Aboudjem · May 31, 2026 00:19
diff --git a/00-STATUS.md b/00-STATUS.md
diff --git a/adam-mac-setup.md b/adam-mac-setup.md
diff --git a/adhd-cleanup.sh b/adhd-cleanup.sh
 #!/bin/zsh
 # Adam's ADHD-friendly file cleanup — mirrors ~/2_KNOWLEDGE/hazel-adhd-rules.md (13 rules).
 # Scheduled via ~/Library/LaunchAgents/com.adam.adhd-cleanup.plist (every 10 min).
 # Idempotent and safe to re-run. mv -n prevents overwrites. Logs to ~/.local-ai/logs/adhd-cleanup.log.
 #
 # Manual: zsh ~/.local-bin/adhd-cleanup.sh
 # Dry-run: DRY_RUN=1 zsh ~/.local-bin/adhd-cleanup.sh   (prints intended moves, doesn't touch files)

 set -u
 LOG="$HOME/.local-ai/logs/adhd-cleanup.log"
 mkdir -p "$(dirname "$LOG")"
 DRY_RUN=${DRY_RUN:-0}

 log()   { print -P "[%D{%H:%M:%S}] $1" >> "$LOG"; }
 moved=0; trashed=0

 do_mv() {
  local src="$1" dest="$2"
  [[ -e "$src" ]] || return
  mkdir -p "$dest"
  if (( DRY_RUN )); then
    log "DRY mv: $src → $dest/"
  else
    if mv -n "$src" "$dest/" 2>>"$LOG"; then
      ((moved++)); log "mv: $src → $dest/"
    fi
  fi
 }

 do_trash() {
  local src="$1"
  [[ -e "$src" ]] || return
  if (( DRY_RUN )); then
    log "DRY trash: $src"
  else
    if mv -n "$src" "$HOME/.Trash/" 2>>"$LOG"; then
      ((trashed++)); log "trash: $src"
    fi
  fi
 }

 archive_dated() {
  local src="$1" dest_root="$2"
  [[ -e "$src" ]] || return
  local mon; mon=$(date -r "$src" +%Y-%m 2>/dev/null) || return
  do_mv "$src" "$dest_root/$mon"
 }

 do_delete_permanent() {
  local src="$1"
  [[ -e "$src" ]] || return
  if (( DRY_RUN )); then
    log "DRY rm: $src"
  else
    if rm -rf -- "$src" 2>>"$LOG"; then
      ((trashed++)); log "rm: $src"
    fi
  fi
 }

 log "=== start (DRY_RUN=$DRY_RUN) ==="

 # Excluded names (case-sensitive on APFS by default)
 EXCL=( ! -name ".DS_Store" ! -name ".localized" )

 #####################
 # ~/Downloads rules
 #####################

 # 1. DMGs older than 1 day → Trash
 while IFS= read -r f; do do_trash "$f"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f -iname "*.dmg" -mtime +1 2>/dev/null
 )

 # 2. .pkg installers older than 3 days → Trash
 while IFS= read -r f; do do_trash "$f"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f -iname "*.pkg" -mtime +3 2>/dev/null
 )

 # 3. Stale archives older than 14 days → Trash
 while IFS= read -r f; do do_trash "$f"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f \
    \( -iname "*.zip" -o -iname "*.tar" -o -iname "*.tar.gz" -o -iname "*.tgz" -o -iname "*.gz" -o -iname "*.7z" -o -iname "*.rar" \) \
    -mtime +14 2>/dev/null
 )

 # 4. Screenshots → ~/Pictures/Screenshots
 while IFS= read -r f; do do_mv "$f" "$HOME/Pictures/Screenshots"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f \
    \( -iname "Screen Shot*" -o -iname "Screenshot*" -o -iname "CleanShot*" \) 2>/dev/null
 )

 # 5. invoice/facture PDFs → ~/Documents/3_admin/factures
 while IFS= read -r f; do do_mv "$f" "$HOME/Documents/3_admin/factures"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f -iname "*.pdf" \
    \( -iname "*invoice*" -o -iname "*facture*" \) 2>/dev/null
 )

 # 6. receipt PDFs → ~/Documents/3_admin/receipts
 while IFS= read -r f; do do_mv "$f" "$HOME/Documents/3_admin/receipts"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f -iname "*.pdf" \
    \( -iname "*receipt*" -o -iname "*recu*" -o -iname "*reçu*" \) 2>/dev/null
 )

