : 11,
-      "Text" : "0x1e"
+      "Text" : "0x1e",
+      "Action" : 11
    },
    "0xf702-0x280000" : {
-      "Text" : "b",
-      "Action" : 10
+      "Action" : 10,
+      "Text" : "b"
    },
    "0xf702-0x260000" : {
-      "Action" : 11,
-      "Text" : "0x1b 0x1b 0x5b 0x44"
+      "Text" : "0x1b 0x1b 0x5b 0x44",
+      "Action" : 11
    },
    "0xf703-0x280000" : {
-      "Text" : "f",
-      "Action" : 10
+      "Action" : 10,
+      "Text" : "f"
    },
    "0xf70a-0x20000" : {
-      "Action" : 10,
-      "Text" : "[28~"
+      "Text" : "[28~",
+      "Action" : 10
    },
    "0xf703-0x260000" : {
-      "Action" : 10,
-      "Text" : "[C"
+      "Text" : "[C",
+      "Action" : 10
    },
    "0x2d-0x40000" : {
-      "Action" : 11,
-      "Text" : "0x1f"
+      "Text" : "0x1f",
+      "Action" : 11
    },
    "0xf702-0x220000" : {
-      "Action" : 10,
-      "Text" : "[D"
+      "Text" : "[D",
+      "Action" : 10
    },
    "0xf703-0x240000" : {
-      "Action" : 10,
-      "Text" : "[5C"
+      "Text" : "[5C",
+      "Action" : 10
    },
    "0xf703-0x220000" : {
-      "Action" : 10,
-      "Text" : "[C"
+      "Text" : "[C",
+      "Action" : 10
    },
    "0xf700-0x280000" : {
-      "Action" : 10,
-      "Text" : "[A"
+      "Text" : "[A",
+      "Action" : 10
    },
    "0xf72b-0x20000" : {
-      "Action" : 10,
-      "Text" : "[F"
+      "Text" : "[F",
+      "Action" : 10
    },
    "0xf700-0x260000" : {
-      "Action" : 10,
-      "Text" : "[A"
+      "Text" : "[A",
+      "Action" : 10
    },
    "0xf701-0x280000" : {
-      "Action" : 10,
-      "Text" : "[B"
+      "Text" : "[B",
+      "Action" : 10
    },
    "0xf700-0x240000" : {
-      "Action" : 10,
-      "Text" : "[A"
+      "Text" : "[A",
+      "Action" : 10
    },
    "0xf701-0x260000" : {
-      "Action" : 10,
-      "Text" : "[B"
+      "Text" : "[B",
+      "Action" : 10
    },
    "0xf700-0x220000" : {
-      "Action" : 10,
-      "Text" : "[A"
+      "Text" : "[A",
+      "Action" : 10
    },
    "0xf701-0x240000" : {
-      "Action" : 10,
-      "Text" : "[B"
+      "Text" : "[B",
+      "Action" : 10
    },
    "0xf72b-0x40000" : {
-      "Action" : 4,
-      "Text" : ""
+      "Text" : "",
+      "Action" : 4
    },
    "0xf708-0x20000" : {
-      "Action" : 10,
-      "Text" : "[25~"
+      "Text" : "[25~",
+      "Action" : 10
    },
    "0xf701-0x220000" : {
-      "Action" : 10,
-      "Text" : "[B"
+      "Text" : "[B",
+      "Action" : 10
    },
    "0xf709-0x20000" : {
-      "Action" : 10,
-      "Text" : "[26~"
+      "Text" : "[26~",
+      "Action" : 10
    },
    "0xf70b-0x20000" : {
-      "Action" : 10,
-      "Text" : "[29~"
+      "Text" : "[29~",
+      "Action" : 10
    },
    "0xf702-0x240000" : {
-      "Action" : 10,
-      "Text" : "[5D"
+      "Text" : "[5D",
+      "Action" : 10
    },
    "0xf729-0x20000" : {
-      "Action" : 10,
-      "Text" : "[H"
+      "Text" : "[H",
+      "Action" : 10
    },
    "0xf729-0x40000" : {
-      "Action" : 5,
-      "Text" : ""
+      "Text" : "",
+      "Action" : 5
    }
  },
  "Ansi 14 Color" : {
@ -319,7 +324,7 @@
    "Green Component" : 0.36078426241874695
  },
  "Use Bold Font" : true,
-  "Silence Bell" : false,
+  "Silence Bell" : true,
  "Ansi 12 Color" : {
    "Red Component" : 0.34117650985717773,
    "Color Space" : "sRGB",
@ -329,8 +334,8 @@
  },
  "Window Type" : 0,
  "Allow Title Reporting" : false,
-  "Use Bright Bold" : true,
  "Has Hotkey" : false,
+  "Use Bright Bold" : true,
  "Cursor Text Color" : {
    "Red Component" : 0.15686270594596863,
    "Color Space" : "sRGB",
@ -379,9 +384,9 @@
    "Green Component" : 0.1491314172744751
  },
  "Semantic History" : {
+    "editor" : "com.microsoft.VSCode",
    "text" : "",
-    "action" : "editor",
-    "editor" : "com.microsoft.VSCode"
+    "action" : "editor"
  },
  "Ambiguous Double Width" : false,
  "Blur Radius" : 10.045428856382978,
@ -457,7 +462,7 @@
  "Columns" : 120,
  "Use Tab Color" : false,
  "Visual Bell" : true,
-  "Custom Directory" : "No",
+  "ASCII Ligatures" : true,
  "Ansi 5 Color" : {
    "Red Component" : 1,
    "Color Space" : "sRGB",
--- a/linux/linux.sh
+++ b/linux/linux.sh
@ -26,16 +26,15 @@ if [[ -e /etc/debian_version ]]; then
 fi

 # set machine's timezone to local time
-sudo timedatectl set-timezone America/New_York
+sudo timedatectl set-timezone America/New_York || true

 # install linuxbrew:
 # https://docs.brew.sh/Homebrew-on-Linux#install
 if ! command -v brew &>/dev/null; then
-  # TODO: hack to permit installing as root, find a better way
-  # https://github.com/Homebrew/install/blob/master/install.sh#L306
-  sudo touch /.dockerenv
-  curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh | bash
-  sudo rm /.dockerenv
+  # TODO: currently tricking installer into thinking we're running it as a non-root user, it doesn't _really_ matter in
+  # my use cases (e.g. codespaces) but this is apparently very unsafe.
+  # https://github.com/Homebrew/install/blob/master/install.sh#L302
+  NONINTERACTIVE=1 UID=999 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
 fi

 # install tailscale
@ -43,13 +42,10 @@ if ! command -v tailscale &>/dev/null; then
  curl -fsSL https://tailscale.com/install.sh | bash
 fi

-# install volta
-if ! command -v volta &>/dev/null; then
-  export VOLTA_HOME="$HOME/.volta"
-  export PATH="$VOLTA_HOME/bin:$PATH"
-  curl -fsSL https://get.volta.sh | bash -s -- --skip-setup
+# install fnm
+if ! command -v fnm &>/dev/null; then
+  curl -fsSL https://fnm.vercel.app/install | bash -s -- --skip-shell
 fi
-volta install node@lts npm@latest yarn@latest

 # install rbenv & ruby-build
 if ! command -v rbenv &>/dev/null; then
--- a/macos/macos.sh
+++ b/macos/macos.sh
@ -19,7 +19,7 @@ sudo xcodebuild -license accept
 # This whole thing kinda hinges on having Homebrew...
 # Check for it and install from GitHub if it's not there
 if ! command -v brew &>/dev/null; then
-  curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh | bash
+  NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
 fi

 # Disable analytics
@ -39,14 +39,9 @@ chsh -s "$(brew --prefix)/bin/zsh"
 chmod 755 "$(brew --prefix)/share/zsh"
 chmod 755 "$(brew --prefix)/share/zsh/site-functions"

