Refactor shell, ghostty, bundles, and preferences

config/ghostty/config

@@ -3,17 +3,24 @@ font-family = SauceCodePro Nerd Font
 font-size = 14
 
 # Theme
-theme = Catppuccin Mocha
+theme = onenord
 
 # Cursor
 cursor-style = bar
 cursor-style-blink = false
+cursor-color = #ffffff
 
 # Window
+window-decoration = true
 window-padding-x = 12
 window-padding-y = 12
+window-padding-color = background
 macos-titlebar-style = tabs
 window-save-state = always
+background-opacity = 0.85
+background-blur-radius = 20
+mouse-hide-while-typing = true
+window-theme = ghostty
 
 # macOS
 macos-option-as-alt = true

config/ghostty/themes/onenord

@@ -0,0 +1,28 @@
+# OneNord colorscheme for Ghostty terminal emulator.
+#
+# To use this theme, place this file in the .config/ghostty/themes directory and load is inside of your .config/ghostty/config file with:
+#
+# theme = onenord
+#
+
+palette = 0=#3B4252
+palette = 1=#E06C75
+palette = 2=#9EC183
+palette = 3=#EBCB8B
+palette = 4=#81A1C1
+palette = 5=#B988B0
+palette = 6=#88C0D0
+palette = 7=#E5E9F0
+palette = 8=#4C566A
+palette = 9=#E06C75
+palette = 10=#9EC183
+palette = 11=#EBCB8B
+palette = 12=#81A1C1
+palette = 13=#B988B0
+palette = 14=#8FBCBB
+palette = 15=#ECEFF4
+background = 2E3440
+foreground = E5E9F0
+cursor-color = 3879C5
+selection-background = 3F4758
+selection-foreground = E5E9F0

config/mise/config.toml

@@ -8,6 +8,9 @@ not_found_auto_install = true
 # Trust config files in code directories without prompts
 trusted_config_paths = ["/Volumes/Code"]
 
+[settings.ruby]
+compile = false
+
 [env]
 MISE_DEFAULT_CONFIG_FILENAME = "mise.local.toml"
 
@@ -19,3 +22,12 @@ go = "latest"
 python = "latest"
 zig = "latest"
 lua = "latest"
+uv = "latest"
+java = "latest"
+ruby = "latest"
+dotnet = "latest"
+gradle = "latest"
+cmake = "latest"
+cocogitto = "latest"
+lefthook = "latest"
+task = "latest"

config/zsh/zshrc.omz → config/zsh/defaults.zsh

@@ -1,11 +1,8 @@
 # ============================================================================
-# Oh-My-Zsh Replacement Settings
+# Shell Defaults
 # ============================================================================
-# This file contains all the settings that Oh-My-Zsh provides by default.
-# Review each section and decide what you want to keep.
-#
-# To use: source this file from your main zshrc
-# Usage: source ~/.dotfiles/zshrc.omz
+# History, completion, keybindings, directory navigation, and aliases.
+# Based on defaults from Oh-My-Zsh (https://github.com/ohmyzsh/ohmyzsh).
 # ============================================================================
 
 # ============================================================================
@@ -42,7 +39,6 @@ setopt always_to_end             # Move cursor to end of word after completion
 # Completion styling
 zstyle ':completion:*:*:*:*:*' menu select                    # Use arrow keys to navigate menu
 zstyle ':completion:*' matcher-list 'm:{[:lower:][:upper:]}={[:upper:][:lower:]}' 'r:|=*' 'l:|=* r:|=*'  # Case-insensitive, partial-word, substring completion
-zstyle ':completion:*' list-colors ''                         # Enable colored completion
 zstyle ':completion:*' special-dirs true                      # Complete . and .. directories
 zstyle ':completion:*' use-cache yes                          # Use cache for faster completions
 zstyle ':completion:*' cache-path ~/.zsh/cache                # Cache location
@@ -185,6 +181,37 @@ setopt auto_pushd                # Push directories onto stack automatically
 setopt pushd_ignore_dups         # Don't push duplicates onto stack
 setopt pushdminus                # Swap meaning of +/- in directory stack
 