 # 7. audit*.pdf → ~/2_KNOWLEDGE/audits/incoming
 while IFS= read -r f; do do_mv "$f" "$HOME/2_KNOWLEDGE/audits/incoming"; done < <(
  find -H "$HOME/Downloads" -maxdepth 1 -type f -iname "audit*.pdf" 2>/dev/null
 )

 # 8. Stale-everything sweep — anything older than 30 days → ~/Downloads/_archive/YYYY-MM
 while IFS= read -r f; do archive_dated "$f" "$HOME/Downloads/_archive"; done < <(
  find -H "$HOME/Downloads" -mindepth 1 -maxdepth 1 -mtime +30 \
    ! -name "_archive" "${EXCL[@]}" 2>/dev/null
 )

 #####################
 # ~/Desktop rules
 #####################

 # 9. Desktop screenshot rescue
 while IFS= read -r f; do do_mv "$f" "$HOME/Pictures/Screenshots"; done < <(
  find -H "$HOME/Desktop" -maxdepth 1 -type f \
    \( -iname "Screen Shot*" -o -iname "Screenshot*" -o -iname "CleanShot*" \) 2>/dev/null
 )

 # 10. Daily Desktop sweep — anything older than 1 day → ~/Desktop/_inbox
 while IFS= read -r f; do do_mv "$f" "$HOME/Desktop/_inbox"; done < <(
  find -H "$HOME/Desktop" -mindepth 1 -maxdepth 1 -mtime +1 \
    ! -name "_inbox" "${EXCL[@]}" 2>/dev/null
 )

 #####################
 # ~/Pictures/Screenshots rules
 #####################

 # 11. Screenshot archive older than 14 days → archive/YYYY-MM
 while IFS= read -r f; do archive_dated "$f" "$HOME/Pictures/Screenshots/archive"; done < <(
  find -H "$HOME/Pictures/Screenshots" -mindepth 1 -maxdepth 1 -mtime +14 \
    ! -name "archive" "${EXCL[@]}" 2>/dev/null
 )

 #####################
 # ~/Documents/0_inbox rules
 #####################

 # 12. 0_inbox older than 14 days → ~/Documents/_archive/YYYY-MM
 while IFS= read -r f; do archive_dated "$f" "$HOME/Documents/_archive"; done < <(
  find -H "$HOME/Documents/0_inbox" -mindepth 1 -maxdepth 1 -mtime +14 \
    "${EXCL[@]}" 2>/dev/null
 )

 #####################
 # ~/.Trash rules
 #####################

 # 13. Auto-empty Trash items WHOSE INODE CHANGE TIME (=when moved into Trash) is older than 14 days.
 # Using -ctime instead of -mtime avoids deleting freshly-trashed apps with old build dates.
 while IFS= read -r f; do do_delete_permanent "$f"; done < <(
  find -H "$HOME/.Trash" -mindepth 1 -maxdepth 1 -ctime +14 2>/dev/null
 )

 #####################
 # Tier C — content classification (OCR + Ollama)
 #####################
 # For PDFs / images / text files in ~/Downloads or ~/Desktop that survived the rules above,
 # extract text via pdftotext / ocrmac and ask Ollama to classify + name.
 # Rate-limit: max CLASSIFY_LIMIT files per cycle (each ~3-10s of Ollama latency).
 # Skip-mark via xattr so files we've already tried aren't re-classified every 10 min.

 CLASSIFY_LIMIT=${CLASSIFY_LIMIT:-5}
 CLASSIFY_MIN_AGE_MIN=2  # ignore files modified in last N minutes (in-progress downloads)
 SKIP_XATTR="com.adam.adhd-classify"
 classified=0