-# 1Password SSH integration
-# https://developer.1password.com/docs/ssh/get-started#step-4-configure-your-ssh-or-git-client
-mkdir -p ~/.1password
-ln -sf ~/Library/Group\ Containers/2BUA8C4S2C.com.1password/t/agent.sock ~/.1password/agent.sock
-
 # Install all apps from the Brewfile, ignore errors
 brew tap homebrew/bundle
-brew bundle || true
+brew bundle --no-lock || true

 # Set macOS defaults
 # Needs to be last since this will restart everything when done
--- a/npm/install_globals.sh
+++ b/npm/install_globals.sh
@ -1,24 +1,18 @@
 #!/usr/bin/env bash

-set -euo pipefail
+set -e

-# fetch and install Volta (better nvm)
-if ! command -v volta &>/dev/null; then
-  # curl https://get.volta.sh | bash -s -- --skip-setup
-  brew install volta
+if ! command -v fnm &>/dev/null; then
+  echo "fnm not found, exiting..."
+  return
 fi

-volta install node@latest # remove when LTS officially supports arm64
-volta install npm@8
-volta install yarn@1
-volta fetch node@lts # not native on M1 but good to have
-
-volta list node
-volta list npm
-volta list yarn
+fnm install --latest --corepack-enabled
+npm install --global npm

 # npm ls --global --parseable --depth=0 | awk '{gsub(/\/.*\//,"",$1); print}' | sort -u
 packages=(
+  @angular/cli
  @babel/cli
  @babel/core
  @lhci/cli
@ -26,10 +20,11 @@ packages=(
  autoprefixer
  cross-env
  depcheck
-  dtslint
  dts-gen
+  dtslint
  esbuild
  eslint
+  gatsby-cli
  gzip-size-cli
  json-server
  markdownlint-cli2
@ -44,6 +39,7 @@ packages=(
  prettier
  release-it
  rollup
+  serverless
  stylelint
  superstatic
  svgo
@ -56,9 +52,7 @@ packages=(
 )

 for p in "${packages[@]}"; do
-  volta run --no-yarn -- npm install --global "$p" || echo "$p not found"
+  NPM_CONFIG_FUND=false npm install --global --no-audit "$p" || echo "$p not found"
 done

 unset p packages
-
-volta list all
--- a/ssh/.ssh/config
+++ b/ssh/.ssh/config
@ -1,71 +1,25 @@
 Include conf.d/*

-CanonicalizeHostname yes
-CanonicalizeMaxDots 0
-
 Host *
-  # https://stribika.github.io/2015/01/04/secure-secure-shell.html
+  CanonicalizeHostname yes
+  CanonicalizeMaxDots 1
  ChallengeResponseAuthentication no
-  Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
-  ControlMaster auto
-  ControlPath /tmp/ssh-%r@%h:%p
-  ControlPersist 5m
-  ForwardX11 no
-  GSSAPIAuthentication yes
-  GSSAPIDelegateCredentials yes
  HashKnownHosts yes
-  HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa
-  KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
-  MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
-  SendEnv LANG
  ServerAliveCountMax 3
  ServerAliveInterval 120
-  VisualHostKey yes
  VerifyHostKeyDNS ask
-  # macOS specific
-  IgnoreUnknown AddKeysToAgent,UseKeychain
-  AddKeysToAgent yes
-  UseKeychain yes
-  PreferredAuthentications publickey
-  # https://developer.1password.com/docs/ssh/get-started#step-4-configure-your-ssh-or-git-client
-  IdentityAgent "~/.1password/agent.sock"
+  VisualHostKey yes

 Host tufts
  HostName linux.eecs.tufts.edu
  User jjarvi01
  ForwardAgent yes

-Host mastodon
-  # tailscale IP:
-  HostName 100.85.213.20
+Host unifi
+  HostName setup.ui.com
  User root
  ForwardAgent yes

-Host gitea
-  # tailscale IP:
-  HostName 100.75.40.17
-  User root
-  ForwardAgent yes
-
-Host y2k
-  # tailscale IP:
-  HostName 100.79.167.105
-  Port 32422
-  User root
-  ForwardAgent yes
-
-Host nas
-  # home net:
-  HostName 192.168.20.11
-  User jake
-  ForwardAgent yes
-
-Host seed
-  # home net:
-  HostName 192.168.20.12
-  User jake
-  ForwardAgent yes
-
 Host github.com
  HostName github.com
  User git
@ -73,6 +27,3 @@ Host github.com
 Host hashbang
  HostName de1.hashbang.sh
  User jakej
-
-Host *.ssh.wpengine.net
-  IdentityFile ~/.ssh/wpe_devkit
--- a/starship/config.toml
+++ b/starship/config.toml
@ -100,6 +100,7 @@ symbol = " "

 [python]
 symbol = " "
+pyenv_version_name = true

 [ruby]
 symbol = " "
--- a/zsh/.zshrc
+++ b/zsh/.zshrc
@ -1,5 +1,8 @@
 #!/usr/bin/env zsh

+# set DOTFILES_DEBUG to trace startup times (1/2)
+[[ "$DOTFILES_DEBUG" != "1" ]] || zmodload zsh/zprof
+
 # path to this directory:
 export ZSH_CUSTOM=~/.dotfiles/zsh

@ -12,10 +15,13 @@ done
 unset _dotzsh

 # macos.zsh has aliases, functions, etc specific to macOS:
-if [[ "$OSTYPE" = "darwin"* ]] && [[ -f "$ZSH_CUSTOM"/custom/macos.zsh ]]; then
+if [[ "$OSTYPE" = darwin* ]] && [[ -f "$ZSH_CUSTOM"/custom/macos.zsh ]]; then
  source "$ZSH_CUSTOM"/custom/macos.zsh
 fi

 if [[ -f ~/.zshrc.local ]]; then
  source ~/.zshrc.local
 fi
+
+# uncomment to debug startup time (2/2)
+[[ "$DOTFILES_DEBUG" != "1" ]] || zprof
--- a/zsh/custom/aliases.zsh
+++ b/zsh/custom/aliases.zsh
@ -11,6 +11,7 @@ alias l="ll"

 # easier dotfile tinkering
 alias shreload="exec \$SHELL"
+alias shdebug="DOTFILES_DEBUG=1 exec \$SHELL"

 # git
 alias g="git"
@ -37,36 +38,42 @@ alias gist="gh gist create --web"
 # docker
 alias dps="docker ps -a"
 dbar() {
-  # build and run:
+  # build a Dockerfile in the current directory and run it interactively:
  # https://stackoverflow.com/questions/45141402/build-and-run-dockerfile-with-one-command/59220656#59220656
-  docker build --progress=plain --no-cache . | tee /dev/tty | tail -n1 | cut -d' ' -f3 | xargs -I{} docker run --rm -i {}
+  docker run --rm -it "$(docker build --no-cache -q .)"
 }
 dsh() {
  docker exec -it "$1" /bin/sh
 }
+# alias dc="docker-compose"
 alias dc="docker compose"
-alias dcu="docker compose up -d"
-alias dcd="docker compose down"
-alias dcr="docker compose down && docker compose up -d"
-alias dcl="docker compose logs -f"
+alias dcu="dc up -d"
+alias dcd="dc down"
+alias dcr="dcd && dcu"
+alias dcl="dc logs -f"

 # multipass
 alias mp="multipass"
 mpl() {
  # creates VM and opens its bash shell
  # `mpl test1 4G 20.04`
-  multipass launch "${2:-jammy}" --cpus 4 --mem "${3:-2G}" --disk 20G --name "$1" && \
+  multipass launch "${2:-jammy}" --cpus=4 --memory="${3:-2G}" --disk="${4:-20G}" --name="$1" && \
  multipass shell "$1"
 }
+mpd() {
+  multipass delete "$1" && multipass purge
+}
 alias mpls="multipass list"
 alias mpsh="multipass shell"
 alias mpk="multipass stop"
-alias mpd="multipass delete"

