From 50828b7df516beab919103a22b623c92677b21a5 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:42:42 +0300
Subject: [PATCH 1/6] refactor(dots-setup): deploy capitals.tsv normally
 instead of source-path read

---
 .chezmoiignore                      | 3 ---
 dot_local/bin/executable_dots-setup | 4 +++-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.chezmoiignore b/.chezmoiignore
index 58f35bc..fce8352 100644
--- a/.chezmoiignore
+++ b/.chezmoiignore
@@ -5,9 +5,6 @@ README.md
 UNLICENSE
 install.sh
 
-# Data consumed by dots-setup directly from the source tree — not deployed
-.local/share/dots-setup
-
 # NOTE: patterns match TARGET paths (the deployed ~/… path), not source
 # filenames — so no dot_ prefix and no .tmpl/executable_/run_once_ attributes.
 
diff --git a/dot_local/bin/executable_dots-setup b/dot_local/bin/executable_dots-setup
index 456ad0b..716b810 100644
--- a/dot_local/bin/executable_dots-setup
+++ b/dot_local/bin/executable_dots-setup
@@ -297,7 +297,9 @@ darkmode_lon=$(_dm_get darkmode_longitude);               : "${darkmode_lon:=24.
 darkmode_sunset=$(_dm_get darkmode_sunset_offset_min);    : "${darkmode_sunset:=-30}"
 darkmode_sunrise=$(_dm_get darkmode_sunrise_offset_min);  : "${darkmode_sunrise:=0}"
 
-_caps="$(chezmoi source-path)/dot_local/share/dots-setup/capitals.tsv"
+_caps="$HOME/.local/share/dots-setup/capitals.tsv"
+# Fall back to the source tree if chezmoi hasn't deployed the file yet (first run).
+[[ -f "$_caps" ]] || _caps="$(chezmoi source-path)/dot_local/share/dots-setup/capitals.tsv"
 if [[ -n "${enabled_cats[macos_utils]:-}" && -f "$_caps" ]]; then
   echo ""
   _pick=$( { printf 'Custom (enter coordinates manually)\t\t\n'; cat "$_caps"; } | \

From 8adc94a498aef7243d6c9f0f18ad8a0f9ce3a027 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:42:51 +0300
Subject: [PATCH 2/6] build(brew): mark third-party taps as trusted

---
 dot_Brewfile.tmpl | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/dot_Brewfile.tmpl b/dot_Brewfile.tmpl
index 113b609..80a28ea 100644
--- a/dot_Brewfile.tmpl
+++ b/dot_Brewfile.tmpl
@@ -1,18 +1,20 @@
 # =============================================================================
 # Taps
 # =============================================================================
+# `trusted: true` — Homebrew now requires explicit trust for third-party taps.
 {{ if .macos_cosmetic -}}
-tap "lihaoyun6/tap"
-tap "theboredteam/boring-notch"
+tap "lihaoyun6/tap", trusted: true
+tap "theboredteam/boring-notch", trusted: true
 {{ end -}}
 {{ if .dev_apps -}}
-tap "hamed-elfayome/claude-usage"
+tap "hamed-elfayome/claude-usage", trusted: true
+tap "siderolabs/tap", trusted: true
 {{ end -}}
 {{ if .productivity -}}
-tap "xykong/tap"
+tap "xykong/tap", trusted: true
 {{ end -}}
 {{ if .macos_utils -}}
-tap "darrylmorley/whatcable"
+tap "darrylmorley/whatcable", trusted: true
 {{ end -}}
 # taps:end
 

From f75acf761dc1d5dc27ecd65047ec35da63e76548 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:43:47 +0300
Subject: [PATCH 3/6] style(dots-setup): combine typeset -A declarations so zsh
 -n passes

---
 dot_local/bin/executable_dots-setup | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/dot_local/bin/executable_dots-setup b/dot_local/bin/executable_dots-setup
index 716b810..b9eead8 100644
--- a/dot_local/bin/executable_dots-setup
+++ b/dot_local/bin/executable_dots-setup
@@ -21,8 +21,7 @@ fi
 
 CAT_ORDER=(alt_tools onepassword docker kubernetes macos_utils macos_cosmetic macos_media dev_apps touchbar gaming productivity peripherals)
 
-typeset -A CAT_DESC
-CAT_DESC=(
+typeset -A CAT_DESC=(
   [alt_tools]="Modern CLI replacements"
   [onepassword]="1Password (app + op CLI)"
   [docker]="Docker via Colima (colima + docker + buildx + compose)"
@@ -37,8 +36,7 @@ CAT_DESC=(
   [peripherals]="8BitDo, QMK Toolbox, BalenaEtcher, F3"
 )
 