 # Skip classification entirely if Ollama is not responding
 if (( ! DRY_RUN )); then
  if ! /usr/bin/curl -s --max-time 2 http://127.0.0.1:11434/api/tags >/dev/null 2>&1; then
    log "classify: ollama down, skipping content tier"
  else
    for root in "$HOME/Downloads" "$HOME/Desktop"; do
      (( classified < CLASSIFY_LIMIT )) || break
      while IFS= read -r f; do
        (( classified < CLASSIFY_LIMIT )) || break
        [[ -e "$f" ]] || continue
        # Skip if we already tried and marked
        if /usr/bin/xattr -p "$SKIP_XATTR" "$f" >/dev/null 2>&1; then
          continue
        fi
        # Classify
        out=$(/opt/homebrew/bin/python3 "$HOME/.local-bin/classify-file.py" "$f" 2>>"$LOG")
        cat=$(print -r -- "$out" | /opt/homebrew/bin/python3 -c "import sys,json; print(json.load(sys.stdin).get('category','skip'))" 2>/dev/null)
        case "$cat" in
          invoice|receipt|bank-statement|audit-report|contract|tax-doc|code-or-tech-doc|screenshot-code|screenshot-other|photo)
            route=$(print -r -- "$out" | /opt/homebrew/bin/python3 -c "import sys,json; print(json.load(sys.stdin).get('route',''))" 2>/dev/null)
            name=$(print -r -- "$out" | /opt/homebrew/bin/python3 -c "import sys,json; print(json.load(sys.stdin).get('name',''))" 2>/dev/null)
            ext="${f##*.}"
            if [[ -n "$route" && -d "$(dirname "$route")" ]]; then
              mkdir -p "$route"
              target="$route/${name:-$(basename "$f" .${ext})}.${ext}"
              # Suffix if exists
              n=1
              while [[ -e "$target" ]]; do
                target="$route/${name:-$(basename "$f" .${ext})}-$n.${ext}"
                (( n++ ))
              done
              if mv -n "$f" "$target" 2>>"$LOG"; then
                ((moved++)); ((classified++))
                log "classify: $f → $target (cat=$cat)"
              fi
            fi
            ;;
          skip|*)
            # Mark so we don't retry every cycle
            /usr/bin/xattr -w "$SKIP_XATTR" "skip-$(date +%Y%m%d)" "$f" 2>/dev/null
            log "classify-skip: $f ($out)"
            ;;
        esac
      done < <(
        find -H "$root" -mindepth 1 -maxdepth 1 -type f \
          \( -iname "*.pdf" -o -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.heic" -o -iname "*.txt" -o -iname "*.md" -o -iname "*.csv" \) \
          -mmin +$CLASSIFY_MIN_AGE_MIN \
          ! -name ".*" "${EXCL[@]}" 2>/dev/null
      )
    done
  fi
 fi

 log "=== end moved=$moved trashed=$trashed classified=$classified ==="
 print "moved=$moved trashed=$trashed classified=$classified log=$LOG"
diff --git a/Brewfile b/Brewfile
 # Brewfile — Adam's M5 Max install (May 2026, fanout-verified)
 #
 # Usage:
 #   brew bundle install --file=Brewfile
 #
 # What this installs:
 #   ~30 CLI formulae + ~25 GUI casks + 5 external taps
 #   ~10 GB disk, ~30 min wall-clock
 #
 # What this does NOT install (run setup.sh after):
 #   - Foundry (curl installer)
 #   - Solidity Python tools (uv tool install)
 #   - Claude Code, Vercel, pnpm (npm install -g)
 #   - Python MLX libs (uv add in project dir)
 #   - Ollama model pulls
 #   - macOS defaults / sysctl / launchd
 #   - Hazel license, ssh-keygen, OAuth logins (manual)
 # ============================================================

 # === External taps (community-maintained repos) ===
 tap "cyfrin/tap"           # aderyn (Solidity static analyzer)
 tap "stripe/stripe-cli"    # stripe CLI
 tap "charmbracelet/tap"    # crush — Phase 17 fallback coding TUI
 # tap "supabase/tap"       # RELOCATED — supabase now in homebrew-core
 # tap "mystenlabs/tap"     # RELOCATED — sui now in homebrew-core

 # ============================================================
 # CLI FORMULAE
 # ============================================================

 # --- Shell foundation ---
 brew "antidote"                # zsh plugin manager (faster than oh-my-zsh)
 brew "starship"                # cross-shell prompt
 brew "atuin"                   # encrypted shell history sync

 # --- Modern Unix replacements ---
 brew "eza"                     # better ls (git status, colors)
 brew "bat"                     # better cat (syntax highlight)
 brew "fd"                      # better find
 brew "ripgrep"                 # better grep (binary: rg)
 brew "fzf"                     # fuzzy finder (Ctrl+R, Ctrl+T, Alt+C)
 brew "zoxide"                  # smart cd (z foo)

 # --- Git + dev TUI ---
 brew "lazygit"                 # git TUI
 brew "yazi"                    # file manager TUI
 brew "gh"                      # GitHub CLI