 # Node/NPM/Yarn
 alias npr="npm run"
+alias yar="yarn run"
+alias pnpr="pnpm run"
 alias fresh_npm="rm -rf node_modules package-lock.json && npm install"
 alias fresh_yarn="rm -rf node_modules yarn.lock && yarn install"
+alias fresh_pnpm="rm -rf node_modules pnpm-lock.yaml && pnpm install"

 # uncomment to use VS Code insiders build
 # alias code="code-insiders"
--- a/zsh/custom/common.zsh
+++ b/zsh/custom/common.zsh
@ -1,13 +1,21 @@
 #!/usr/bin/env zsh

-autoload -U colors && colors
+autoload -U colors && \
+colors

-autoload -Uz url-quote-magic
-zle -N self-insert url-quote-magic
-
-autoload -Uz select-word-style
+autoload -Uz select-word-style && \
 select-word-style bash

+# autoload -Uz bracketed-paste-magic && \
+# zle -N bracketed-paste bracketed-paste-magic
+# zstyle ':bracketed-paste-magic' active-widgets '.self-*'
+
+autoload -Uz url-quote-magic && \
+zle -N self-insert url-quote-magic
+zstyle ":urlglobber" url-other-schema ftp git gopher http https magnet && \
+
+export DISABLE_MAGIC_FUNCTIONS=true     # make pasting into terminal faster
+
 # enable bash-like 'help' command for zsh:
 # https://stackoverflow.com/questions/4405382/how-can-i-read-documentation-about-built-in-zsh-commands
 unalias run-help 2>/dev/null
@ -17,31 +25,29 @@ alias help=run-help
 # ---

 setopt notify
+setopt complete_aliases
 setopt complete_in_word
 setopt always_to_end
 setopt extended_history
 setopt hist_expire_dups_first
-# setopt hist_ignore_dups
+setopt hist_ignore_dups
 setopt hist_ignore_space
 setopt hist_verify
 setopt share_history
 setopt inc_append_history
 setopt rc_quotes
-setopt autocd
 setopt extended_glob
 setopt glob_dots
 unsetopt case_glob
 unsetopt beep  # kindly stfu
+unsetopt list_beep
 unsetopt correct
 unsetopt correct_all

 # ---

-bindkey -e
-bindkey "^[^[[D" backward-word
-bindkey "^[^[[C" forward-word
-
-# ---
+# kinda hacky way to traverse up to the root of the dotfiles repo
+export DOTFILES="$(realpath "$(realpath "$(dirname "${0}")")/../..")"

 export LC_ALL="${LC_ALL:-en_US.UTF-8}"
 export LANG="${LANG:-en_US.UTF-8}"
@ -55,7 +61,17 @@ export HISTSIZE=10000
 export SAVEHIST=10000

 export EDITOR="nano"  # don't judge me
-export VISUAL="code"
+export VISUAL="code --new-window --wait"
+
+export PAGER="less"
+export LESS="$LESS -RF --mouse --silent"
+
+# resolve GPG terminal at shell runtime
+# fixes "signing failed: Inappropriate ioctl for device"
+if tty -s 2>/dev/null; then
+  GPG_TTY=$(tty)
+  export GPG_TTY
+fi

 # https://github.com/ohmyzsh/ohmyzsh/blob/master/lib/theme-and-appearance.zsh#L5
 # export LS_COLORS="Gxfxcxdxbxegedabagacad"
--- a/zsh/custom/env.zsh
+++ b/zsh/custom/env.zsh
@ -1,11 +1,33 @@
 #!/usr/bin/env zsh

+# homebrew tweaks
 export HOMEBREW_NO_ANALYTICS=1
+export HOMEBREW_NO_ENV_HINTS=1
 export HOMEBREW_NO_INSECURE_REDIRECT=1
-# export HOMEBREW_CASK_OPTS=--require-sha
-export NEXT_TELEMETRY_DISABLED=1
-export GATSBY_TELEMETRY_DISABLED=1
-export DOTNET_CLI_TELEMETRY_OPTOUT=1
-export SAM_CLI_TELEMETRY=0
+
+# docker tweaks
+export DOCKER_BUILDKIT=1
+export DOCKER_SCAN_SUGGEST=false
+export COMPOSE_DOCKER_CLI_BUILD=1
+
+# npm tweaks
+export DISABLE_OPENCOLLECTIVE=1
+export NO_UPDATE_NOTIFIER=1
+export NPM_CONFIG_FUND=false
+export NPM_CONFIG_UPDATE_NOTIFIER=false
+export OPEN_SOURCE_CONTRIBUTOR=true
+export OPENCOLLECTIVE_HIDE=1
+
+# can everyone stop being so creepy pls
 export AZURE_CORE_COLLECT_TELEMETRY=0
 export CHECKPOINT_DISABLE=1
+export CLI_COLLECT_METRICS=0
+export CLOUDSDK_CORE_DISABLE_USAGE_REPORTING=true
+export DOTNET_CLI_TELEMETRY_OPTOUT=true
+export GATSBY_TELEMETRY_DISABLED=1
+export NEXT_TELEMETRY_DISABLED=1
+export POWERSHELL_TELEMETRY_OPTOUT=1
+export SAM_CLI_TELEMETRY=0
+export SLS_TELEMETRY_DISABLED=1
+export VAGRANT_CHECKPOINT_DISABLE=1
+export YARN_ENABLE_TELEMETRY=0
--- a/zsh/custom/functions.zsh
+++ b/zsh/custom/functions.zsh
@ -2,8 +2,18 @@

 # Make a new directory and `cd` right into it (this seems like a no-brainer)
 mkcd() {
-  mkdir -p -- "$1" &&
-  cd -P -- "$1" || return
+  mkdir -p "$1" && cd "$1"
+}
+
+# Load .env file into shell session for environment variables
+# https://github.com/thoughtbot/dotfiles/blob/main/zsh/functions/envup
+envup() {
+  if [ -f .env ]; then
+    export $(sed '/^ *#/ d' .env)
+  else
+    echo 'No .env file found' 1>&2
+    return 1
+  fi
 }

 # Start an HTTP server from a directory, optionally specifying the port
@ -61,6 +71,13 @@ extract() {
  fi
 }

+# create a jrvs.io short URL
+# ex: short https://github.com/jakejarvis/dotfiles jakesdotfiles => https://jrvs.io/jakesdotfiles
+# https://github.com/jakejarvis/jrvs.io/blob/main/short.sh
+short() {
+  ( cd "$HOME/source/jrvs.io" && bash -c "./short.sh $*" )
+}
+
 # Create a git.io short URL (custom slug optional)
 # ex: gitio https://github.com/jakejarvis/dotfiles [jakesdotfiles] => https://git.io/jakesdotfiles
 # https://blog.github.com/2011-11-10-git-io-github-url-shortener
--- a/zsh/custom/macos.zsh
+++ b/zsh/custom/macos.zsh
@ -1,7 +1,15 @@
 #!/usr/bin/env zsh

 export BROWSER="/Applications/Firefox.app/Contents/MacOS/firefox"
-# export BROWSER="/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome"
+
+# https://developer.1password.com/docs/ssh/get-started#step-4-configure-your-ssh-or-git-client
+if [[ -S "$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock" ]]; then
+  export SSH_AUTH_SOCK="$HOME/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"
+fi
+
+export HOMEBREW_CASK_OPTS="--appdir=/Applications"  # --require-sha
+export HOMEBREW_FORCE_BREWED_CURL=1
+export HOMEBREW_FORCE_BREWED_GIT=1

