Dotfiles overhaul: infrastructure, tooling, performance, and modernization

[STiXzoOR]

Summary

Complete overhaul of the dotfiles repository adding development infrastructure, optimizing shell performance, modernizing macOS defaults for Sonoma/Sequoia, and performing a comprehensive audit across security, correctness, and maintainability.

71 files changed, 6039 insertions, 580 deletions across 12 commits.

New Infrastructure

Development Tooling

• Test suite (dotfiles test) — 113 tests covering syntax validation, cache generation, functions, aliases, environment, Prezto config, security fixes, performance optimizations, config modernization, and dead code cleanup
• Doctor command (dotfiles doctor) — Health checks for symlinks, submodules, shell config, Homebrew, caches, tools, Node.js, git, SSH; auto-fix with --fix
• Shell profiler (dotfiles profiler) — Measures startup time, shows file-by-file breakdown, compares with/without caches
• Cheatsheet generator (dotfiles cheatsheet) — Extracts and displays all aliases and functions with search
• Secrets manager (dotfiles secrets) — macOS Keychain-backed secret storage with export/import
• Setup wizard (dotfiles setup) — Interactive TUI for bootstrapping new machines
• Brewfile — Consolidated all brew/cask/mas packages into single brew bundle manifest

CI/CD & Git Hooks

• GitHub Actions — Syntax validation, shellcheck linting, test suite, Brewfile validation (Homebrew action pinned to SHA)
• Pre-commit hooks — Bash/zsh syntax, shellcheck, secret detection; properly skip zsh scripts from bash checks
• Machine profiles — Work/personal configurations with default.zsh → profile.zsh → local.zsh loading order

Neovim Configuration

• Modern setup with lazy.nvim package manager
• Catppuccin colorscheme, Telescope, nvim-tree, Treesitter, LSP with Mason, nvim-cmp, git integration, lualine/bufferline

Shell Performance Optimization

Startup time reduced to 67ms (excellent):

• Remove double compinit call (Prezto handles it)
• Cache expensive eval outputs: fnm, zoxide, thefuck, fzf, brew shellenv, dircolors, npm completion
• Filter path_helper subprocess from brew shellenv cache
• Replace $(command -v) subprocess checks with zsh $commands[] hash lookups
• Use typeset -U for PATH deduplication (no awk subprocess)
• Reduce syntax highlighters from 6 to 3
• Fix fpath order, remove redundant sourcing

Security Hardening

• Fix unsafe git unstage alias (removed --hard flag)
• Fix printf %q injection safety in dotfiles-secrets
• Fix unsafe sh -c "$DOTFILES_IDE" → direct execution
• Replace curl+sudo get-pip.py with python3 -m ensurepip
• Add SSH config backup before overwrite
• Migrate ssh-add -K → --apple-use-keychain
• Quote all variables in function files for injection safety

macOS Defaults Modernization (Research-Backed)

All changes backed by deep research into Sonoma (14) and Sequoia (15) compatibility:

Removed (broken/obsolete)

• nvram SystemAudioVolume/StartupMute — no-op on Apple Silicon
• askForPassword/askForPasswordDelay — broken since macOS 10.13
• _FXShowPosixPathInTitle — broken on Sequoia (Finder title bar redesign)
• expose-animation-duration — unreliable since Sierra
• Simulator (Watch).app symlink — removed in Xcode 9
• defaults-messages.sh (entire file) — messageshelper domain no longer honored
• ConfigDataInstall — deprecated since Catalina
• ShowSidebarInTopSites — Top Sites replaced by Start Page in Big Sur
• IncludeInternalDebugMenu — non-functional since Safari 15+
• DisableReplyAnimations/DisableSendAnimations — broken since High Sierra
• systemsetup -setwakeonmodem — obsolete (no modem hardware)
• Deprecated macOS defaults: SMS, battery %, BezelServices, AppleFontSmoothing, QLEnableTextSelection, EmptyTrashSecurely, IDEIndexDisable

Migrated

• Wake-on-LAN: systemsetup → sudo pmset -a womp 0
• AppleKeyboardUIMode: value 3 → 2 (Sonoma/Sequoia)
• spctl --master-disable: version-guarded for macOS 15+ (requires manual confirmation on Sequoia)

Added

• Safari Full Disk Access check (sandboxed since Catalina — warns if writes will be silently ignored)
• Quick Note (value 14) to hot corners reference
• Existence check before Simulator.app symlink
• Consistent 2>/dev/null || true on systemsetup commands

Fixed

• 4 missing ok calls (3 in hot corners, 1 in Safari backspace setting)
• Stale section headers ("Dock & Dashboard" → "Dock", "TextEdit and Disk Utility" → "TextEdit")
• Duplicate Activity Monitor comment

Git & Neovim Updates

• Git: add zdiff3, histogram, autoSetupRemote, branch sort, column UI, hooksPath, autocorrect=20; fix ksdiff PATH lookup, fix unstage alias
• Neovim: migrate tsserver→ts_ls, vim.loop→vim.uv, which-key v3 API, trouble v3 API; update diagnostic.jump; remove duplicate options

Other Fixes

• Restore Powerlevel10k as active prompt (keep Starship config dormant for future use)
• Restore homebrew Prezto module and .bindings sourcing (keybindings were not loading)
• Fix LESS_TERMCAP_md undefined ${yellow} variable → ANSI escape
• Fix curlhammer() calling undefined bot function → echo
• Guard $HOME/.local/bin/env sourcing for fresh machines
• Update Nord theme URLs (arcticicestudio → nordtheme)
• Update stevenblack-hosts submodule, remove unused zsh-autocomplete
• Remove deprecated cask-fonts tap and duplicate Brewfile entries
• Remove .huskyrc (migrated to config/husky)
• Fix bin/dotfiles command dispatch for pass-through commands
• Rename fd() → finddir() to avoid shadowing fd binary
• Remove dead aliases/functions (lwp-request, vtop, json, ncd, transfer, notioff/notion)
• Replace egrep → grep -E, backticks → $(), expr → arithmetic

Test Plan

• All 113 tests pass (./bin/dotfiles test --verbose)
• Shell startup time: 67ms (excellent)
• Pre-commit hooks pass (bash syntax, zsh syntax, shellcheck, secrets)
• Shellcheck clean on all bash scripts
• Verify Powerlevel10k prompt renders correctly after exec $SHELL
• Verify key bindings work (arrow keys for history search, option+arrows for word nav)
• Run ./bin/dotfiles configure --defaults on a test machine to verify macOS defaults

🤖 Generated with Claude Code