-typeset -A CAT_PKGS
-CAT_PKGS=(
+typeset -A CAT_PKGS=(
   [alt_tools]="bat doggo duf dust eza fd gping gron jid navi ripgrep tldr xh"
   [onepassword]="1password 1password-cli"
   [docker]="docker"
@@ -54,16 +52,14 @@ CAT_PKGS=(
 )
 
 # ── Profile definitions ──────────────────────────────────────────────────────
-typeset -A PROFILE_CATS
-PROFILE_CATS=(
+typeset -A PROFILE_CATS=(
   [work]="alt_tools docker kubernetes dev_apps macos_utils macos_media"
   [personal]="alt_tools macos_utils macos_cosmetic macos_media productivity peripherals"
   [minimal]="alt_tools"
   [full]="alt_tools docker kubernetes macos_utils macos_cosmetic macos_media dev_apps touchbar gaming productivity peripherals"
 )
 
-typeset -A PROFILE_EXCL
-PROFILE_EXCL=(
+typeset -A PROFILE_EXCL=(
   [work]="macos_media/spotify macos_media/iina macos_utils/nordvpn macos_utils/utm macos_utils/transmission macos_utils/netspot"
   [personal]="macos_utils/displaylink macos_utils/utm macos_utils/duckdb"
   [minimal]=""

From 8e2b9c364e0ddc8a135c50be18a58104b235e067 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:45:22 +0300
Subject: [PATCH 4/6] refactor(mise): drop vestigial rbenv; move claude-notify
 to mise npm backend

rbenv had zero Ruby usage in the repo (Ruby is per-project via mise use).
claude-notify moves from a Brewfile npm entry to mise's npm: backend, so
mise handles the node-first install ordering instead of brew bundle hitting
npm before node exists. mise-install.sh gains a config-hash trigger.
---
 .chezmoiscripts/run_onchange_mise-install.sh    | 14 --------------
 .../run_onchange_mise-install.sh.tmpl           | 17 +++++++++++++++++
 dot_Brewfile.tmpl                               |  6 ------
 dot_config/mise/config.toml.tmpl                |  5 ++++-
 dot_local/bin/executable_dots-setup             |  4 ++--
 5 files changed, 23 insertions(+), 23 deletions(-)
 delete mode 100644 .chezmoiscripts/run_onchange_mise-install.sh
 create mode 100644 .chezmoiscripts/run_onchange_mise-install.sh.tmpl

diff --git a/.chezmoiscripts/run_onchange_mise-install.sh b/.chezmoiscripts/run_onchange_mise-install.sh
deleted file mode 100644
index 2d9d8a2..0000000
--- a/.chezmoiscripts/run_onchange_mise-install.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash
-# Runs whenever ~/.config/mise/config.toml changes (chezmoi run_onchange_).
-# Installs all runtimes declared in the mise global config.
-
-set -euo pipefail
-
-if ! command -v mise &>/dev/null; then
-    echo "mise not found — skipping. Install via: brew install mise"
-    exit 0
-fi
-
-echo "Installing mise runtimes..."
-mise install --yes
-echo "✅ mise install complete."
diff --git a/.chezmoiscripts/run_onchange_mise-install.sh.tmpl b/.chezmoiscripts/run_onchange_mise-install.sh.tmpl
new file mode 100644
index 0000000..7ac6d62
--- /dev/null
+++ b/.chezmoiscripts/run_onchange_mise-install.sh.tmpl
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Installs all runtimes and tools declared in the mise global config.
+# Re-runs whenever that config changes (hash below) or this script changes.
+# mise config hash: {{ include "dot_config/mise/config.toml.tmpl" | sha256sum }}
+
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:$PATH"
+
+if ! command -v mise &>/dev/null; then
+    echo "mise not found — skipping. Install via: brew install mise"
+    exit 0
+fi
+
+echo "Installing mise runtimes..."
+mise install --yes
+echo "✅ mise install complete."
diff --git a/dot_Brewfile.tmpl b/dot_Brewfile.tmpl
index 80a28ea..d0a5ade 100644
--- a/dot_Brewfile.tmpl
+++ b/dot_Brewfile.tmpl
@@ -217,9 +217,6 @@ cask "utm"
 {{ if not (has "duckdb" .machine_excludes) -}}
 brew "duckdb"
 {{ end -}}
-{{ if not (has "rbenv" .machine_excludes) -}}
-brew "rbenv"
-{{ end -}}
 {{ if not (has "hyperfine" .machine_excludes) -}}
 brew "hyperfine"
 {{ end -}}
@@ -301,9 +298,6 @@ brew "webp"
 {{ if not (has "claude" .machine_excludes) -}}
 cask "claude"
 {{ end -}}
-{{ if not (has "claude-notify" .machine_excludes) -}}
-npm "@daik0z/claude-notify"
-{{ end -}}
 {{ if not (has "claude-usage-tracker" .machine_excludes) -}}
 cask "hamed-elfayome/claude-usage/claude-usage-tracker"
 {{ end -}}
diff --git a/dot_config/mise/config.toml.tmpl b/dot_config/mise/config.toml.tmpl
index cd63f4e..414e757 100644
--- a/dot_config/mise/config.toml.tmpl
+++ b/dot_config/mise/config.toml.tmpl
@@ -6,7 +6,10 @@ gpg_verify = false
 node = "lts"     # JavaScript runtime
 uv   = "latest"  # Python package manager + Python version installer
 ruff = "latest"  # Python linter/formatter
-
+{{ if .dev_apps }}
+# === dev_apps (global npm tools — mise handles node-first ordering) ===
+"npm:@daik0z/claude-notify" = "latest"  # Claude Code desktop notifications
+{{ end }}
 # === Add runtimes with: mise-add <tool> [version] ===
 # mise:end
 