 # Rosetta hacks for M1
 alias intel="arch -x86_64 /bin/zsh"
@ -16,17 +24,13 @@ system_update() {
  brew update
  brew upgrade
  # avoid annoying `(latest) != latest` cask updates:
-  # shellcheck disable=SC2046
  brew upgrade $(brew outdated --greedy --verbose | awk '$2 !~ /(latest)/ {print $1}')
  brew cleanup

  # node, npm, yarn
  echo -e "${YELLOW}Updating global NPM/Yarn packages...${NC}"
-  volta fetch node@latest  # pull latest non-LTS version but don't use it
-  volta install node@lts
-  volta install yarn@1
-  volta run --node lts --no-yarn -- npm update --global
-  volta run --node lts --yarn 1 -- yarn global upgrade
+  fnm install --latest --corepack-enabled
+  npm update --global --no-audit

  # ruby, gems
  echo -e "${YELLOW}Updating Ruby and gems...${NC}"
@ -43,6 +47,11 @@ system_update() {
  echo -e "${YELLOW}Updating pip packages...${NC}"
  pip3 list --outdated --format=json | jq -r '.[] | .name+"="+.latest_version' | cut -d = -f 1 | xargs -n1 pip3 install -U

+  # zinit & plugins
+  echo -e "${YELLOW}Updating zinit...${NC}"
+  zinit self-update
+  zinit update --all
+
  # App Store
  echo -e "${YELLOW}Checking for App Store updates...${NC}"
  mas outdated
@ -50,20 +59,16 @@ system_update() {
  # macOS system
  echo -e "${YELLOW}Checking for macOS system updates...${NC}"
  softwareupdate --list
-
-  # zinit & plugins
-  echo -e "${YELLOW}Updating zinit...${NC}"
-  zinit self-update
-  zinit update --all
 }

-alias rehide="defaults write com.apple.finder AppleShowAllFiles -bool false && killall Finder"
-alias unhide="defaults write com.apple.finder AppleShowAllFiles -bool true && killall Finder"
+alias unhidden="defaults write com.apple.finder AppleShowAllFiles -bool true && killall Finder"
+alias rehidden="defaults write com.apple.finder AppleShowAllFiles -bool false && killall Finder"
 alias force_empty="sudo rm -rf ~/.Trash /Volumes/*/.Trashes"
 alias unq="sudo xattr -rd com.apple.quarantine"

-alias gpu="system_profiler SPDisplaysDataType"
-alias cpu="sysctl -n machdep.cpu.brand_string"
+# hide/show all desktop icons (useful when presenting)
+alias hidedesk="defaults write com.apple.finder CreateDesktop -bool false && killall Finder"
+alias showdesk="defaults write com.apple.finder CreateDesktop -bool true && killall Finder"

 alias ripfinder="killall Finder"
 alias ripdock="killall Dock"
@ -83,9 +88,8 @@ alias flush="sudo killall -HUP mDNSResponder; sudo killall mDNSResponderHelper;
 alias ios_sim="open /Applications/Xcode.app/Contents/Developer/Applications/Simulator.app"
 alias watchos_sim="open /Applications/Xcode.app/Contents/Developer/Applications/Simulator\ \(Watch\).app"

-# convenient access to public key
+# convenient access to ssh public key
 alias pubkey="pbcopy < ~/.ssh/id_ed25519.pub && echo '=> Public key copied to clipboard.'"
-alias pubkey_rsa="pbcopy < ~/.ssh/id_rsa.pub && echo '=> Public key copied to clipboard.'"

 # workaround for lack of tailscale CLI on mac:
 # https://tailscale.com/kb/1080/cli/?tab=macos#using-the-cli
--- a/zsh/custom/path.zsh
+++ b/zsh/custom/path.zsh
@ -1,76 +1,132 @@
 #!/usr/bin/env zsh

-# set PATH, MANPATH, etc., for Homebrew
-if [[ -x /opt/homebrew/bin/brew ]]; then
+# Homebrew's location is different depending on OS...
+# https://github.com/Homebrew/install/blob/master/install.sh#L122
+if [[ -d /opt/homebrew ]]; then
  # macOS on Apple Silicon
-  eval "$(/opt/homebrew/bin/brew shellenv)"
-elif [[ -x /usr/local/bin/brew ]]; then
-  # macOS on x86
-  eval "$(/opt/homebrew/bin/brew shellenv)"
-elif [[ -d /home/linuxbrew/.linuxbrew ]]; then
-  # Linux, system install
-  eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+  BREW_BIN="/opt/homebrew/bin/brew"
 elif [[ -d "$HOME/.linuxbrew" ]]; then
  # Linux, user install
-  eval "$("$HOME/.linuxbrew/bin/brew" shellenv)"
+  # NOTE: definitely discouraged, maybe deprecated? https://github.com/Homebrew/install/pull/702
+  BREW_BIN="$HOME/.linuxbrew/bin/brew"
+elif [[ -d /home/linuxbrew/.linuxbrew ]]; then
+  # Linux, system install
+  BREW_BIN="/home/linuxbrew/.linuxbrew/bin/brew"
+else
+  # macOS on Intel (hopefully, or else we're kinda doomed...)
+  BREW_BIN="/usr/local/bin/brew"
 fi

-# a lot of this file only applies to macOS
-if [[ "$OSTYPE" = "darwin"* ]]; then
-  # remap macOS core utils to GNU equivalents (from coreutils, findutils, gnu-*, etc.):
-  # https://gist.github.com/skyzyx/3438280b18e4f7c490db8a2a2ca0b9da?permalink_comment_id=3049694#gistcomment-3049694
-  if command -v brew &>/dev/null; then
-    for gbin in "$(brew --prefix)"/opt/*/libexec/gnubin; do
-      export PATH="$gbin:$PATH"
+# set PATHs for Homebrew (if we found it)
+if [[ -x "$BREW_BIN" ]]; then
+  eval "$("$BREW_BIN" shellenv)"
+
+  # macOS-only remedies
+  if [[ "$OSTYPE" = darwin* ]]; then
+    # manually add VS Code 'code' command to path
+    # https://code.visualstudio.com/docs/setup/mac#_alternative-manual-instructions
+    if [[ -d "/Applications/Visual Studio Code.app/Contents/Resources/app/bin" ]]; then
+      path=("/Applications/Visual Studio Code.app/Contents/Resources/app/bin" $path)
+    fi
+
+    # remap macOS core utils to GNU equivalents without needing the 'g' prefix (e.g. ggrep -> grep):
+    # https://gist.github.com/skyzyx/3438280b18e4f7c490db8a2a2ca0b9da?permalink_comment_id=3049694#gistcomment-3049694
+    for gnubin in "$(brew --prefix)"/opt/*/libexec/gnubin; do
+      path=($gnubin $path)
    done
-    # Ensure `man` refers to the new binaries:
-    for gman in "$(brew --prefix)"/opt/*/libexec/gnuman; do
-      export MANPATH="$gman:$MANPATH"
+
+    # ensure man also points to the GNU manuals
+    for gnuman in "$(brew --prefix)"/opt/*/libexec/gnuman; do
+      manpath=($gnuman $manpath)
    done
-    unset gbin gman

-    # shellcheck disable=SC2155
-    export HELPDIR="$(brew --prefix)/share/zsh/help"
+    # declare the base xcode & homebrew paths first
+    LDFLAGS="${LDFLAGS:+"$LDFLAGS "}-L$(brew --prefix)/lib"
+    CFLAGS="${CPPFLAGS:+"$CPPFLAGS "}-I$(brew --prefix)/include -I$(brew --prefix openjdk)/include"
+    PKG_CONFIG_PATH="${PKG_CONFIG_PATH:+${PKG_CONFIG_PATH}:}$(brew --prefix)/lib/pkgconfig"

