From 441a87d94dc62505fbd33aabf48575e7f1a0a33e Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sat, 16 May 2026 14:34:56 -0400
Subject: [PATCH 01/12] Make assimilate.sh cross-platform (macOS + Linux)

Branches on `uname -s` to skip macOS-only steps on Linux:
- Skip hammerspoon/ghostty/vscode/zed symlinks and `brew bundle install`
- Source dotfiles bashrc from $HOME/.bashrc instead of symlinking (the EC2
  user_data appends a secrets block; symlinking would write into the repo)
- Pick delta tarball + SHA256 per OS/arch (Linux SHA marked TODO until first
  install on the EC2 box)
- Only run `nvim PackerSync` if nvim is on PATH

Enables running the install script on the EC2 dev box without breaking the
existing macOS flow.
---
 assimilate.sh | 129 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 94 insertions(+), 35 deletions(-)

diff --git a/assimilate.sh b/assimilate.sh
index 336b923..49b3d76 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -1,7 +1,10 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
 set -ex
 
+OS="$(uname -s)"
+ARCH="$(uname -m)"
+
 PREFIX="$HOME"
 DOTFILES=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 BACKUPS="$PREFIX/backups"
@@ -24,6 +27,19 @@ function sym () {
   ln -s "$src" "$dest"
 }
 
+function clone_pinned () {
+  url="$1"; dir="$2"; sha="$3"
+  if [ ! -d "$dir" ]; then
+    git clone --revision="$sha" "$url" "$dir"
+  else
+    # SHA may be missing locally — newer than the last fetch, or absent because
+    # the prior clone was shallow (--revision pulls only that one commit).
+    # Fetch it directly.
+    git -C "$dir" fetch origin "$sha"
+    git -C "$dir" checkout "$sha"
+  fi
+}
+
 if [ ! -e "$DOTFILES" ]; then
   echo "error: dotfiles/ needs to reside in $PREFIX"
   exit 1
@@ -31,40 +47,54 @@ fi
 
 mkdir -p "$BACKUPS/vim_backups"
 
-sym bashrc              .bashrc
+# Shared symlinks (work on macOS and Linux)
 sym bash_profile        .bash_profile
 sym gitconfig           .gitconfig
 sym tmux.conf           .tmux.conf
 sym zshrc               .zshrc
 sym nvim                .config/nvim
-sym hammerspoon         .hammerspoon
-sym vscode/code_settings.json  .vscode/settings.json
-sym zed/settings.json   .config/zed/settings.json
-sym ghostty/config      Library/Application\ Support/com.mitchellh.ghostty/config
-sym tmux-powerline/config.sh   .config/tmux-powerline/config.sh
+sym tmux-powerline/config.sh        .config/tmux-powerline/config.sh
 sym tmux-powerline/themes/theme.sh  .config/tmux-powerline/themes/theme.sh
-sym claude/statusline.sh .claude/statusline.sh
-sym agent-instructions.md .claude/CLAUDE.md
-sym agent-instructions.md .codex/AGENTS.md
-sym zed/keymap.json     .config/zed/keymap.json
+sym claude/statusline.sh            .claude/statusline.sh
+sym agent-instructions.md           .claude/CLAUDE.md
+sym agent-instructions.md           .codex/AGENTS.md
+
+# bashrc: symlinked on macOS; sourced from a stub on Linux.
+# On the EC2 dev box, user_data appends a secrets/region block to .bashrc after
+# this script runs. If .bashrc were a symlink into the repo, those appends would
+# write into the dotfiles repo's tracked file. So on Linux, leave .bashrc as a
+# regular file and source the dotfiles bashrc from it.
+if [ "$OS" = "Darwin" ]; then
+  sym bashrc .bashrc
+else
+  if ! grep -Fq 'dotfiles/bashrc' "$PREFIX/.bashrc" 2>/dev/null; then
+    echo '[ -f "$HOME/dotfiles/bashrc" ] && . "$HOME/dotfiles/bashrc"' >> "$PREFIX/.bashrc"
+  fi
+fi
 
-brew bundle install
+# macOS-only symlinks and Homebrew (apps/paths don't exist on Linux)
+if [ "$OS" = "Darwin" ]; then
+  sym hammerspoon                 .hammerspoon
+  sym vscode/code_settings.json   .vscode/settings.json
+  sym zed/settings.json           .config/zed/settings.json
+  sym zed/keymap.json             .config/zed/keymap.json
+  sym ghostty/config              Library/Application\ Support/com.mitchellh.ghostty/config
 