diff --git a/dot_local/bin/executable_dots-setup b/dot_local/bin/executable_dots-setup
index b9eead8..3ddfeeb 100644
--- a/dot_local/bin/executable_dots-setup
+++ b/dot_local/bin/executable_dots-setup
@@ -41,10 +41,10 @@ typeset -A CAT_PKGS=(
   [onepassword]="1password 1password-cli"
   [docker]="docker"
   [kubernetes]="helm kubectx k9s kubeconform mintoolkit stern gcloud-cli awscli kustomize"
-  [macos_utils]="alt-tab displaylink hammerspoon hot logi-options-plus raycast sniffnet keyboardcleantool netspot nordvpn transmission utm duckdb rbenv hyperfine darrylmorley/whatcable/whatcable"
+  [macos_utils]="alt-tab displaylink hammerspoon hot logi-options-plus raycast sniffnet keyboardcleantool netspot nordvpn transmission utm duckdb hyperfine darrylmorley/whatcable/whatcable"
   [macos_cosmetic]="airbattery boring-notch cork"
   [macos_media]="brave-browser slack spotify telegram iina"
-  [dev_apps]="ffmpeg gh git-filter-repo glab libpq php composer claude claude-notify claude-usage-tracker opencode-desktop jetbrains-toolbox dbeaver-community gimp rtk vscodium webp cyberduck cloudflared hcloud uv opentofu caddy siderolabs/tap/talosctl"
+  [dev_apps]="ffmpeg gh git-filter-repo glab libpq php composer claude claude-usage-tracker opencode-desktop jetbrains-toolbox dbeaver-community gimp rtk vscodium webp cyberduck cloudflared hcloud uv opentofu caddy siderolabs/tap/talosctl"
   [touchbar]="bettertouchtool"
   [gaming]="discord steam"
   [productivity]="calibre flux-markdown grammarly-desktop notion obsidian"

From 7cfb93918d4c5c88d6fb42412d9eab0e9cc6aea8 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:55:49 +0300
Subject: [PATCH 5/6] refactor(chezmoi): fetch external assets via
 .chezmoiexternal

Replaces run_onchange_install-{bat,btop,fresh,k9s}-themes and the navi-cheats
clone logic with a declarative .chezmoiexternal.toml.tmpl (git-repo / file /
archive entries, weekly refreshPeriod). navi-cheats.sh keeps only personal.cheat
generation. Two small post-steps remain: run_onchange_bat-cache rebuilds bat's
theme cache; dot_config/k9s/create_config.yaml.tmpl seeds the k9s skin (then
sync-theme owns it).
---
 .chezmoiexternal.toml.tmpl                    | 66 +++++++++++++++++++
 .../run_onchange_bat-cache.sh.tmpl            | 15 +++++
 .../run_onchange_install-bat-themes.sh        | 34 ----------
 .../run_onchange_install-btop-themes.sh       | 27 --------
 .../run_onchange_install-fresh-themes.sh.tmpl | 21 ------
 .../run_onchange_install-k9s-theme.sh.tmpl    | 51 --------------
 .../run_onchange_navi-cheats.sh.tmpl          | 42 +-----------
 README.md                                     |  8 ++-
 dot_config/k9s/create_config.yaml.tmpl        |  6 ++
 9 files changed, 95 insertions(+), 175 deletions(-)
 create mode 100644 .chezmoiexternal.toml.tmpl
 create mode 100644 .chezmoiscripts/run_onchange_bat-cache.sh.tmpl
 delete mode 100755 .chezmoiscripts/run_onchange_install-bat-themes.sh
 delete mode 100755 .chezmoiscripts/run_onchange_install-btop-themes.sh
 delete mode 100644 .chezmoiscripts/run_onchange_install-fresh-themes.sh.tmpl
 delete mode 100644 .chezmoiscripts/run_onchange_install-k9s-theme.sh.tmpl
 create mode 100644 dot_config/k9s/create_config.yaml.tmpl