-    # OpenJDK
-    # shellcheck disable=SC2155
-    export PATH="$(brew --prefix)/opt/openjdk/bin:$PATH"
+    # tell compilers and pkg-config where to find the homebrew versions (rather than the vendored macOS versions) of the
+    # following packages:
+    declare -a compiler_libs=(
+      bzip2
+      curl
+      jemalloc
+      libffi
+      gettext
+      libxml2
+      ncurses
+      openssl@1.1
+      readline
+      sqlite
+      tcl-tk
+      icu4c
+      xz
+      zlib
+    )

-    # macOS-only fixes for rbenv/ruby below
-    # shellcheck disable=SC2155
-    export RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@1.1) --with-readline-dir=$(brew --prefix readline) --with-libyaml-dir=$(brew --prefix libyaml) --with-jemalloc-dir=$(brew --prefix jemalloc)"
+    # append the specific paths for each of the above libraries
+    for lib in $compiler_libs; do
+      # TODO: 'brew --prefix' got pretty slow in Homebrew v4, so these calls should be cleaned up/optimized
+      # https://github.com/Homebrew/brew/commit/ca32473a672ef08be60792a921a3a1e4dcc32e13
+      LDFLAGS+=" -L$(brew --prefix $lib)/lib"
+      CFLAGS+=" -I$(brew --prefix $lib)/include"
+      PKG_CONFIG_PATH+=":$(brew --prefix $lib)/lib/pkgconfig"
+    done

-    # tell compilers where to find all of this stuff
-    # shellcheck disable=SC2155
-    export LDFLAGS="$LDFLAGS -L$(brew --prefix openssl@1.1)/lib -L$(brew --prefix readline)/lib -L$(brew --prefix jemalloc)/lib"
-    # shellcheck disable=SC2155
-    export CPPFLAGS="$CPPFLAGS -I$(brew --prefix openjdk)/include -I$(brew --prefix openssl@1.1)/include -I$(brew --prefix readline)/include -I$(brew --prefix jemalloc)/include"
+    # it's easier to do ruby opts separately as it needs different libraries than above in a very different format
+    RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@1.1) --with-readline-dir=$(brew --prefix readline) --with-jemalloc-dir=$(brew --prefix jemalloc) --with-libffi-dir=$(brew --prefix libffi) --with-libyaml-dir=$(brew --prefix libyaml) $RUBY_CONFIGURE_OPTS"
+
+    # add xcode flags last
+    if command -v xcrun &>/dev/null; then
+      LDFLAGS+=" -L$(xcrun --show-sdk-path)/usr/lib"
+      CFLAGS+=" -I$(xcrun --show-sdk-path)/usr/include"
+      PKG_CONFIG_PATH+=":$(brew --prefix $lib)/lib/pkgconfig"
+    fi
+
+    # finally all done with this mess
+    export LDFLAGS CPPFLAGS PKG_CONFIG_PATH RUBY_CONFIGURE_OPTS
+    unset gnubin gnuman compiler_libs lib
  fi
+else
+  echo "⚠️ Homebrew can't be found in any of the normal locations. Are you sure it's installed?"
 fi

 # go
 if [[ -d "$HOME/golang" ]]; then
  export GOPATH="$HOME/golang"
-  export PATH="$GOPATH/bin:$PATH"
+  path=("$GOPATH/bin" $path)
 fi

 # rust/cargo
 if [[ -d "$HOME/.cargo" ]]; then
-  export PATH="$HOME/.cargo/bin:$PATH"
+  path=("$HOME/.cargo/bin" $path)
+fi
+
+# fnm
+if command -v fnm &>/dev/null; then
+  eval "$(fnm env --use-on-cd --shell zsh)"
 fi

 # rbenv
 if command -v rbenv &>/dev/null; then
-  eval "$(rbenv init --no-rehash - zsh)"
+  eval "$(rbenv init - --no-rehash zsh)"
 fi

 # pyenv
 if command -v pyenv &>/dev/null; then
-  eval "$(pyenv init --no-rehash - zsh)"
+  eval "$(pyenv init - --no-rehash zsh)"
+
+  # pyenv-virtualenv
+  if command -v pyenv-virtualenv-init &>/dev/null; then
+    eval "$(pyenv virtualenv-init - zsh)"
+  fi
 fi

-# volta
-if [[ -d "$HOME/.volta" ]]; then
-  export VOLTA_HOME="$HOME/.volta"
-  export PATH="$VOLTA_HOME/bin:$PATH"
+# docker user mode, see: https://docs.docker.com/desktop/mac/permission-requirements/#installing-symlinks
+if [[ -d "$HOME/.docker/bin" ]]; then
+  path=("$HOME/.docker/bin" $path)
 fi
+
+# let zsh sort out formatting and deduplication
+typeset -aU path fpath manpath
+export PATH FPATH MANPATH
--- a/zsh/custom/plugins.zsh
+++ b/zsh/custom/plugins.zsh
@ -1,42 +1,48 @@
 #!/usr/bin/env zsh

-# check for zinit and clone if not installed
-ZINIT_HOME="$HOME/.local/share/zinit/zinit.git"
-if [[ ! -d "$ZINIT_HOME" ]]; then
-  mkdir -p "$(dirname "$ZINIT_HOME")"
-  git clone https://github.com/zdharma-continuum/zinit.git "$ZINIT_HOME"
+# these custom values must be set *before* sourcing zinit
+export ZINIT_HOME="${ZINIT_HOME:-"${XDG_DATA_HOME:-"${HOME}/.local/share"}/zinit/zinit.git"}"
+declare -A ZINIT=(
+  [ZCOMPDUMP_PATH]="${XDG_CACHE_HOME:-"$HOME/.cache"}/zsh/.zcompdump-$ZSH_VERSION"
+)
+
+# check for zinit
+if [[ -f "$ZINIT_HOME/zinit.zsh" ]]; then
+  source "$ZINIT_HOME/zinit.zsh"
+else
+  echo "zinit not found in '$ZINIT_HOME', either check the value of ZINIT_HOME or install zinit."
+  return
 fi

-# initialize zinit
-# shellcheck disable=SC1091
-source "$ZINIT_HOME/zinit.zsh"
-
-# ensure compinit recognizes zinit's changes
+# initialize zinit && ensure compinit recognizes its completions
 autoload -Uz _zinit
-# shellcheck disable=SC2154
 (( ${+_comps} )) && _comps[zinit]=_zinit

+# TODO: figure out why zinit stopped adding itself to MANPATH automatically...
+if [[ -d "${ZINIT[MAN_DIR]}" ]]; then
+  manpath=(
+    "${ZINIT[MAN_DIR]}"
+    $manpath
+  )
+fi
+
 # various zinit add-ons
 zinit light zdharma-continuum/zinit-annex-patch-dl

+# oh-my-zsh was good at setting iTerm tab titles, keep doing it pls
+# https://github.com/ohmyzsh/ohmyzsh/tree/master/lib
+zinit snippet OMZ::lib/functions.zsh
+zinit snippet OMZ::lib/termsupport.zsh
+zinit snippet OMZ::lib/compfix.zsh
+
 # async support
-zinit ice wait lucid \
+zinit ice lucid depth"1" \
  atload"async_init" \
  src"async.zsh"
 zinit light mafredri/zsh-async

-# z
-zinit ice wait lucid blockf \
-  atclone"
-    mv -vf z.1 ${ZINIT[MAN_DIR]}/man1
-  " \
-  atpull"%atclone" \
-  atload"_Z_DATA=~/.zdata" \
-  src"z.sh"
-zinit light rupa/z
-
 # grab exa (better ls) binary
-zinit ice from"gh-r" as"command" \
+zinit ice lucid from"gh-r" as"command" \
  mv"bin/exa* -> exa" \
  atclone"
    mv -vf completions/exa.zsh _exa
@ -52,7 +58,7 @@ zinit ice from"gh-r" as"command" \
 zinit light ogham/exa