-"$DOTFILES/claude/sync-settings.sh"
-"$DOTFILES/codex/sync-config.sh"
+  brew bundle install
+fi
 
-function clone_pinned () {
-  url="$1"; dir="$2"; sha="$3"
-  if [ ! -d "$dir" ]; then
-    git clone --revision="$sha" "$url" "$dir"
-  else
-    # SHA may be missing locally — newer than the last fetch, or absent because
-    # the prior clone was shallow (--revision pulls only that one commit).
-    # Fetch it directly.
-    git -C "$dir" fetch origin "$sha"
-    git -C "$dir" checkout "$sha"
-  fi
-}
+# Sync portable agent settings after Homebrew has supplied jq, yq, and Codex on
+# macOS. On Linux, run each sync when its dependencies are already available.
+if command -v jq >/dev/null 2>&1; then
+  "$DOTFILES/claude/sync-settings.sh"
+else
+  echo "WARN: jq is unavailable — skipping Claude settings sync" >&2
+fi
+if command -v yq >/dev/null 2>&1 && command -v codex >/dev/null 2>&1; then
+  "$DOTFILES/codex/sync-config.sh"
+else
+  echo "WARN: yq or codex is unavailable — skipping Codex settings sync" >&2
+fi
 
 # Install oh-my-zsh (clone repo directly; install.sh is just `git clone` once
 # its zshrc/runzsh/chsh side-effects are disabled)
@@ -79,17 +109,44 @@ if [ ! -d "$HOME/.cargo" ]; then
     | sh -s -- -y --no-modify-path --default-toolchain 1.95.0
 fi
 
-# Install git-delta from a pinned GitHub release tarball (sidesteps brew bottle ABI drift)
+# Install git-delta from a pinned GitHub release tarball (sidesteps brew bottle ABI drift).
+# Tarball target and SHA256 are platform-specific.
 DELTA_VERSION=0.19.2
-DELTA_SHA256=9be36612a5a13e9e386dc498fb8e50dc87c72ee42b63db0ea05b32f99a72a69a
 DELTA_BIN="$HOME/.local/bin/delta"
-if [ ! -x "$DELTA_BIN" ] || [ "$("$DELTA_BIN" --version 2>/dev/null | awk '{print $2}')" != "$DELTA_VERSION" ]; then
+
+case "$OS-$ARCH" in
+  Darwin-arm64)
+    DELTA_TARGET=aarch64-apple-darwin
+    DELTA_SHA256=9be36612a5a13e9e386dc498fb8e50dc87c72ee42b63db0ea05b32f99a72a69a
+    ;;
+  Linux-x86_64)
+    DELTA_TARGET=x86_64-unknown-linux-gnu
+    # TODO: pin SHA256 after first install on the EC2 box.
+    # Compute on the install target with `sha256sum delta.tar.gz`, then replace
+    # the empty default below to enable integrity verification.
+    DELTA_SHA256=""
+    ;;
+  *)
+    echo "WARN: no delta build pinned for $OS-$ARCH — skipping delta install" >&2
+    DELTA_TARGET=""
+    ;;
+esac
+
+if [ -n "$DELTA_TARGET" ] && { [ ! -x "$DELTA_BIN" ] || [ "$("$DELTA_BIN" --version 2>/dev/null | awk '{print $2}')" != "$DELTA_VERSION" ]; }; then
   tmp=$(mktemp -d)
-  curl -fsSL "https://github.com/dandavison/delta/releases/download/${DELTA_VERSION}/delta-${DELTA_VERSION}-aarch64-apple-darwin.tar.gz" -o "$tmp/delta.tar.gz"
-  echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | shasum -a 256 -c -
+  curl -fsSL "https://github.com/dandavison/delta/releases/download/${DELTA_VERSION}/delta-${DELTA_VERSION}-${DELTA_TARGET}.tar.gz" -o "$tmp/delta.tar.gz"
+  if [ -n "$DELTA_SHA256" ]; then
+    if command -v sha256sum >/dev/null; then
+      echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | sha256sum -c -
+    else
+      echo "${DELTA_SHA256}  $tmp/delta.tar.gz" | shasum -a 256 -c -
+    fi
+  else
+    echo "WARN: no DELTA_SHA256 pinned for $OS-$ARCH — integrity check skipped" >&2
+  fi
   mkdir -p "$HOME/.local/bin"
   tar -xzf "$tmp/delta.tar.gz" -C "$tmp"
-  install -m 755 "$tmp/delta-${DELTA_VERSION}-aarch64-apple-darwin/delta" "$DELTA_BIN"
+  install -m 755 "$tmp/delta-${DELTA_VERSION}-${DELTA_TARGET}/delta" "$DELTA_BIN"
   rm -rf "$tmp"
 fi
 