+# ============================================================================
+# TERMINAL TITLE
+# ============================================================================
+# Set tab/window title to current directory and running command
+function _set_terminal_title_preexec() {
+  # Show running command in title
+  print -Pn "\e]2;${1:gs/%/%%}\a"
+}
+function _set_terminal_title_precmd() {
+  # Show current directory in title
+  print -Pn "\e]2;%~\a"
+}
+autoload -Uz add-zsh-hook
+add-zsh-hook preexec _set_terminal_title_preexec
+add-zsh-hook precmd _set_terminal_title_precmd
+
+# ============================================================================
+# COLORS
+# ============================================================================
+# LS_COLORS for completion menu and ls fallback
+export LSCOLORS="Gxfxcxdxbxegedabagacad"
+export LS_COLORS="di=1;36:ln=35:so=32:pi=33:ex=31:bd=34;46:cd=34;43:su=30;41:sg=30;46:tw=30;42:ow=30;43"
+
+# Use LS_COLORS in completion menus
+zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
+
+# Colored grep output
+alias grep='grep --color=auto'
+alias egrep='egrep --color=auto'
+alias fgrep='fgrep --color=auto'
+
 # ============================================================================
 # MISCELLANEOUS SHELL OPTIONS
 # ============================================================================
@@ -483,5 +510,16 @@ alias gta='git tag -a'                           # Annotated tag
 export VIRTUAL_ENV_DISABLE_PROMPT=1
 
 # ============================================================================
-# END OF OH-MY-ZSH REPLACEMENT SETTINGS
+# ZSH PLUGINS (must be near end of file)
+# ============================================================================
+# Autosuggestions (grey inline suggestions from history)
+[[ -f /opt/homebrew/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]] && \
+    source /opt/homebrew/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+
+# Syntax highlighting (green/red command validation — must be sourced last)
+[[ -f /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] && \
+    source /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+
+# ============================================================================
+# END OF SHELL DEFAULTS
 # ============================================================================

config/zsh/zshrc

@@ -2,9 +2,9 @@
 # Zsh Configuration
 # ============================================================================
 
-# Load Oh-My-Zsh replacement settings
-if [[ -f ~/.dotfiles/config/zsh/zshrc.omz ]]; then
-    source ~/.dotfiles/config/zsh/zshrc.omz
+# Load shell defaults (history, completion, keybindings, aliases)
+if [[ -f ~/.dotfiles/config/zsh/defaults.zsh ]]; then
+    source ~/.dotfiles/config/zsh/defaults.zsh
 fi
 