 # grab bat (better cat) binary
-zinit ice from"gh-r" as"command" \
+zinit ice lucid from"gh-r" as"command" \
  mv"bat-*/bat -> bat" \
  atclone"
    mv -vf bat-*/autocomplete/bat.zsh _bat
@ -61,95 +67,121 @@ zinit ice from"gh-r" as"command" \
  atpull"%atclone" \
  atload"
    export BAT_THEME='base16'
-    export BAT_PAGER='less -R -F -+X --mouse'
    export MANPAGER='sh -c \"col -bx | bat --color=always --style=plain --language=man\"'
-    alias cat='bat --paging=never --color=auto --style=numbers,changes'
-    alias cats='bat --paging=always --color=always --style=numbers,changes'
-    alias catcat='\cat --paging=never --color=auto --style=plain'
+    alias cat='bat --paging=always --color=auto --style=numbers,changes'
+    alias plcat='bat --paging=never --color=auto --style=plain'
  "
 zinit light sharkdp/bat

 # grab delta binary
-zinit ice from"gh-r" as"command" \
+zinit ice lucid from"gh-r" as"command" \
  mv"delta-*/delta -> delta" \
-  dl"https://github.com/dandavison/delta/raw/HEAD/etc/completion/completion.zsh -> _delta" \
-  atload"
-    # https://dandavison.github.io/delta/mouse-scrolling.html
-    export DELTA_PAGER='less -R -F -+X --mouse'
-  "
+  dl"https://github.com/dandavison/delta/raw/HEAD/etc/completion/completion.zsh -> _delta"
 zinit light dandavison/delta

 # grab fd binary
-# TODO: preview commands are an absolute sh*tshow, maybe use .lessfilter?
-# https://github.com/Aloxaf/fzf-tab/wiki/Preview#show-file-contents
-# shellcheck disable=SC2016
-zinit ice from"gh-r" as"command" \
+zinit ice lucid from"gh-r" as"command" \
  mv"fd-*/fd -> fd" \
  atclone"
    mv -vf fd-*/autocomplete/_fd _fd
    mv -vf fd-*/fd.1 ${ZINIT[MAN_DIR]}/man1
  " \
-  atpull"%atclone" \
-  atload'
-    FZF_FD_OPTS="--color always --hidden --follow --exclude .git --exclude node_modules"
-    FZF_PREVIEW_FILE_COMMAND="bat --color=always --paging=never --style=plain"
-    FZF_PREVIEW_DIR_COMMAND="exa -1a --color=always --icons --group-directories-first"
-    FZF_DEFAULT_OPTS="--no-mouse --bind \"tab:accept,ctrl-y:preview-page-up,ctrl-v:preview-page-down,ctrl-e:execute-silent(\${VISUAL:-code} {+} >/dev/null 2>&1)\""
-    FZF_DEFAULT_COMMAND="fd --type f $FZF_FD_OPTS"
-    FZF_ALT_C_OPTS="--ansi --preview \"$FZF_PREVIEW_DIR_COMMAND {} 2>/dev/null\""
-    FZF_ALT_C_COMMAND="fd --type d . $FZF_FD_OPTS"
-    FZF_CTRL_T_OPTS="--ansi --bind \"ctrl-w:execute(\${EDITOR:-nano} {1} >/dev/tty </dev/tty)+refresh-preview\" --preview \"$FZF_PREVIEW_FILE_COMMAND {} 2>/dev/null\""
-    FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
-  '
+  atpull"%atclone"
 zinit light sharkdp/fd

 # grab fzf binary from release & other files from source
-zinit ice from"gh-r" as"command" \
+# TODO: preview commands are an absolute sh*tshow, maybe use .lessfilter?
+# https://github.com/Aloxaf/fzf-tab/wiki/Preview#show-file-contents
+zinit ice lucid from"gh-r" as"command" \
  dl"https://github.com/junegunn/fzf/raw/HEAD/shell/key-bindings.zsh -> key-bindings.zsh" \
  dl"https://github.com/junegunn/fzf/raw/HEAD/shell/completion.zsh -> _fzf" \
  dl"https://github.com/junegunn/fzf/raw/HEAD/man/man1/fzf.1 -> ${ZINIT[MAN_DIR]}/man1/fzf.1" \
  dl"https://github.com/junegunn/fzf/raw/HEAD/man/man1/fzf-tmux.1 -> ${ZINIT[MAN_DIR]}/man1/fzf-tmux.1" \
+  atload'
+    export FZF_FD_OPTS="--color always --hidden --follow --exclude .git --exclude node_modules"
+    export FZF_PREVIEW_FILE_COMMAND="bat --color=always --paging=never --style=plain"
+    export FZF_PREVIEW_DIR_COMMAND="exa -1a --color=always --icons --group-directories-first"
+    export FZF_DEFAULT_OPTS="--cycle --select-1 --exit-0 --height=60% --no-mouse --bind=\"tab:accept,ctrl-y:preview-page-up,ctrl-v:preview-page-down,ctrl-e:execute-silent(\${VISUAL:-\$EDITOR} {+} >/dev/null 2>&1)\""
+    export FZF_DEFAULT_COMMAND="fd --type f $FZF_FD_OPTS"
+    export FZF_ALT_C_OPTS="-i --ansi --preview=\"$FZF_PREVIEW_DIR_COMMAND {}\""
+    export FZF_ALT_C_COMMAND="fd --type d . $FZF_FD_OPTS"
+    export FZF_CTRL_T_OPTS="-i --ansi --bind=\"ctrl-w:execute(\$EDITOR {1} >/dev/tty </dev/tty)+refresh-preview\" --preview=\"$FZF_PREVIEW_FILE_COMMAND {} 2>/dev/null\""
+    export FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
+  ' \
  src"key-bindings.zsh"
 zinit light junegunn/fzf

+# zoxide
+zinit ice wait"0b" lucid from"gh-r" as"command" \
+  atclone"
+    mv -vf man/man1/zoxide* ${ZINIT[MAN_DIR]}/man1
+    ./zoxide init zsh > init.zsh
+    zcompile init.zsh
+  " \
+  atpull"%atclone" \
+  atinit'
+    export _ZO_DATA_DIR="${XDG_DATA_HOME:-"$HOME/.local/share"}/zoxide"
+    export _ZO_FZF_OPTS="$FZF_DEFAULT_OPTS --exact --no-sort --ansi --reverse --preview=\"$FZF_PREVIEW_DIR_COMMAND {2..}\""
+  ' \
+  src"init.zsh"
+zinit light ajeetdsouza/zoxide
+
 # grab vivid binary (for all the colors)
 # https://github.com/sharkdp/vivid/tree/master/themes
-# shellcheck disable=SC2016
-zinit ice from"gh-r" as"command" \
+# by outputting the generated LS_COLORS variable to a file and sourcing it, we only need to call vivid once on
+# installation rather than every time a new session begins.
+zinit ice lucid from"gh-r" as"command" \
  mv"vivid-*/vivid -> vivid" \
-  atload'export LS_COLORS="$(vivid generate snazzy)"'
-zinit load sharkdp/vivid
+  atclone"
+    ./vivid generate snazzy | xargs printf 'export LS_COLORS=%q' > colors.zsh
+  " \
+  atpull"%atclone" \
+  atload"zstyle ':completion:*' list-colors \${(s.:.)LS_COLORS}" \
+  src"colors.zsh"
+zinit light sharkdp/vivid