@@ -97,9 +154,11 @@ fi
 clone_pinned https://github.com/tmux-plugins/tpm     "$HOME/.tmux/plugins/tpm"            7bdb7ca33c9cc6440a600202b50142f401b6fe21  # v3.1.0
 clone_pinned https://github.com/erikw/tmux-powerline "$HOME/.tmux/plugins/tmux-powerline" 6079ace8d534a01d4d964b8b854b223f72edaf4b  # v3.2.0
 
-# Install Packer (nvim plugin manager) and run PackerSync
-clone_pinned https://github.com/wbthomason/packer.nvim "$HOME/.local/share/nvim/site/pack/packer/start/packer.nvim" ea0cc3c59f67c440c5ff0bbe4fb9420f4350b9a3  # 2023-08-24, matches plugins.lua pin
+# Install Packer (nvim plugin manager) and run PackerSync — only if nvim is available
+if command -v nvim >/dev/null; then
+  clone_pinned https://github.com/wbthomason/packer.nvim "$HOME/.local/share/nvim/site/pack/packer/start/packer.nvim" ea0cc3c59f67c440c5ff0bbe4fb9420f4350b9a3  # 2023-08-24, matches plugins.lua pin
 
-nvim --headless -c 'autocmd User PackerComplete quitall' -c 'PackerSync' || true
+  nvim --headless -c 'autocmd User PackerComplete quitall' -c 'PackerSync' || true
+fi
 
 echo "> Assimilation successful!"

From 70cd312d30a3a2c503c0c87e674f22afc5d7b018 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sat, 16 May 2026 17:42:29 -0400
Subject: [PATCH 02/12] Drop ls=lsd alias

lsd isn't installed on the EC2 dev box (no brew, dnf doesn't ship it),
and the dotfiles flow doesn't have a good place to install it cross-platform
without dragging in a several-minute cargo compile. Plain ls is fine.
---
 bashrc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/bashrc b/bashrc
index 795a00c..da2b1f7 100644
--- a/bashrc
+++ b/bashrc
@@ -14,7 +14,6 @@ export LANG='en_US.UTF-8'
 alias config="/usr/bin/git --git-dir=$HOME/.cfg/ --work-tree=$HOME"
 alias vi=nvim
 alias vim=nvim
-alias ls="lsd -al"
 
 # Docker
 alias d='docker'

From 71d419d411d17b6fac6e0b33e7cfc6187251c0cb Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sat, 16 May 2026 17:45:30 -0400
Subject: [PATCH 03/12] Guard ~/.cargo/env source against missing file

Matches the same pattern nvm uses two lines above. Sourcing an absent file
errors out on shell startup, which is harmless on Mac (rust is installed)
but breaks the prompt on systems without rust.
---
 bashrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bashrc b/bashrc
index da2b1f7..fe8cb3b 100644
--- a/bashrc
+++ b/bashrc
@@ -103,7 +103,7 @@ alias dbtr="dbt run"
 alias cb="cargo build"
 alias cr="cargo run"
 alias ct="cargo test"
-. "$HOME/.cargo/env"
+[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
 
 # modal
 alias md="modal deploy"

From 39e54432c70120e89907964010d525b87d28e534 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sat, 16 May 2026 18:29:24 -0400
Subject: [PATCH 04/12] Install neovim on Linux from a pinned tarball

AL2023 (and likely most non-Fedora Linuxes) don't have neovim in the
default package repos. macOS gets it from the Brewfile. Drops nvim into
$HOME/.local/bin so no root is needed. Placed above the PackerSync block
so the plugin sync that depends on `command -v nvim` actually fires.
---
 assimilate.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/assimilate.sh b/assimilate.sh
index 49b3d76..4c3b5e0 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -154,6 +154,22 @@ fi
 clone_pinned https://github.com/tmux-plugins/tpm     "$HOME/.tmux/plugins/tpm"            7bdb7ca33c9cc6440a600202b50142f401b6fe21  # v3.1.0
 clone_pinned https://github.com/erikw/tmux-powerline "$HOME/.tmux/plugins/tmux-powerline" 6079ace8d534a01d4d964b8b854b223f72edaf4b  # v3.2.0
 