 # --- Data processing ---
 brew "jq"                      # JSON processor
 brew "yq"                      # YAML processor
 brew "tree"                    # directory tree

 # --- System monitoring ---
 brew "htop"                    # process viewer
 brew "btop"                    # pretty process viewer
 brew "dust"                    # better du (disk usage tree)
 brew "duf"                     # better df (free space)

 # --- Dev utilities ---
 brew "direnv"                  # auto-load .envrc per folder
 brew "tldr"                    # short man pages
 brew "gnupg"                   # provides gpg (commit signing)
 brew "mkcert"                  # local HTTPS certs

 # --- Network / API ---
 brew "mas"                     # Mac App Store CLI
 brew "xh"                      # rust port of httpie (faster)
 brew "doggo"                   # modern dig
 brew "wget"                    # download with resume
 brew "cloudflared"             # cloudflare tunnel

 # --- Misc ---
 brew "watch"                   # repeat a command every N seconds
 brew "imagemagick"             # image processing (resize/convert)
 brew "poppler"                 # pdftotext + pdftoppm — adhd-cleanup Tier C classify pipeline
 brew "yt-dlp"                  # youtube downloader
 brew "ncdu"                    # interactive disk usage

 # --- Dev runtimes / managers ---
 brew "mise"                    # polyglot version manager (node/python/rust/go)
 brew "uv"                      # python package + venv manager (Astral)
 brew "git"                     # newer than Xcode CLT git (2.54 vs 2.39)

 # --- AI / MLX local stack ---
 brew "ollama"                  # local LLM runtime (drives opencode/Continue.dev — NEVER the `claude` CLI)
 brew "whisper-cpp"             # speech-to-text via Metal (NEVER use pip whisper)
 brew "espeak-ng"               # offline TTS (paired with whisper-cpp for voice pipelines)
 brew "ffmpeg"                  # required transitive dep for whisper + Python AI libs
 brew "llama.cpp"               # GGUF inference
 brew "charmbracelet/tap/crush" # Phase 17 fallback coding TUI (replaced openclaude — CVE GHSA-m6rx-7pvw-2f73)
 brew "dockutil"                # scriptable Dock add/remove (CLI Dock layout helper)

 # --- Web3 / Solidity ---
 brew "echidna"                 # Haskell smart-contract fuzzer
 brew "solana"                  # Solana CLI v4 (Agave/Anza build)
 brew "aptos"                   # Aptos Move chain CLI
 brew "cyfrin/tap/aderyn"       # Cyfrin Rust static analyzer (no core formula yet)
 brew "sui"                     # Sui Move chain CLI (relocated to core, was mystenlabs/tap)
 brew "supabase"                # Supabase CLI (relocated to core, was supabase/tap)
 brew "stripe/stripe-cli/stripe" # Stripe CLI (Stripe-owned tap, no core formula)

 # --- Cloud CLIs ---
 brew "awscli"                  # AWS CLI v2 (formula is awscli, not aws-cli)
 brew "doctl"                   # DigitalOcean

 # ============================================================
 # GUI CASKS
 # ============================================================

 # --- Terminal + editor ---
 cask "ghostty"                 # GPU terminal (multi-line paste needs TERM=xterm-256color in Claude Code)
 cask "visual-studio-code"      # editor (uses MS Marketplace; Continue.dev wires local Ollama/MLX)

 # --- Browsers ---
 cask "brave-browser"           # primary — Chromium + native adblock/tracker block + crypto wallet
 cask "google-chrome"           # backup — universal DevTools reference, sites that detect Brave
 cask "firefox"                 # cross-browser testing (non-Chromium engine)
 # cask "zen"                   # OPTIONAL: Firefox fork with workspaces + vertical tabs (cask=zen NOT zen-browser)

 # --- ADHD power stack ---
 cask "raycast"                 # launcher (replaces Spotlight + Alfred + Maccy + Paste)
 cask "jordanbaird-ice"         # menubar declutter (NOT thaw/bartender)
 cask "obsidian"                # local-first markdown notes

 # --- Cloud CLIs (casks) ---
 cask "tailscale-app"           # mesh VPN (NOT tailscale)

 # --- AI / MLX GUIs ---
 cask "lm-studio"               # local LLM chat GUI
 cask "draw-things"             # image gen GUI (SD, FLUX, Z-Image)
 cask "comfyui"                 # node-based image/video workflows