-# history substring searching
-# only bind these keys once they're ready
-bindkey -r "^[[A"
-bindkey -r "^[[B"
-zinit ice wait lucid \
+# better Ctrl+R history searching
+zinit ice wait lucid depth"1" \
  atload"
-    zmodload zsh/terminfo
-    bindkey '^[[A' history-substring-search-up
-    bindkey '^[[B' history-substring-search-down
-  "
-zinit light zsh-users/zsh-history-substring-search
+    zstyle ':history-search-multi-word' highlight-color 'fg=yellow,bold'
+    zstyle ':history-search-multi-word' page-size 15
+    zstyle ':plugin:history-search-multi-word' active 'standout'
+    zstyle ':plugin:history-search-multi-word' reset-prompt-protect 1
+  " \
+  trackbinds
+zinit light zdharma-continuum/history-search-multi-word

 # tab completions via fzf
-zinit ice wait"1" lucid \
+zinit ice wait"0b" lucid depth"1" \
  has"fzf" \
+  blockf \
+  atpull"zinit creinstall -q ." \
  atload"
-    zstyle ':completion:*' verbose yes
-    zstyle ':completion:*' list-colors \${(s.:.)LS_COLORS}
-    zstyle ':completion:*:descriptions' format '[%d]'
-    zstyle ':completion::complete:*:*:files' ignored-patterns '.DS_Store' 'Icon?' '.Trash'
-    zstyle ':completion::complete:*:*:globbed-files' ignored-patterns '.DS_Store' 'Icon?' '.Trash'
+    zstyle ':completion:*' verbose true
+    zstyle ':completion:*' use-cache true
+    zstyle ':completion:*' cache-path '$(dirname ${ZINIT[ZCOMPDUMP_PATH]})/.zcompcache'
+    zstyle ':completion:*' rehash true
+    zstyle ':completion:*' squeeze-slashes true
+    zstyle ':completion:*' list-dirs-first true
+    zstyle ':completion:*' keep-prefix true
+    zstyle ':completion:*' special-dirs true
+    zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}' 'r:|[._-]=* r:|=*' 'l:|=* r:|=*'
+    zstyle ':completion:*' menu select
+    zstyle ':completion:*' group-name ''
+    zstyle ':completion:*' select-prompt '%SScrolling active: current selection at %p%s'
+    zstyle ':completion:*:descriptions' format '%d'
+    zstyle ':completion:*:functions' ignored-patterns '_*'
+    zstyle ':completion::complete:*:*:files' ignored-patterns '.DS_Store' 'Icon?'
+    zstyle ':completion::complete:*:*:globbed-files' ignored-patterns '.DS_Store' 'Icon?'
    zstyle ':completion::complete:rm:*:globbed-files' ignored-patterns
-    zstyle ':fzf-tab:*' fzf-command fzf
-    zstyle ':fzf-tab:*' fzf-flags '--ansi'
+    zstyle ':fzf-tab:*' fzf-command 'fzf'
+    zstyle ':fzf-tab:*' fzf-flags $FZF_DEFAULT_OPTS '-i' '--ansi'
    zstyle ':fzf-tab:*' fzf-bindings \
      'tab:accept' \
      'ctrl-y:preview-page-up' \
      'ctrl-v:preview-page-down' \
-      'ctrl-e:execute-silent(\${VISUAL:-code} \$realpath >/dev/null 2>&1)' \
-      'ctrl-w:execute(\${EDITOR:-nano} \$realpath >/dev/tty </dev/tty)+refresh-preview'
+      'ctrl-e:execute-silent(\${VISUAL:-\$EDITOR} \$realpath >/dev/null 2>&1)' \
+      'ctrl-w:execute(\$EDITOR \$realpath >/dev/tty </dev/tty)+refresh-preview'
    zstyle ':fzf-tab:*' fzf-min-height 15
    zstyle ':fzf-tab:complete:git-(add|diff|restore):*' fzf-preview \
      'git diff --no-ext-diff \$word | delta --paging=never --no-gitconfig --line-numbers --file-style=omit --hunk-header-style=omit --theme=base16'
@ -170,86 +202,138 @@ zinit ice wait"1" lucid \
  "
 zinit light Aloxaf/fzf-tab

-# TODO: fix git-* completions, apparently there's some conflict with brew's git
-# https://github.com/Aloxaf/fzf-tab/wiki/Preview#git
-# shellcheck disable=SC2016
-zinit ice wait lucid as"completions" \
-  id-as"git-completions" \
-  has"git" \
-  dl"https://github.com/git/git/raw/HEAD/contrib/completion/git-completion.zsh -> _git" \
-  dl"https://github.com/git/git/raw/HEAD/contrib/completion/git-completion.bash -> git-completion.bash" \
+# fix git-* completions, apparently there's some conflict with brew's git
+# TODO: investigate more... https://github.com/Aloxaf/fzf-tab/wiki/Preview#git
+zinit ice wait lucid as"null" \
+  atload'zstyle ":completion:*:*:git:*" script "$(pwd)/git-completion.bash"'
+zinit snippet https://github.com/git/git/raw/HEAD/contrib/completion/git-completion.bash
+
+# grab completions as snippets from GitHub repos
+zinit wait lucid as"completion" \
  atpull"zinit creinstall -q ." \
-  atload'
-    zstyle ":completion:*:*:git:*" script "$PWD/git-completion.bash"
-  ' \
-  nocompile
+  nocompile \
+  for \
+    has"bundle"           https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_bundle \
+    has"conda"            https://github.com/conda-incubator/conda-zsh-completion/raw/HEAD/_conda \
+    has"docker"           https://github.com/docker/cli/raw/HEAD/contrib/completion/zsh/_docker \
+    has"golang"           https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_golang \
+    has"nano"             https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_nano \
+    has"node"             https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_node \
+    has"nvm"              https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_nvm \
+    has"psql"             https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_pgsql_utils \
+    has"rails"            https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_rails \
+    has"rbenv"            https://github.com/rbenv/rbenv/raw/HEAD/completions/_rbenv \
+    has"redis-cli"        https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_redis-cli \
+    has"shellcheck"       https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_shellcheck \
+    has"vagrant"          https://github.com/hashicorp/vagrant/raw/HEAD/contrib/zsh/_vagrant \
+    has"yarn"             https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_yarn \
+    has"git"    mv"git-completion.zsh -> _git"    https://github.com/git/git/raw/HEAD/contrib/completion/git-completion.zsh \
+    has"pyenv"  mv"pyenv.zsh -> _pyenv"    https://github.com/pyenv/pyenv/raw/HEAD/completions/pyenv.zsh \
+    if'[[ "$OSTYPE" = linux-gnu* ]]'  has"fail2ban-client"    https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_fail2ban-client \
+    if'[[ "$OSTYPE" = linux-gnu* ]]'  has"ufw"                https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_ufw \
+    if'[[ "$OSTYPE" = darwin* ]]'     has"security"           https://github.com/ohmyzsh/ohmyzsh/raw/HEAD/plugins/macos/_security \
+
+# generate other completions from externally installed programs
+zinit wait lucid as"completion" \
+  atpull"zinit creinstall -q ." \
+  nocompile \
+  for \
+    has"doctl"      id-as"_local/completions/doctl"       atclone"doctl completion zsh > _doctl"          zdharma-continuum/null \
+    has"fnm"        id-as"_local/completions/fnm"         atclone"fnm completions --shell zsh > _fnm"            zdharma-continuum/null \
+    has"gh"         id-as"_local/completions/gh"          atclone"gh completion -s zsh > _gh"             zdharma-continuum/null \
+    has"glab"       id-as"_local/completions/glab"        atclone"glab completion -s zsh > _glab"         zdharma-continuum/null \
+    has"helm"       id-as"_local/completions/helm"        atclone"helm completion zsh > _helm"           zdharma-continuum/null \
+    has"hugo"       id-as"_local/completions/hugo"        atclone"hugo completion zsh > _hugo"            zdharma-continuum/null \
+    has"kubectl"    id-as"_local/completions/kubectl"     atclone"kubectl completion zsh > _kubectl"      zdharma-continuum/null \
+    has"minikube"   id-as"_local/completions/minikube"    atclone"minikube completion zsh > _minikube"    zdharma-continuum/null \
+    has"ng"         id-as"_local/completions/ng"          atclone"ng completion script > _ng"             zdharma-continuum/null \
+    has"op"         id-as"_local/completions/op"          atclone"op completion zsh > _op"                zdharma-continuum/null \
+    has"pip"        id-as"_local/completions/pip"         atclone"pip completion --zsh > pip"             zdharma-continuum/null \
+    has"pnpm"       id-as"_local/completions/pnpm"        atclone"pnpm completion zsh > _pnpm"            zdharma-continuum/null \
+    has"pscale"     id-as"_local/completions/pscale"      atclone"pscale completion zsh > _pscale"        zdharma-continuum/null \
+    has"rustup"     id-as"_local/completions/rustup"      atclone"rustup completions zsh > _rustup"       zdharma-continuum/null \
+    has"supabase"   id-as"_local/completions/supabase"    atclone"supabase completion zsh > _supabase"    zdharma-continuum/null \
+    has"tailscale"  id-as"_local/completions/tailscale"   atclone"tailscale completion zsh > _tailscale"  zdharma-continuum/null
+
+# fix git-* completions, apparently there's some conflict with brew's git
+# TODO: investigate more... https://github.com/Aloxaf/fzf-tab/wiki/Preview#git
+zinit ice wait lucid as"null" \
+  atload'zstyle ":completion:*:*:git:*" script "$(pwd)/git-completion.bash"'
+zinit snippet https://github.com/git/git/raw/HEAD/contrib/completion/git-completion.bash
+
+# macOS-only completion fixes
+zinit ice wait lucid as"null" \
+  id-as"_local/extra/mac" \
+  if'[[ "$OSTYPE" = darwin* ]]' \
+  atload"
+    zstyle ':completion:*:*:*:*:processes' command 'ps -o comm=\"\" -w -w'
+    zstyle ':fzf-tab:complete:(kill|ps):argument-rest' fzf-preview \
+      '[[ \$group == \"process ID\" ]] && ps -p\$word -o comm=\"\" -w -w'
+  "
 zinit light zdharma-continuum/null