+# Install neovim on Linux from a pinned upstream tarball (macOS gets it via Brewfile).
+# AL2023 doesn't ship neovim in its default dnf repos. Lands in $HOME/.local so no
+# root needed, and runs before the PackerSync block below so the plugin sync works.
+NVIM_VERSION=0.10.4
+if [ "$OS" = "Linux" ] && [ "$ARCH" = "x86_64" ] && ! command -v nvim >/dev/null; then
+  tmp=$(mktemp -d)
+  curl -fsSL "https://github.com/neovim/neovim/releases/download/v${NVIM_VERSION}/nvim-linux64.tar.gz" -o "$tmp/nvim.tar.gz"
+  # TODO: pin SHA256 after first install; compute on the install target with `sha256sum nvim.tar.gz`.
+  mkdir -p "$HOME/.local/share" "$HOME/.local/bin"
+  tar -xzf "$tmp/nvim.tar.gz" -C "$HOME/.local/share"
+  ln -sf "$HOME/.local/share/nvim-linux64/bin/nvim" "$HOME/.local/bin/nvim"
+  rm -rf "$tmp"
+  # Make nvim visible to the rest of this script (PackerSync below)
+  export PATH="$HOME/.local/bin:$PATH"
+fi
+
 # Install Packer (nvim plugin manager) and run PackerSync — only if nvim is available
 if command -v nvim >/dev/null; then
   clone_pinned https://github.com/wbthomason/packer.nvim "$HOME/.local/share/nvim/site/pack/packer/start/packer.nvim" ea0cc3c59f67c440c5ff0bbe4fb9420f4350b9a3  # 2023-08-24, matches plugins.lua pin

From 7e2861367ab28786f151d6e525a824f6bcd998e3 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sun, 17 May 2026 09:48:32 -0400
Subject: [PATCH 05/12] Pin neovim to 0.9.5 to match macOS version

v0.10.4 (my earlier guess) doesn't exist as a published release.
v0.9.5 is what's installed on the Mac, and v0.9.x predates the
asset-rename (still uses `nvim-linux64.tar.gz`), so the existing
extraction path stays correct.
---
 assimilate.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/assimilate.sh b/assimilate.sh
index 4c3b5e0..31e9994 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -157,7 +157,7 @@ clone_pinned https://github.com/erikw/tmux-powerline "$HOME/.tmux/plugins/tmux-p
 # Install neovim on Linux from a pinned upstream tarball (macOS gets it via Brewfile).
 # AL2023 doesn't ship neovim in its default dnf repos. Lands in $HOME/.local so no
 # root needed, and runs before the PackerSync block below so the plugin sync works.
-NVIM_VERSION=0.10.4
+NVIM_VERSION=0.9.5
 if [ "$OS" = "Linux" ] && [ "$ARCH" = "x86_64" ] && ! command -v nvim >/dev/null; then
   tmp=$(mktemp -d)
   curl -fsSL "https://github.com/neovim/neovim/releases/download/v${NVIM_VERSION}/nvim-linux64.tar.gz" -o "$tmp/nvim.tar.gz"

From 360b8e4cba330ea703a503c8e1c86a6626036d51 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sun, 17 May 2026 14:21:26 -0400
Subject: [PATCH 06/12] Guard brew-shipped zsh plugin sources and ~/.cargo/env

zsh-autosuggestions, zsh-syntax-highlighting, and rust may be absent on
boxes where the Brewfile hasn't been applied (Linux dev box) or where
those brew packages aren't installed. Mirror the existing nvm/bun
pattern: source only when the file exists.
---
 zshrc | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/zshrc b/zshrc
index b4cbca2..7b9f31f 100644
--- a/zshrc
+++ b/zshrc
@@ -47,13 +47,19 @@ else
 fi
 
 export PATH="$HOME/.yarn/bin:$HOME/.config/yarn/global/node_modules/.bin:$PATH"
-source $(brew --prefix)/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+
+# zsh-autosuggestions (installed via brew on macOS, may be missing elsewhere)
+if command -v brew >/dev/null 2>&1; then
+  _zsh_autosug="$(brew --prefix)/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
+  [ -f "$_zsh_autosug" ] && source "$_zsh_autosug"
+  unset _zsh_autosug
+fi
 
 export NVM_DIR="$HOME/.nvm"
 [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
 [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
 
