codex's config.toml held nine live API keys inline under
[mcp_servers.*.env] -- deepseek, gemini, kimi, mimo, qwen, glm, cursor,
an OpenAI key and a Home Assistant token -- so it could not be tracked
as it stood. TOML env tables take literal values only, with no ${VAR}
indirection or env_file, so the keys cannot simply be named there.
Move them to ~/.codex/secrets.env (0600, ignored) and route the four
affected servers through mcp-with-secrets.sh, which sources that file
and execs the real command. Doing it in the wrapper rather than relying
on exported shell vars means it does not depend on how codex handles
environment inheritance, and works on ssh-only boxes with no keychain or
1Password agent, which is why this was preferred over a chezmoi
template.
Adds configs for claude, codex, pi, grok, kimi, kimi-code and reasonix,
and extends .chezmoiignore so credentials, session logs, local state and
.bak files stay out even if a directory is ever added whole.
Held back for still containing live keys: opencode.json (bailian), and
reasonix config.json and .env.
theme-mode is a per-machine preference, and the three *-theme.auto.conf
files are generated from it plus themes/, so tracking any of them made
every machine flag the others' choice. Drop all four from the source
state and ignore them.
That leaves a freshly applied machine with no theme files for kitty to
read, so add run_after_kitty-theme-mode.sh to regenerate them from the
canonical themes. It defaults to `auto`, so a new machine follows its OS
until told otherwise, and it exits quietly where this kitty config isn't
applied rather than failing the run.
Since that script now runs on every apply, including on Linux, make the
permission lookup in both shell scripts fall back from BSD `stat -f` to
GNU `stat -c` and then to 600.
Local drift that was never added: a cursorapi provider pointing at
http://127.0.0.1:8788/v1, plus the formatting pi itself writes. No key
material -- the apiKey fields hold env var names or the local
placeholder.
Captures the current mode. The two generated theme files now hold the
dark theme because the mode is pinned; themes/light.conf still has the
light theme, so `theme light` and `theme auto` restore it.
kitty gives *-theme.auto.conf priority over everything -- includes and
even --override -- and has no option to stop following the OS. So the
only way to start in a chosen mode is to control what those files
contain. Make them generated:
themes/{light,dark,no-preference}.conf canonical, the real themes
theme-mode auto | light | dark
apply-theme-mode.sh writes the three .auto.conf
Under `auto` each appearance keeps its own theme, so kitty follows the
OS as before. Pinned, all three get the pinned theme, so kitty starts in
it whatever the OS says and a config reload no longer resets it.
`theme` now records the mode and reloads instead of calling set-colors,
which is why the setting survives restarts. A bare `theme` records
`auto` rather than pinning when the toggle lands on the macOS
appearance, so nothing is pinned unless it actually differs.
The kitten shim hashes the automatic theme files before running `kitten
themes` and copies whichever changed into themes/, so picking a new
light theme while pinned to dark is kept and applied on the next switch.
Covered by tests/test_theme_mode.sh.
conf.d/kitty_theme.fish is gone: theme-mode is now the source of truth,
so the universal-variable tracker it maintained is redundant.
__kitty_tab_set sent a luminance-picked black/white active_fg, so a
tinted tab's title looked different from a normal one. Send NONE
instead: tab_fg() then falls back to the shared active foreground (the
theme background) while active_bg keeps the per-host tint.
Covered by a new case in tests/test_tab_bar_colors.py matching what
__kitty_tab_set actually sends — host background, no fg override.
a68b138 made draw_tab() derive all four color roles from tab_colors(),
so it stopped reading the per-tab colors that `kitten @ set-tab-color`
sets. The ssh wrapper (__kitty_tab_set) still set them, but the renderer
discarded them and every remote tab drew in the #2e84e6 accent.
Resolve the drawn colors through DrawData.tab_fg/tab_bg on the already
role-substituted title_draw_data: those return the per-tab override when
one is set and the accent roles otherwise. Theme-provided tab colors
still cannot leak in, so the theme-independence fix is preserved.
Extend tests/test_tab_bar_colors.py with the override case; it fails
against the old renderer (got the accent, wanted the host color).
The bare command substitution ran on every shell start regardless of
platform, so Linux/WSL printed "fish: Unknown command: security" at
login — the 2>/dev/null only redirects the command's own stderr, not
fish's command-not-found diagnostic.
Guard with `type -q security`, matching conf.d/codex-github-mcp.fish,
and skip the export when the lookup returns nothing so a missing
keychain item no longer exports an empty GITHUB_PERSONAL_ACCESS_TOKEN.
`theme` switches kitty between the existing dark-theme.auto.conf and
light-theme.auto.conf via `kitty @ set-colors --all --configured`, so it
stays in sync with whatever `kitten themes --light/--dark` selects.
Subcommands: light, dark, auto (hand control back to the OS appearance
via load-config), status.
Tide is resynced by calling __tide_apply_terminal_appearance directly,
so the prompt recolors even if kitty sends no palette-change
notification for a dynamic color change. conf.d/kitty_theme.fish tracks
$fish_terminal_color_theme into $kitty_theme_mode so the toggle still
reads the real state after kitty follows an OS appearance change.
light-theme.auto.conf had no tab colors, which left the dark tab bar on
a light background after switching; add a matching tab style block.
Add a nova 'session' segment (#S) on the right side, styled with the
same colors as the window tabs (#6272a4 bg / #f8f8f2 fg).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tint the kitty tab background by target host so local vs remote (and
which remote) is visible at a glance.
- __kitty_host_color: explicit color table for known hosts (routers,
resolvers, ryzen/mini, personal cloud, geo VPS) + stable hashed
palette fallback; auto-picks readable fg by luminance
- __kitty_ssh_host: parse target host from ssh/mosh-style argv
- __kitty_tab_set/__kitty_tab_reset: active tab = full host-color bg,
inactive tab = dark theme bg with host-color text; revert on exit
- ssh wrapper + s (kitten ssh) and m (mosh) wired to tint/reset
Also includes unrelated pending dotfile changes (GH MCP PAT from
keychain in fish/zsh, kitty/wezterm font_size 15->14, kitty
colorspace displayp3) committed together at user request.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
When running via env.lat, push the cursor to the bottom of the screen
before print_block sets up the TUI, so we don't overwrite env.lat output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract tide configuration into a reusable fish function (tide-reset)
and call it from the chezmoi onchange script. Also revert treesitter
config to the stable API (nvim-treesitter.configs).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
