Initial import: chezmoi source for CachyOS + Umbriel + Noctalia

Imported from prdlk/dotfiles master (efdd827). Drops the niri, Hyprland/Omarchy,
macOS, and Blume docs-site layers; docs/ is plain Markdown.

.chezmoiscripts/run_once_after_30-user-services.sh.tmpl

@@ -0,0 +1,23 @@
+{{ if eq .chezmoi.os "linux" -}}
+#!/bin/sh
+# Enable session-critical user services. Personal automation units
+# (brain-lens, omp-loop, rclone, hermes, voxtype) ship as files only —
+# enable manually per machine.
+set -eu
+
+# Pre-shutdown save of kitty's daily session (dot_config/systemd/user, only on
+# linux desktop/laptop roles; see .chezmoiignore.tmpl).
+if [ -f "$HOME/.config/systemd/user/kitty-day-save.service" ] && command -v systemctl >/dev/null 2>&1; then
+    systemctl --user daemon-reload || true
+    systemctl --user enable --now kitty-day-save.service || true
+fi
+
+# Symlink ~/Code repos into ~/Projects every 5 min (same role gate).
+if [ -f "$HOME/.config/systemd/user/projects-sync.timer" ] && command -v systemctl >/dev/null 2>&1; then
+    systemctl --user daemon-reload || true
+    systemctl --user enable --now projects-sync.timer || true
+fi
+{{ else -}}
+#!/bin/sh
+exit 0
+{{ end -}}

.chezmoiscripts/run_onchange_after_15-tools.sh.tmpl

@@ -0,0 +1,68 @@
+#!/bin/sh
+# Tools that come from their own installers rather than pacman:
+# rustup (cargo) and the packages.shared.cargo crates, the
+# packages.shared.mise tools (omp, opencode, …), and strata on Linux desktop
+# roles. Runs before 20-gh-extensions, whose fish session sources
+# ~/.cargo/env.fish (conf.d/rustup.fish) and activates mise.
+# cargo hash: {{ .packages.shared.cargo | toJson | sha256sum }}
+# mise hash: {{ .packages.shared.mise | toJson | sha256sum }}
+set -eu
+
+# Where rustup puts cargo; chezmoi's environment can predate the shell config
+# that adds it.
+PATH="$HOME/.cargo/bin:$PATH"
+export PATH
+
+# rustup: -y answers its prompt (no tty under chezmoi); --no-modify-path keeps
+# it out of the shell rc files, which are symlinks into this repo and already
+# source ~/.cargo/env (bash, zsh, fish conf.d/rustup.fish).
+if ! command -v cargo >/dev/null 2>&1; then
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
+fi
+
+installed=$(cargo install --list | awk '/^[^ ]/{print $1}')
+{{ range .packages.shared.cargo -}}
+echo "$installed" | grep -qx {{ . | quote }} || cargo install --locked {{ . | quote }}
+{{ end }}
+
+# Global mise tools. Only tools absent from the global config are added, so a
+# local pin (node = "22") is never rewritten to latest; `mise install` then
+# fetches any configured version that is not installed yet.
+if command -v mise >/dev/null 2>&1; then
+    global=$(mise ls --global --json)
+    missing=''
+    for tool in{{ range .packages.shared.mise }} {{ . | quote }}{{ end }}; do
+        echo "$global" | jq -e --arg t "$tool" 'has($t)' >/dev/null || missing="$missing $tool"
+    done
+    # shellcheck disable=SC2086 # one word per tool
+    [ -z "$missing" ] || mise use -g $missing
+    mise install{{ range .packages.shared.mise }} {{ . | quote }}{{ end }}
+    # omp's own installer (omp.sh/install) put a binary in ~/.local/bin, which
+    # precedes mise's shims on PATH; drop it once mise provides omp.
+    if [ -f "$HOME/.local/bin/omp" ] && [ ! -L "$HOME/.local/bin/omp" ] && mise which omp >/dev/null 2>&1; then
+        rm -f "$HOME/.local/bin/omp"
+    fi
+else
+    echo "warning: mise not installed — skipping mise tools" >&2
+fi
+{{- if and (eq .chezmoi.os "linux") (or (eq .role "desktop") (eq .role "laptop")) }}
+
+# strata (GUI file manager): binary in ~/.local/bin, desktop entry, and the
+# FileManager1 D-Bus service for "Open file location". The inode/directory
+# default is dot_config/mimeapps.list; --with-folder-association is not used
+# because xdg-mime would replace that symlink with a plain file. Runtime deps
+# are in packages.arch.desktop.pacman.
+if [ ! -e "$HOME/.local/bin/strata" ]; then
+    curl -fsSL https://raw.githubusercontent.com/lgse/strata/main/install.sh | bash -s -- --with-desktop-entry --with-file-manager
+fi
+
+# System file chooser: strata serves org.freedesktop.impl.portal.FileChooser
+# for portal-aware apps (browsers, GTK). --install-portal writes the .portal
+# and D-Bus service under ~/.local/share, prepends "strata;" to the
+# FileChooser line of ~/.config/xdg-desktop-portal/<desktop>-portals.conf
+# (copied from the system one if absent; strata owns that file, not chezmoi,
+# so `strata --uninstall-portal` can restore it), and restarts the portal.
+if [ -e "$HOME/.local/bin/strata" ] && [ ! -e "${XDG_DATA_HOME:-$HOME/.local/share}/xdg-desktop-portal/portals/strata.portal" ]; then
+    "$HOME/.local/bin/strata" --install-portal
+fi
+{{- end }}