-. "$HOME/.cargo/env"
+[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
 alias snowsql=/Applications/SnowSQL.app/Contents/MacOS/snowsql
 
 # The next line updates PATH for the Google Cloud SDK.
@@ -62,8 +68,10 @@ if [ -f "$HOME/Downloads/google-cloud-sdk/path.zsh.inc" ]; then . "$HOME/Downloa
 # The next line enables shell command completion for gcloud.
 if [ -f "$HOME/Downloads/google-cloud-sdk/completion.zsh.inc" ]; then . "$HOME/Downloads/google-cloud-sdk/completion.zsh.inc"; fi
 
-# .zsh syntax highlighting
-source /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+# .zsh syntax highlighting (installed via brew on macOS, may be missing elsewhere)
+if [ -f /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then
+  source /opt/homebrew/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+fi
 
 # Prepend so pinned overrides in assimilate.sh (e.g. delta) win over brew bottles with ABI drift
 export PATH="$HOME/.local/bin:$PATH"

From 9ec823a0bea4b9a1208e15d9d547bbacd42deb55 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sun, 17 May 2026 14:41:23 -0400
Subject: [PATCH 07/12] Source nvm with --no-use to suppress "N/A" auto-use
 errors

Without an argument, sourcing nvm.sh triggers nvm_auto use, which tries
to resolve a version (from .nvmrc or default-alias) and errors with
"N/A: version N/A -> N/A is not yet installed" when neither is set.
--no-use loads nvm without invoking auto-use; users still get the `nvm`
function and can `nvm use <version>` explicitly when they want one.
---
 bashrc | 2 +-
 zshrc  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bashrc b/bashrc
index fe8cb3b..4db50a2 100644
--- a/bashrc
+++ b/bashrc
@@ -74,7 +74,7 @@ alias kuc='kubectl config'
 
 # nvm
 export NVM_DIR="$HOME/.nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" --no-use  # Load nvm without auto-use (auto-use errors with "N/A" when no .nvmrc is set)
 [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
 
 # PYTHONPATH
diff --git a/zshrc b/zshrc
index 7b9f31f..aea3ca7 100644
--- a/zshrc
+++ b/zshrc
@@ -56,7 +56,7 @@ if command -v brew >/dev/null 2>&1; then
 fi
 
 export NVM_DIR="$HOME/.nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" --no-use  # Load nvm without auto-use (auto-use errors with "N/A" when no .nvmrc is set)
 [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
 
 [ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"

From f6a9728f974ad6d2c1cf706007e87bfac5059f95 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Mon, 18 May 2026 15:10:18 -0400
Subject: [PATCH 08/12] Set zed project panel on lhs

---
 zed/settings.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/zed/settings.json b/zed/settings.json
index b46a8f0..f3a1182 100644
--- a/zed/settings.json
+++ b/zed/settings.json
@@ -1,4 +1,7 @@
 {
+    "project_panel": {
+        "dock": "left"
+    },
     "cursor_blink": false,
     "terminal": {
         "cursor_shape": "bar"

From 9de06fd93e07efb731dada144168276f7c5219c3 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Mon, 18 May 2026 15:10:46 -0400
Subject: [PATCH 09/12] Clean up Brewfile

---
 Brewfile | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/Brewfile b/Brewfile
index e473bae..4df7c68 100644
--- a/Brewfile
+++ b/Brewfile
@@ -6,15 +6,12 @@ brew "gh"
 brew "hashicorp/tap/terraform", trusted: true
 brew "htop"
 brew "jq"
-brew "k9s"
 brew "lsd"
 brew "lua"
 brew "neovim"
 brew "mosh"
 brew "node"
 brew "postgresql@17"
-brew "py-spy"
-brew "pyenv"
 brew "tmux"
 brew "tree"
 brew "wget"

From 8a8d739247eafcf7754a9b39e4c0363d90830cf7 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 14:43:49 -0400
Subject: [PATCH 10/12] Pin Linux SHA256 for delta and neovim tarballs