diff --git a/.chezmoiexternal.toml.tmpl b/.chezmoiexternal.toml.tmpl
new file mode 100644
index 0000000..6cacfa4
--- /dev/null
+++ b/.chezmoiexternal.toml.tmpl
@@ -0,0 +1,66 @@
+# Externally-sourced assets, fetched and refreshed by chezmoi directly.
+# Replaces the run_onchange_install-*-themes scripts and the navi-cheats clone
+# logic — declarative, cached, with a built-in refresh interval.
+#
+# Post-fetch steps that can't be expressed here stay as tiny run_onchange
+# scripts keyed on this file's hash: bat cache rebuild, k9s skin bootstrap.
+
+{{- $refresh := "168h" }}
+
+# ── navi community cheatsheets ──────────────────────────────────────────────
+{{ if and .alt_tools (not (has "navi" .machine_excludes)) -}}
+{{ range $repo := list "denisidoro/cheats" "denisidoro/navi-tldr-pages" "tg-z/navi-cheats" -}}
+[".local/share/navi/cheats/{{ $repo | replace "/" "__" }}"]
+    type = "git-repo"
+    url = "https://github.com/{{ $repo }}.git"
+    refreshPeriod = "{{ $refresh }}"
+    clone = { args = ["--depth=1"] }
+    pull = { args = ["--ff-only"] }
+{{ end -}}
+{{ if .kubernetes -}}
+[".local/share/navi/cheats/tsologub__navi-cheats"]
+    type = "git-repo"
+    url = "https://github.com/tsologub/navi-cheats.git"
+    refreshPeriod = "{{ $refresh }}"
+    clone = { args = ["--depth=1"] }
+    pull = { args = ["--ff-only"] }
+{{ end -}}
+{{ end -}}
+
+# ── bat: Catppuccin themes (rebuild cache in run_onchange_bat-cache) ────────
+{{ if and .alt_tools (not (has "bat" .machine_excludes)) -}}
+{{ range $flavor := list "Macchiato" "Latte" -}}
+[".config/bat/themes/Catppuccin {{ $flavor }}.tmTheme"]
+    type = "file"
+    url = "https://raw.githubusercontent.com/catppuccin/bat/main/themes/Catppuccin%20{{ $flavor }}.tmTheme"
+    refreshPeriod = "{{ $refresh }}"
+{{ end -}}
+{{ end -}}
+
+# ── btop: Catppuccin themes (always installed) ─────────────────────────────
+{{ range $flavor := list "latte" "frappe" "macchiato" "mocha" -}}
+[".config/btop/themes/catppuccin_{{ $flavor }}.theme"]
+    type = "file"
+    url = "https://raw.githubusercontent.com/catppuccin/btop/main/themes/catppuccin_{{ $flavor }}.theme"
+    refreshPeriod = "{{ $refresh }}"
+{{ end -}}
+
+# ── fresh editor: Catppuccin themes ───────────────────────────────────────
+{{ if eq .editor "fresh" -}}
+{{ range $flavor := list "latte" "frappe" "macchiato" "mocha" -}}
+[".config/fresh/themes/catppuccin-{{ $flavor }}.json"]
+    type = "file"
+    url = "https://raw.githubusercontent.com/milon/catppuccin-fresh/master/catppuccin-{{ $flavor }}.json"
+    refreshPeriod = "{{ $refresh }}"
+{{ end -}}
+{{ end -}}
+
+# ── k9s: Catppuccin skins (skin selection in sync-theme / k9s-skin bootstrap)
+{{ if .kubernetes -}}
+[".config/k9s/skins"]
+    type = "archive"
+    url = "https://github.com/catppuccin/k9s/archive/main.tar.gz"
+    refreshPeriod = "{{ $refresh }}"
+    stripComponents = 2
+    include = ["k9s-main/dist/**"]
+{{ end -}}
diff --git a/.chezmoiscripts/run_onchange_bat-cache.sh.tmpl b/.chezmoiscripts/run_onchange_bat-cache.sh.tmpl
new file mode 100644
index 0000000..1159cf7
--- /dev/null
+++ b/.chezmoiscripts/run_onchange_bat-cache.sh.tmpl
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Rebuilds bat's theme cache after .chezmoiexternal fetches the Catppuccin
+# .tmTheme files — bat won't see new theme files until the cache is rebuilt.