.chezmoiscripts/run_onchange_after_20-gh-extensions.sh.tmpl

@@ -0,0 +1,25 @@
+#!/usr/bin/env fish
+# Install gh extensions declared in .chezmoidata/packages.yaml.
+# A fish script, so fish's config (~/.config/fish, applied before after-scripts
+# run) is sourced first: PATH (mise, ~/.local/bin, ~/.cargo/bin) and
+# GITHUB_TOKEN (conf.d/10-env.fish) match a fish session.
+# gh_extensions hash: {{ .packages.shared.gh_extensions | toJson | sha256sum }}
+
+if not command -q gh
+    echo "warning: gh not installed — skipping extensions" >&2
+    exit 0
+end
+if not gh auth status >/dev/null 2>&1
+    echo "warning: gh not authenticated — run 'gh auth login', then 'chezmoi apply' again" >&2
+    exit 0
+end
+
+set -l installed (gh extension list 2>/dev/null | string split -f2 \t)
+set -l failed
+for ext in{{ range .packages.shared.gh_extensions }} {{ . | quote }}{{ end }}
+    contains -- $ext $installed; or gh extension install $ext; or set -a failed $ext
+end
+if set -q failed[1]
+    echo "error: gh extension install failed for: $failed" >&2
+    exit 1
+end

.chezmoiscripts/run_onchange_after_25-skills.sh.tmpl

@@ -0,0 +1,70 @@
+#!/bin/sh
+# Sync agent skills with .chezmoidata/skills.yaml through the Skills CLI:
+# install every declared skill (one `skills add` per source), then remove
+# skills a previous run installed that are no longer declared.
+# skills hash: {{ .skills | toJson | sha256sum }}
+set -u
+
+command -v npx >/dev/null 2>&1 || { echo "warning: npx not found — skipping skills sync" >&2; exit 0; }
+
+src={{ .chezmoi.sourceDir | quote }}
+state=${XDG_STATE_HOME:-$HOME/.local/state}/chezmoi/skills.txt
+declared='{{ range .skills.sources }}{{ range .skills }} {{ . }}{{ end }}{{ end }} '
+
+skills() { npx -y {{ .skills.cli | quote }} "$@" </dev/null; }
+
+# Leftovers from when skills were vendored in this repo (chezmoi symlink mode):
+# skill dirs whose files are symlinks into the source tree, and the old lock
+# symlink. Drop them so the CLI writes real copies instead of writing through
+# the links into the repo.
+for dir in "$HOME/.agents/skills"/* "$HOME/.claude/skills"/*; do
+    [ -d "$dir" ] && [ ! -L "$dir" ] || continue
+    if [ -n "$(find "$dir" -type l -lname "$src/*" -print -quit)" ]; then
+        rm -rf "$dir"
+    fi
+done
+lock=$HOME/.agents/.skill-lock.json
+if [ -L "$lock" ]; then
+    case $(readlink "$lock") in "$src"/*) rm -f "$lock" ;; esac
+fi
+
+# Remove what the last sync installed but skills.yaml no longer lists.
+stale=''
+if [ -f "$state" ]; then
+    while IFS= read -r name; do
+        case $declared in *" $name "*) ;; *) stale="$stale $name" ;; esac
+    done <"$state"
+fi
+if [ -n "$stale" ]; then
+    echo "skills: removing$stale"
+    # shellcheck disable=SC2086 # one word per skill name
+    skills remove -g -y $stale || echo "warning: skills remove failed:$stale" >&2
+fi
+
+failed=''
+log=$(mktemp)
+trap 'rm -f "$log"' EXIT
+add() {
+    source=$1 agents=$2
+    shift 2
+    echo "skills: $source → $*"
+    # shellcheck disable=SC2086 # agents is a space-separated list
+    if ! skills add "$source" -g -y -a $agents --skill "$@" >"$log" 2>&1; then
+        failed="$failed $source"
+        tail -n 8 "$log" >&2
+    fi
+}
+{{ range .skills.sources -}}
+{{ $agents := $.skills.agents -}}
+{{ if hasKey . "agents" }}{{ $agents = .agents }}{{ end -}}
+add {{ .source | quote }} {{ $agents | join " " | quote }}{{ range .skills }} {{ . | quote }}{{ end }}
+{{ end -}}
+
+mkdir -p "$(dirname "$state")"
+printf '%s\n' $declared >"$state"
+
+if [ -n "$failed" ]; then
+    # Non-zero keeps the old hash, so the next `chezmoi apply` retries.
+    echo "error: skills add failed for:$failed" >&2
+    exit 1
+fi