 # ============================================================================

platforms/macos/bin/codesign-cert

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+    cat <<EOF
+Usage: codesign-cert create <name> [--days <days>]
+       codesign-cert delete <name>
+
+Manage self-signed code signing certificates in the login keychain.
+
+Creates a self-signed certificate with code signing EKU, imports it into
+the login keychain, and sets the trust policy for codesigning. The resulting
+identity can be used with codesign -s and SIGNING_IDENTITY in mise.local.toml.
+
+Source: https://github.com/tsilenzio/dotfiles/blob/main/platforms/macos/bin/codesign-cert
+
+Commands:
+    create      Create a new certificate and import into keychain
+    delete      Remove certificate and key from keychain
+
+Arguments:
+    name        Signing identity name (used with codesign -s and SIGNING_IDENTITY)
+
+Options:
+    --days      Validity period in days (default: 3650, ~10 years). Only for create.
+    --help      Show this help message
+
+Examples:
+    codesign-cert create rune-keychain-dev
+    codesign-cert create my-tool-dev --days 7300
+    codesign-cert delete rune-keychain-dev
+EOF
+    exit 0
+}
+
+# --- Parse subcommand ---
+COMMAND="${1:-}"
+
+case "$COMMAND" in
+    create|delete) shift ;;
+    --help|-h|"") usage ;;
+    -*) echo "error: unknown option: $COMMAND" >&2; echo "Run 'codesign-cert --help' for usage." >&2; exit 1 ;;
+    *) echo "error: unknown command: $COMMAND" >&2; echo "Run 'codesign-cert --help' for usage." >&2; exit 1 ;;
+esac
+
+# --- Parse remaining arguments ---
+NAME=""
+DAYS=3650
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --days)
+            DAYS="${2:?--days requires a value}"
+            shift 2
+            ;;
+        --help|-h)
+            usage
+            ;;
+        -*)
+            echo "error: unknown option: $1" >&2
+            echo "Run 'codesign-cert --help' for usage." >&2
+            exit 1
+            ;;
+        *)
+            if [[ -n "$NAME" ]]; then
+                echo "error: unexpected argument: $1" >&2
+                exit 1
+            fi
+            NAME="$1"
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$NAME" ]]; then
+    echo "error: certificate name is required" >&2
+    echo "Run 'codesign-cert --help' for usage." >&2
+    exit 1
+fi
+
+KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
+
+# --- Delete ---
+if [[ "$COMMAND" == "delete" ]]; then
+    # Find all certificate hashes matching the name — delete by hash to avoid
+    # "ambiguous, matches more than one certificate" errors from duplicate certs.
+    HASHES=$(security find-certificate -a -c "$NAME" -Z "$KEYCHAIN" \
+        | grep "SHA-1" | awk '{print $NF}')
+
+    if [[ -z "$HASHES" ]]; then
+        echo "error: no certificates found matching \"$NAME\"" >&2
+        exit 1
+    fi
+
+    COUNT=$(echo "$HASHES" | wc -l | tr -d ' ')
+    echo "Deleting $COUNT certificate(s) matching \"$NAME\"..."
+
+    echo "$HASHES" | while read -r HASH; do
+        security delete-certificate -Z "$HASH" -t "$KEYCHAIN"
+    done
+
+    echo "Done. Identity \"$NAME\" has been removed."
+    exit 0
+fi
+
+# --- Create ---
+
+# Check if identity already exists
+if security find-identity -v -p codesigning | grep -q "\"$NAME\""; then
+    echo "error: signing identity \"$NAME\" already exists in keychain" >&2
+    echo "hint: remove it first with: codesign-cert delete \"$NAME\"" >&2
+    exit 1
+fi
+
+# Temp directory with cleanup
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+KEY="$TMPDIR/key.pem"
+CERT="$TMPDIR/cert.pem"
+P12="$TMPDIR/cert.p12"
+CNF="$TMPDIR/openssl.cnf"
+
+# Generate RSA private key
+echo "Generating private key..."
+openssl genrsa -out "$KEY" 2048 2>/dev/null
+
+# Create openssl config with code signing extensions
+cat > "$CNF" <<EOF
+[req]
+distinguished_name = dn
+prompt = no
+
+[dn]
+CN = $NAME
+
+[codesign]
+keyUsage = critical, digitalSignature
+extendedKeyUsage = critical, codeSigning
+EOF
+
+# Create self-signed certificate
+echo "Creating self-signed certificate (valid for $DAYS days)..."
+openssl req -new -x509 \
+    -key "$KEY" \
+    -out "$CERT" \
+    -days "$DAYS" \
+    -config "$CNF" \
+    -extensions codesign
+
+# Package as .p12 for keychain import
+# Ephemeral password — avoids the null-vs-empty-string ambiguity in PKCS#12
+# that causes macOS import to reject empty passwords.
+# The .p12 is a temp file deleted on exit, so this password doesn't matter.
+P12_PASS="codesign-cert-tmp"
+
+echo "Packaging as .p12..."
+openssl pkcs12 -export \
+    -inkey "$KEY" \
+    -in "$CERT" \
+    -out "$P12" \
+    -name "$NAME" \
+    -passout "pass:$P12_PASS"
+
+# Import into login keychain
+echo "Importing into login keychain..."
+security import "$P12" \
+    -k "$KEYCHAIN" \
+    -T /usr/bin/codesign \
+    -f pkcs12 \
+    -P "$P12_PASS"
+
+# Set trust policy (this will prompt for authentication)
+echo ""
+echo "Setting trust policy (you will be prompted to authenticate)..."
+security add-trusted-cert -p codeSign -r trustRoot -k "$KEYCHAIN" "$CERT"
+
+# Verify
+echo ""
+if security find-identity -v -p codesigning | grep -q "\"$NAME\""; then
+    echo "Success! Signing identity \"$NAME\" is ready."
+    echo ""
+    echo "Add to your mise.local.toml:"
+    echo ""
+    echo "  [env]"
+    echo "  SIGNING_IDENTITY = \"$NAME\""
+    echo ""
+    echo "Verify anytime with:"
+    echo "  security find-identity -v -p codesigning"
+else
+    echo "error: certificate was imported but not found as a codesigning identity" >&2
+    echo "hint: check manually with: security find-identity -v -p codesigning" >&2
+    exit 1
+fi

platforms/macos/bundles/core/Brewfile

@@ -8,6 +8,8 @@ brew "fzf"                              # Fuzzy finder
 brew "zoxide"                           # Smart cd replacement
 brew "broot"                            # Tree navigation and fuzzy finder
 brew "atuin"                            # Shell history sync
+brew "zsh-syntax-highlighting"          # Command validation highlighting
+brew "zsh-autosuggestions"              # Inline history suggestions
 
 # File Operations & Search
 brew "ripgrep"                          # Fast recursive search (rg)
@@ -32,9 +34,6 @@ brew "coreutils"                        # GNU core utilities
 brew "age"                              # Modern encryption
 brew "sops"                             # Secrets management
 brew "gnupg"                            # GPG encryption
-brew "pinentry-mac"                     # macOS pinentry for GPG
-tap "jorgelbg/tap"
-brew "jorgelbg/tap/pinentry-touchid"    # Touch ID for GPG passphrase
 
 # Task Runner
 brew "just"                             # Command runner for justfile

platforms/macos/bundles/core/setup.sh

@@ -22,9 +22,6 @@ echo "Installing core packages..."
 ## Install Brewfile
 install_brewfile "$BUNDLE_DIR/Brewfile"
 
-# Kill apps that auto-launch after installation
-killall "zoom.us" 2>/dev/null || true
-
 ## Strip Gatekeeper quarantine from cask apps defined in loaded Brewfiles
 echo ""
 echo "Clearing quarantine flags..."