+# .chezmoiexternal hash: {{ include ".chezmoiexternal.toml.tmpl" | sha256sum }}
+
+set -euo pipefail
+
+export PATH="/opt/homebrew/bin:$PATH"
+
+command -v bat &>/dev/null || exit 0
+
+# Run from / — bat misreads 'cache' as a filename when a dir named 'cache'
+# exists in the CWD (sharkdp/bat#1726).
+(cd / && bat cache --build)
+echo "✅ bat theme cache rebuilt."
diff --git a/.chezmoiscripts/run_onchange_install-bat-themes.sh b/.chezmoiscripts/run_onchange_install-bat-themes.sh
deleted file mode 100755
index cf5bc64..0000000
--- a/.chezmoiscripts/run_onchange_install-bat-themes.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/bin/bash
-# Install Catppuccin Latte and Macchiato themes for bat.
-# Named install-* to ensure it runs after brew-bundle installs bat.
-# run_onchange: re-runs if this file changes.
-
-set -euo pipefail
-
-# Chezmoi scripts run without the user's shell profile. Add Homebrew to PATH.
-export PATH="/opt/homebrew/bin:$PATH"
-
-if ! command -v bat &>/dev/null; then
-    echo "bat not found — skipping theme install"
-    exit 0
-fi
-
-themes_dir="$(bat --config-dir)/themes"
-mkdir -p "$themes_dir"
-
-base_url="https://github.com/catppuccin/bat/raw/main/themes"
-curl -fsSL "${base_url}/Catppuccin%20Macchiato.tmTheme" -o "$themes_dir/Catppuccin Macchiato.tmTheme" ||
-    {
-        echo "Failed to download Catppuccin Macchiato theme" >&2
-        exit 1
-    }
-curl -fsSL "${base_url}/Catppuccin%20Latte.tmTheme" -o "$themes_dir/Catppuccin Latte.tmTheme" ||
-    {
-        echo "Failed to download Catppuccin Latte theme" >&2
-        exit 1
-    }
-
-# Run from / to avoid bat misinterpreting 'cache' as a filename when a
-# directory named 'cache' exists in the CWD. See sharkdp/bat#1726.
-(cd / && bat cache --build)
-echo "✅ bat Catppuccin themes installed and cache rebuilt."
diff --git a/.chezmoiscripts/run_onchange_install-btop-themes.sh b/.chezmoiscripts/run_onchange_install-btop-themes.sh
deleted file mode 100755
index d4ef4c6..0000000
--- a/.chezmoiscripts/run_onchange_install-btop-themes.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash
-# Install all four Catppuccin flavour themes for btop.
-# Named install-* to ensure it runs after brew-bundle installs btop.
-# run_onchange: re-runs if this file changes.
-
-set -euo pipefail
-
-# Chezmoi scripts run without the user's shell profile. Add Homebrew to PATH.
-export PATH="/opt/homebrew/bin:$PATH"
-
-if ! command -v btop &>/dev/null; then
-    echo "btop not found — skipping theme install"
-    exit 0
-fi
-
-themes_dir="${XDG_CONFIG_HOME:-$HOME/.config}/btop/themes"
-mkdir -p "$themes_dir"
-
-base_url="https://github.com/catppuccin/btop/raw/main/themes"
-for flavor in latte frappe macchiato mocha; do
-    curl -fsSL "${base_url}/catppuccin_${flavor}.theme" -o "${themes_dir}/catppuccin_${flavor}.theme" ||
-        {
-            echo "Failed to download catppuccin_${flavor} btop theme" >&2
-            exit 1
-        }
-done
-echo "btop Catppuccin themes installed to ${themes_dir}"
diff --git a/.chezmoiscripts/run_onchange_install-fresh-themes.sh.tmpl b/.chezmoiscripts/run_onchange_install-fresh-themes.sh.tmpl
deleted file mode 100644
index dd7b1b9..0000000
--- a/.chezmoiscripts/run_onchange_install-fresh-themes.sh.tmpl
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-# Install all four Catppuccin flavour themes for fresh editor.