.chezmoiscripts/run_onchange_after_40-post.sh.tmpl

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Post-apply housekeeping. Re-runs when this file's rendered content changes.
+set -eu
+
+if command -v bat >/dev/null 2>&1; then bat cache --build >/dev/null || true; fi
+
+{{ if eq .chezmoi.os "linux" -}}
+if command -v fc-cache >/dev/null 2>&1; then fc-cache -f >/dev/null || true; fi
+{{ end -}}

.chezmoiscripts/run_onchange_before_10-packages.sh.tmpl

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Install packages declared in .chezmoidata/packages.yaml.
+# packages.yaml hash: {{ include ".chezmoidata/packages.yaml" | sha256sum }}
+set -eu
+
+{{ if eq .chezmoi.os "linux" -}}
+if [ "$(id -u)" -eq 0 ]; then PACMAN="pacman"; else PACMAN="sudo pacman"; fi
+
+# Install only what no installed package already provides (`pacman -T`), so a
+# machine with mise-bin or yazi-git is not asked to replace them with mise/yazi.
+install_missing() {
+    missing=$(pacman -T "$@" || true)
+    # shellcheck disable=SC2086  # word splitting intended
+    [ -z "$missing" ] || $PACMAN -S --needed --noconfirm $missing
+}
+
+install_missing {{ range .packages.arch.pacman }}{{ . }} {{ end }}
+
+{{ if or (eq .role "desktop") (eq .role "laptop") -}}
+install_missing {{ range .packages.arch.desktop.pacman }}{{ . }} {{ end }}
+
+aur_pkgs="{{ range .packages.arch.desktop.aur }}{{ . }} {{ end }}{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ else -}}
+aur_pkgs="{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ end -}}
+# AUR names no installed package provides yet; ones already installed from a
+# sync repo (CachyOS, chaotic-aur) are neither rebuilt nor replaced.
+# shellcheck disable=SC2086
+aur_missing=$(pacman -T $aur_pkgs || true)
+if [ -n "$aur_missing" ]; then
+    # No AUR helper yet: take yay from a sync repo that ships it (cachyos,
+    # chaotic-aur), else build yay-bin from the AUR (makepkg refuses root).
+    if ! command -v yay >/dev/null 2>&1 && ! command -v paru >/dev/null 2>&1; then
+        if pacman -Si yay >/dev/null 2>&1; then
+            $PACMAN -S --needed --noconfirm yay
+        elif [ "$(id -u)" -ne 0 ]; then
+            install_missing git base-devel
+            yay_build=$(mktemp -d)
+            git clone --depth 1 https://aur.archlinux.org/yay-bin.git "$yay_build"
+            (cd "$yay_build" && makepkg -si --noconfirm)
+            rm -rf "$yay_build"
+        fi
+    fi
+    if command -v yay >/dev/null 2>&1; then AUR="yay"
+    elif command -v paru >/dev/null 2>&1; then AUR="paru"
+    else AUR=""; fi
+    if [ -n "$AUR" ]; then
+        # shellcheck disable=SC2086
+        $AUR -S --needed --noconfirm $aur_missing
+    else
+        echo "warning: no yay/paru and none could be bootstrapped — skipping AUR packages:" $aur_missing >&2
+    fi
+fi
+
+{{ end -}}