---
 assimilate.sh | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/assimilate.sh b/assimilate.sh
index 31e9994..8fa649d 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -121,10 +121,7 @@ case "$OS-$ARCH" in
     ;;
   Linux-x86_64)
     DELTA_TARGET=x86_64-unknown-linux-gnu
-    # TODO: pin SHA256 after first install on the EC2 box.
-    # Compute on the install target with `sha256sum delta.tar.gz`, then replace
-    # the empty default below to enable integrity verification.
-    DELTA_SHA256=""
+    DELTA_SHA256=8e695c5f586a8c53d6c3b01be0b4a422ed218bfed2a56191caebe373a1c18ab2
     ;;
   *)
     echo "WARN: no delta build pinned for $OS-$ARCH — skipping delta install" >&2
@@ -158,10 +155,15 @@ clone_pinned https://github.com/erikw/tmux-powerline "$HOME/.tmux/plugins/tmux-p
 # AL2023 doesn't ship neovim in its default dnf repos. Lands in $HOME/.local so no
 # root needed, and runs before the PackerSync block below so the plugin sync works.
 NVIM_VERSION=0.9.5
+NVIM_SHA256=44ee395d9b5f8a14be8ec00d3b8ead34e18fe6461e40c9c8c50e6956d643b6ca
 if [ "$OS" = "Linux" ] && [ "$ARCH" = "x86_64" ] && ! command -v nvim >/dev/null; then
   tmp=$(mktemp -d)
   curl -fsSL "https://github.com/neovim/neovim/releases/download/v${NVIM_VERSION}/nvim-linux64.tar.gz" -o "$tmp/nvim.tar.gz"
-  # TODO: pin SHA256 after first install; compute on the install target with `sha256sum nvim.tar.gz`.
+  if command -v sha256sum >/dev/null; then
+    echo "${NVIM_SHA256}  $tmp/nvim.tar.gz" | sha256sum -c -
+  else
+    echo "${NVIM_SHA256}  $tmp/nvim.tar.gz" | shasum -a 256 -c -
+  fi
   mkdir -p "$HOME/.local/share" "$HOME/.local/bin"
   tar -xzf "$tmp/nvim.tar.gz" -C "$HOME/.local/share"
   ln -sf "$HOME/.local/share/nvim-linux64/bin/nvim" "$HOME/.local/bin/nvim"

From 286f249be587c77110937039d4acb62b2d141618 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 14:51:49 -0400
Subject: [PATCH 11/12] Make clone_pinned work on git <2.49 (drop --revision)

AL2023 on older/un-updated AMIs ships git 2.40, which lacks
`git clone --revision`. Use git init + fetch --depth 1 <sha> + checkout
instead, which pins the same single commit on any git version.
---
 assimilate.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/assimilate.sh b/assimilate.sh
index 8fa649d..cb94c0e 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -29,15 +29,15 @@ function sym () {
 
 function clone_pinned () {
   url="$1"; dir="$2"; sha="$3"
+  # Fetch only the pinned commit, no full history. Avoids `git clone --revision`
+  # (git >= 2.49) so this works on older git too, e.g. AL2023's 2.40 on stale AMIs.
+  # Fetch-by-SHA relies on the server allowing reachable-SHA1-in-want (GitHub does).
   if [ ! -d "$dir" ]; then
-    git clone --revision="$sha" "$url" "$dir"
-  else
-    # SHA may be missing locally — newer than the last fetch, or absent because
-    # the prior clone was shallow (--revision pulls only that one commit).
-    # Fetch it directly.
-    git -C "$dir" fetch origin "$sha"
-    git -C "$dir" checkout "$sha"
+    git init -q "$dir"
+    git -C "$dir" remote add origin "$url"
   fi
+  git -C "$dir" fetch --depth 1 origin "$sha"
+  git -C "$dir" checkout -q "$sha"
 }
 
 if [ ! -e "$DOTFILES" ]; then

From 58abadfa1abdaa687aca7fc369e73253dcf13080 Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Mon, 6 Jul 2026 20:52:15 -0400
Subject: [PATCH 12/12] Keep lsd ls alias on machines that have lsd

The cross-platform pass dropped the alias entirely so Linux boxes without
lsd keep a working ls, but that also removed it on macOS where lsd is
installed via the Brewfile. Guard on the binary instead.
---
 bashrc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/bashrc b/bashrc
index 4db50a2..8de032c 100644
--- a/bashrc
+++ b/bashrc
@@ -14,6 +14,9 @@ export LANG='en_US.UTF-8'
 alias config="/usr/bin/git --git-dir=$HOME/.cfg/ --work-tree=$HOME"
 alias vi=nvim
 alias vim=nvim
+# lsd comes from the Brewfile on macOS; guard so a Linux box without it keeps
+# a working `ls`
+command -v lsd >/dev/null 2>&1 && alias ls="lsd -al"
 
 # Docker
 alias d='docker'