-# Named install-* to ensure it runs after brew-bundle installs fresh-editor.
-{{ if ne .editor "fresh" -}}
-exit 0
-{{ end -}}
-
-set -euo pipefail
-
-themes_dir="${XDG_CONFIG_HOME:-$HOME/.config}/fresh/themes"
-mkdir -p "$themes_dir"
-
-base_url="https://raw.githubusercontent.com/milon/catppuccin-fresh/master"
-for flavor in latte frappe macchiato mocha; do
-    curl -fsSL "${base_url}/catppuccin-${flavor}.json" -o "${themes_dir}/catppuccin-${flavor}.json" ||
-        {
-            echo "Failed to download catppuccin-${flavor} fresh theme" >&2
-            exit 1
-        }
-done
-echo "fresh Catppuccin themes installed to ${themes_dir}"
diff --git a/.chezmoiscripts/run_onchange_install-k9s-theme.sh.tmpl b/.chezmoiscripts/run_onchange_install-k9s-theme.sh.tmpl
deleted file mode 100644
index 8efb59b..0000000
--- a/.chezmoiscripts/run_onchange_install-k9s-theme.sh.tmpl
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-# Install Catppuccin Macchiato skin for k9s (kubernetes installs only).
-# Named install-* to ensure it runs after brew-bundle.
-{{ if not .kubernetes -}}
-exit 0
-{{ end -}}
-
-set -euo pipefail
-
-export PATH="/opt/homebrew/bin:$PATH"
-
-if ! command -v k9s &>/dev/null; then
-    echo "k9s not found — skipping theme install"
-    exit 0
-fi
-
-K9S_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/k9s"
-SKINS_DIR="$K9S_CONFIG/skins"
-mkdir -p "$SKINS_DIR"
-
-echo "Downloading Catppuccin skins for k9s..."
-curl -fsSL https://github.com/catppuccin/k9s/archive/main.tar.gz |
-    tar xz -C "$SKINS_DIR" --strip-components=2 k9s-main/dist
-
-echo "✅ Catppuccin k9s skins installed."
-
-# Set skin in config.yaml to match current macOS appearance
-if [[ "$(defaults read -g AppleInterfaceStyle 2>/dev/null)" = "Dark" ]]; then
-    skin="catppuccin-macchiato"
-else
-    skin="catppuccin-latte"
-fi
-
-CONFIG_FILE="$K9S_CONFIG/config.yaml"
-mkdir -p "$(dirname "$CONFIG_FILE")"
-[[ -f "$CONFIG_FILE" ]] || echo '{}' >"$CONFIG_FILE"
-
-if ! command -v yq &>/dev/null; then
-    echo "yq not found — install it with: brew install yq"
-    exit 1
-fi
-
-# Remove duplicate k9s: top-level keys left by previous buggy append
-if [[ -f "$CONFIG_FILE" ]] && [[ $(grep -c "^k9s:" "$CONFIG_FILE") -gt 1 ]]; then
-    awk '/^k9s:/{count++; if (count > 1) exit} {print}' "$CONFIG_FILE" >"$CONFIG_FILE.tmp"
-    mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
-    echo "Fixed duplicate k9s: block in config.yaml"
-fi
-
-yq -i ".k9s.ui.skin = \"${skin}\"" "$CONFIG_FILE"
-echo "✅ Set k9s skin to ${skin} in config.yaml"
diff --git a/.chezmoiscripts/run_onchange_navi-cheats.sh.tmpl b/.chezmoiscripts/run_onchange_navi-cheats.sh.tmpl
index 7691378..9609793 100644
--- a/.chezmoiscripts/run_onchange_navi-cheats.sh.tmpl
+++ b/.chezmoiscripts/run_onchange_navi-cheats.sh.tmpl
@@ -1,6 +1,6 @@
 #!/bin/bash
-# Regenerates ~/.local/share/navi/cheats/personal.cheat from aliases and functions,
-# and ensures community cheatsheet repos are cloned.
+# Regenerates ~/.local/share/navi/cheats/personal.cheat from aliases and functions.
+# Community cheat repos are fetched declaratively via .chezmoiexternal.toml.tmpl.
 # dot_zsh/aliases.zsh hash:          {{ include "dot_zsh/aliases.zsh.tmpl" | sha256sum }}
 # dot_zsh/functions.zsh.tmpl hash:   {{ include "dot_zsh/functions.zsh.tmpl" | sha256sum }}
 