-# use zinit to track completions from non-zinit programs
-zinit ice wait lucid blockf as"completions" \
-  id-as"local-completions" \
-  dl"https://github.com/docker/cli/raw/HEAD/contrib/completion/zsh/_docker -> _docker" \
-  dl"https://github.com/docker/compose/raw/master/contrib/completion/zsh/_docker-compose -> _docker-compose" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_node -> _node" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_yarn -> _yarn" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_bundle -> _bundle" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_rails -> _rails" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_golang -> _golang" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_shellcheck -> _shellcheck" \
-  dl"https://github.com/zsh-users/zsh-completions/raw/HEAD/src/_httpie -> _httpie" \
-  dl"https://github.com/rbenv/rbenv/raw/HEAD/completions/rbenv.zsh -> _rbenv" \
-  dl"https://github.com/pyenv/pyenv/raw/HEAD/completions/pyenv.zsh -> _pyenv" \
-  atclone"
-    command -v volta &>/dev/null && volta completions zsh > _volta || true
-    command -v npm &>/dev/null && npm completion > _npm || true
-    command -v gh &>/dev/null && gh completion -s zsh > _gh || true
-    command -v op &>/dev/null && op completion zsh > _op || true
-    command -v hugo &>/dev/null && hugo completion zsh > _hugo || true
-  " \
-  atpull"zinit creinstall -q ." \
-  nocompile
+# Linux-only completion fixes
+zinit ice wait lucid as"null" \
+  id-as"_local/extra/linux" \
+  if'[[ "$OSTYPE" = linux-gnu* ]]' \
+  atload"
+    zstyle ':completion:*:*:*:*:processes' command 'ps -o cmd --no-headers -w -w'
+    zstyle ':fzf-tab:complete:(kill|ps):argument-rest' fzf-preview \
+      '[[ \$group == \"process ID\" ]] && ps --pid=\$word -o cmd --no-headers -w -w'
+    zstyle ':fzf-tab:complete:systemctl-*:*' fzf-preview 'SYSTEMD_COLORS=1 systemctl status \$word'
+  "
 zinit light zdharma-continuum/null

-# additional completions
-# zinit ice wait lucid blockf as"completion" \
-#   atpull"zinit creinstall -q ."
-# zinit light zsh-users/zsh-completions
+# autopairing of quotes, brackets, etc.
+zinit ice wait"0b" lucid depth"1" \
+  atload"ZSH_AUTOSUGGEST_CLEAR_WIDGETS+=(autopair-insert)"
+zinit light hlissner/zsh-autopair
+
+# syntax highlighting
+zinit ice wait lucid depth"1" \
+  atinit"ZINIT[COMPINIT_OPTS]=-C; zicompinit; zicdreplay" \
+  atload"
+    zle_highlight+=('paste:reverse')
+    zstyle ':plugin:fast-syntax-highlighting' theme ''
+    typeset -gA FAST_HIGHLIGHT_STYLES
+    FAST_HIGHLIGHT_STYLES[${FAST_THEME_NAME:-}variable]='fg=cyan,bold'
+  "
+zinit light zdharma-continuum/fast-syntax-highlighting

 # autosuggestions, trigger precmd hook upon load
-zinit ice wait lucid \
+zinit ice wait"0a" lucid depth"1" \
+  atinit"
+    export ZSH_AUTOSUGGEST_BUFFER_MAX_SIZE=20
+    export ZSH_AUTOSUGGEST_MANUAL_REBIND=1
+    export ZSH_AUTOSUGGEST_USE_ASYNC=1
+  " \
  atload"_zsh_autosuggest_start"
 zinit light zsh-users/zsh-autosuggestions

-# syntax highlighting
-zinit ice wait lucid \
-  atinit"ZINIT[COMPINIT_OPTS]=-C; zicompinit; zicdreplay"
-zinit light zsh-users/zsh-syntax-highlighting
-
 # 1Password plugins: https://developer.1password.com/docs/cli/shell-plugins/
-zinit ice wait lucid \
-  id-as"op-plugins" \
+# NOTE: this needs to happen *after* generating the completions above, otherwise it'll ask for touch ID to do very
+# simple tasks...
+zinit ice wait"1" lucid \
+  id-as"_local/op-auth" \
  has"op" \
-  if"[[ -f ~/.config/op/plugins.sh ]]"
+  if"[[ -f ~/.config/op/plugins.sh ]]" \
+  nocompile
 zinit snippet ~/.config/op/plugins.sh

-# oh-my-zsh leftovers
-# https://github.com/ohmyzsh/ohmyzsh/tree/master/lib
-zinit snippet OMZ::lib/clipboard.zsh
-zinit snippet OMZ::lib/termsupport.zsh
-
 # iTerm2 integration
-# shellcheck disable=SC2016
-zinit ice lucid \
+zinit ice lucid depth"1" \
  if'[[ "$TERM_PROGRAM" = "iTerm.app" ]]' \
-  pick"shell_integration/zsh" \
-  sbin"utilities/*"
+  atload'path=("$(pwd)/utilities" $path)' \
+  src"shell_integration/zsh" \
+  nocompile
 zinit light gnachman/iTerm2-shell-integration

 # starship prompt
 zinit ice from"gh-r" as"command" \
  atclone"
-    ./starship init zsh --print-full-init > init.zsh
    ./starship completions zsh > _starship
+    ./starship init zsh --print-full-init > init.zsh
+    zcompile init.zsh
  " \
  atpull"%atclone" \
  src"init.zsh"