@@ -21,7 +21,7 @@ cmd python3 || {
 CHEAT_DIR="$HOME/.local/share/navi/cheats"
 mkdir -p "$CHEAT_DIR"
 
-# --- 1. Generate personal.cheat from aliases.zsh and functions.zsh ---
+# Generate personal.cheat from aliases.zsh and functions.zsh
 python3 - "$HOME/.zsh/aliases.zsh" "$HOME/.zsh/functions.zsh" <<'PYEOF' >"$CHEAT_DIR/personal.cheat"
 import re, sys
 
@@ -78,39 +78,3 @@ print("".join(out))
 PYEOF
 
 echo "✅ Generated $CHEAT_DIR/personal.cheat"
-
-# --- 2. Community repos — clone if missing, pull if older than 7 days ---
-# Uses git clone directly to avoid navi repo add's interactive file picker.
-REPO_CACHE="$CHEAT_DIR/.last_updated"
-_needs_update() {
-    [[ ! -f "$REPO_CACHE" ]] && return 0
-    local age=$(($(date +%s) - $(date -r "$REPO_CACHE" +%s)))
-    ((age > 604800)) # 7 days in seconds
-}
-
-add_repo() {
-    local repo="$1"
-    local dest="$CHEAT_DIR/${repo//\//__}"
-    if [[ ! -d "$dest/.git" ]]; then
-        # Missing, or a stale non-git directory from an interrupted clone.
-        [[ "$dest" == "$CHEAT_DIR/"?* ]] && rm -rf "$dest"
-        echo "Cloning navi repo: $repo ..."
-        git clone --depth=1 --quiet "https://github.com/${repo}.git" "$dest" ||
-            echo "⚠️  Could not clone $repo (check network)"
-    elif _needs_update; then
-        echo "Updating navi repo: $repo ..."
-        git -C "$dest" fetch --depth=1 --quiet origin HEAD &&
-            git -C "$dest" reset --quiet --hard FETCH_HEAD ||
-            echo "⚠️  Could not update $repo"
-    fi
-}
-
-add_repo "denisidoro/cheats"
-add_repo "denisidoro/navi-tldr-pages"
-add_repo "tg-z/navi-cheats"
-{{ if .kubernetes -}}
-add_repo "tsologub/navi-cheats"
-{{ end -}}
-
-_needs_update && touch "$REPO_CACHE"
-echo "✅ Navi setup complete."
diff --git a/README.md b/README.md
index f01c2af..7667417 100644
--- a/README.md
+++ b/README.md
@@ -92,10 +92,10 @@ Package categories you can toggle:
 On first apply, chezmoi automatically:
 
 1. Runs `brew bundle --global` to install all selected Homebrew packages
-2. Runs `mise install` to set up language runtimes
+2. Runs `mise install` to set up language runtimes and global npm tools
 3. Generates static init files and completions (`~/.zsh/*_init.zsh`, `~/.zsh/completions/`)
 4. Seeds a Colima config (`~/.colima/default/colima.yaml`) optimised for Apple Silicon
-5. Generates navi cheatsheets and clones community repos
+5. Generates `personal.cheat` for navi; fetches external assets (community cheats, editor/tool themes) via `.chezmoiexternal`
 
 ## Forking
 
@@ -240,7 +240,7 @@ To remove a package permanently: `pkg-rm <package>` — removes it from the Brew
 
 [navi](https://github.com/denisidoro/navi) is a command-line cheatsheet tool. Press **Ctrl+G** mid-command to search cheatsheets and insert a command into the prompt. Or run `navi` to browse interactively.
 
-On first `chezmoi apply`, `run_onchange_navi-cheats.sh.tmpl` auto-generates `~/.local/share/navi/cheats/personal.cheat` from your aliases and functions, and clones community repos. The personal cheat file is regenerated automatically whenever `aliases.zsh` or `functions.zsh` changes.
+On first `chezmoi apply`, `run_onchange_navi-cheats.sh.tmpl` generates `~/.local/share/navi/cheats/personal.cheat` from your aliases and functions (regenerated whenever `aliases.zsh` or `functions.zsh` changes). The community cheat repos are fetched and refreshed weekly by chezmoi via `.chezmoiexternal.toml.tmpl`.
 
 | Source | What it covers |
 | ------ | -------------- |
@@ -268,6 +268,8 @@ On first `chezmoi apply`, `run_onchange_navi-cheats.sh.tmpl` auto-generates `~/.
 | btop | `~/.config/btop/themes/` (all four flavours: latte, frappé, macchiato, mocha) |
 | k9s | `~/.config/k9s/skins/` (all flavours; follows macOS appearance via `sync-theme`) *(kubernetes only)* |
 
+Theme files (bat/btop/fresh `.tmTheme`/`.theme`/`.json`, k9s skins) are fetched and refreshed by chezmoi via `.chezmoiexternal.toml.tmpl`.
+
 `sync-theme` (`~/.local/bin/sync-theme`) switches delta, starship, atuin, eza, lazygit, and k9s between Latte and Macchiato. It is called by Hammerspoon (`~/.hammerspoon/init.lua`) which watches `AppleInterfaceThemeChangedNotification` — so all tools switch instantly when you toggle macOS appearance. ghostty is not part of sync-theme; it follows the appearance natively.
 
 Override manually with `theme dark` or `theme light`.
diff --git a/dot_config/k9s/create_config.yaml.tmpl b/dot_config/k9s/create_config.yaml.tmpl
new file mode 100644
index 0000000..ede78fa
--- /dev/null
+++ b/dot_config/k9s/create_config.yaml.tmpl
@@ -0,0 +1,6 @@
+# Seeded once by chezmoi (create_), then owned at runtime by ~/.local/bin/sync-theme,
+# which flips `skin:` to match the macOS appearance. Skins themselves come from the
+# catppuccin/k9s archive in .chezmoiexternal.toml.tmpl.
+k9s:
+  ui:
+    skin: catppuccin-macchiato

From bd819fd471211351def1ed5ab13ca075b6c9b721 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Mon, 31 Aug 2026 08:57:41 +0300
Subject: [PATCH 6/6] feat(zsh): brew-up refreshes tool-init caches after
 upgrade

A 'brew upgrade' can change a tool's 'init' output, but the static
~/.zsh/*_init.zsh files only regenerate on Brewfile/plugin hash changes.
brew-up becomes a function that also runs _regen_inits (shared with mnt).
---
 README.md                  |  2 +-
 dot_zsh/aliases.zsh.tmpl   |  6 +-----
 dot_zsh/functions.zsh.tmpl | 19 ++++++++++++++++++-
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 7667417..236b5d1 100644
--- a/README.md
+++ b/README.md
@@ -140,7 +140,7 @@ Tool inits (atuin, zoxide, direnv, navi, etc.) are pre-generated once rather tha
 | Command | Description |
 | ------- | ----------- |
 | `mnt` | Full maintenance: sync dotfiles, brew upgrade, sheldon update, regenerate inits & completions, recompile, backup, reload |
-| `brew-up` | Homebrew update + upgrade + cleanup + tldr update |
+| `brew-up` | Homebrew update + upgrade + cleanup + tldr update, then refresh the static tool-init caches |
 | `pkg-cats` | List all package categories with their descriptions and package lists |
 | `brewsync` | Interactively promote untracked brew packages into the chezmoi-managed Brewfile |
 | `comp-add <tool>` | Auto-detect and add zsh completions for a new tool; persists to chezmoi source |
diff --git a/dot_zsh/aliases.zsh.tmpl b/dot_zsh/aliases.zsh.tmpl
index 865e114..e807db1 100644
--- a/dot_zsh/aliases.zsh.tmpl
+++ b/dot_zsh/aliases.zsh.tmpl
@@ -60,11 +60,7 @@ alias sheldonconfig="chezmoi edit ~/.config/sheldon/plugins.toml"
 alias reload="exec zsh"
 
 # --- Maintenance & Updates ---
-{{ if and .alt_tools (not (has "tldr" .machine_excludes)) -}}
-alias brew-up="brew update && brew upgrade --greedy && brew cleanup --prune=all && tldr --update"
-{{- else -}}
-alias brew-up="brew update && brew upgrade --greedy && brew cleanup --prune=all"
-{{- end }}
+# brew-up is a function (functions.zsh) — it also refreshes the tool-init caches.
 alias sheldon-up="sheldon lock --update && sheldon source > ~/.zsh/sheldon.zsh && echo 'Sheldon updated.'"
 {{ if and .alt_tools (not (has "navi" .machine_excludes)) -}}
 alias navi-up="for d in ~/.local/share/navi/cheats/*/; do echo \"Updating \$(basename \$d)...\"; git -C \"\$d\" fetch --depth=1 --quiet origin HEAD && git -C \"\$d\" reset --quiet --hard FETCH_HEAD || echo \"⚠️  Failed: \$d\"; done && touch ~/.local/share/navi/cheats/.last_updated && echo 'Navi repos updated.'"
diff --git a/dot_zsh/functions.zsh.tmpl b/dot_zsh/functions.zsh.tmpl
index a98417b..b2bbf6a 100644
--- a/dot_zsh/functions.zsh.tmpl
+++ b/dot_zsh/functions.zsh.tmpl
@@ -20,6 +20,23 @@ _chezmoi_sync() {
     chezmoi apply
 }
 
+# === Maintenance ===
+# Regenerate the static tool-init files (~/.zsh/*_init.zsh) + completions.
+# A `brew upgrade` can change a tool's `init` output, leaving the cache stale;
+# the run_onchange hash only catches Brewfile/plugin edits, not version bumps.
+_regen_inits() {
+    bash <(chezmoi execute-template < "$(chezmoi source-path)/.chezmoiscripts/run_onchange_generate-tool-inits.sh.tmpl")
+}
+
+# Homebrew update + upgrade + cleanup, then refresh the tool-init caches.
+brew-up() {
+    brew update && brew upgrade --greedy && brew cleanup --prune=all
+    {{- if and .alt_tools (not (has "tldr" .machine_excludes)) }}
+    tldr --update
+    {{- end }}
+    _regen_inits
+}
+
 # === Elite Maintenance Workflow ===
 mnt() {
     echo "🚀 Starting Elite Maintenance..."
@@ -43,7 +60,7 @@ mnt() {
 
     # 3. Static Initialization Caching
     echo "🏎️ Caching Tool Initializations..."
-    bash <(chezmoi execute-template < "$(chezmoi source-path)/.chezmoiscripts/run_onchange_generate-tool-inits.sh.tmpl")
+    _regen_inits
 
     # 4. Binary Compilation (Dynamic & Automatic)
     echo "🏗️  Rebuilding binaries from a clean slate..."