 # --- Docker ---
 cask "orbstack"                # fast Docker for Mac (NOT Docker Desktop)

 # --- Fonts ---
 cask "font-jetbrains-mono-nerd-font" # required by Ghostty config (setup.sh §21.4)

 # --- Productivity ---
 cask "cleanshot"               # screenshots + screen recording + OCR
 # cask "rectangle"             # OPTIONAL: window snapping
 cask "1password"               # password manager
 cask "1password-cli"           # op CLI for secret injection
 cask "postman"                 # API testing GUI

 # --- Communications ---
 cask "whatsapp"
 cask "telegram"
 cask "zoom"

 # --- System utilities ---
 cask "alt-tab"                 # window-level cmd-tab with previews
 cask "stats"                   # menubar system monitor
 cask "appcleaner"              # proper uninstaller
 cask "the-unarchiver"          # .rar / .7z / .tar.xz
 cask "iina"                    # modern video player
 # cask "spotify"               # OPTIONAL — Adam uses Apple Music (native). Uncomment if you switch.
 cask "voiceink"                # MLX dictation (Whisper-Turbo on GPU)
diff --git a/classify-file.py b/classify-file.py
 #!/usr/bin/env python3
 """
 Classify a file by extracting its text (pdftotext / ocrmac / head) and asking Ollama
 to categorize. Prints JSON {category, name, confidence, route, source} to stdout, or
 {category:"skip", reason:...} if not classifiable.

 Used by ~/.local-bin/adhd-cleanup.sh for content-aware routing of unmatched files.

 Usage: classify-file.py <path>
 """
 import json
 import os
 import subprocess
 import sys
 from pathlib import Path

 OLLAMA_URL = "http://127.0.0.1:11434/api/chat"
 OLLAMA_MODEL = "huihui_ai/qwen3-coder-abliterated:30b-a3b-instruct-q8_0"
 MAX_TEXT_CHARS = 4000
 MIN_TEXT_CHARS = 40

 CATEGORIES = [
    "invoice",
    "receipt",
    "bank-statement",
    "audit-report",
    "contract",
    "tax-doc",
    "code-or-tech-doc",
    "screenshot-code",
    "screenshot-other",
    "photo",
    "other",
 ]

 ROUTES = {
    "invoice":          os.path.expanduser("~/Documents/3_admin/factures"),
    "receipt":          os.path.expanduser("~/Documents/3_admin/receipts"),
    "bank-statement":   os.path.expanduser("~/Documents/3_admin/banking"),
    "audit-report":     os.path.expanduser("~/2_KNOWLEDGE/audits/incoming"),
    "contract":         os.path.expanduser("~/Documents/3_admin/contracts"),
    "tax-doc":          os.path.expanduser("~/Documents/3_admin/tax"),
    "code-or-tech-doc": os.path.expanduser("~/Documents/0_inbox"),
    "screenshot-code":  os.path.expanduser("~/Pictures/Screenshots"),
    "screenshot-other": os.path.expanduser("~/Pictures/Screenshots"),
    "photo":            os.path.expanduser("~/Pictures/inbox"),
    "other":            None,
 }

 SYSTEM_PROMPT = (
    "You classify documents and suggest concise filenames. Respond ONLY with valid JSON, "
    "no reasoning text, no markdown fences. Schema: "
    f"{{\"category\":\"<one of: {'|'.join(CATEGORIES)}>\",\"name\":\"<kebab-case-filename-no-extension-max-50-chars-ascii-only>\",\"confidence\":<0.0-1.0>}}"
 )


 def emit(payload):
    print(json.dumps(payload))
    sys.exit(0)


 def extract_text(path: Path) -> tuple[str, str]:
    """Return (text, source) where source is 'pdftotext', 'ocrmac', 'head', or 'none'."""
    ext = path.suffix.lower()

    if ext == ".pdf":
        try:
            r = subprocess.run(
                ["/opt/homebrew/bin/pdftotext", "-q", "-layout", "-l", "3", str(path), "-"],
                capture_output=True, text=True, timeout=10,
            )
            text = (r.stdout or "").strip()
            if len(text) >= MIN_TEXT_CHARS:
                return text[:MAX_TEXT_CHARS], "pdftotext"
            # Fall through to OCR of rendered first page
            tmp = Path(f"/tmp/classify-{os.getpid()}.png")
            subprocess.run(
                ["/opt/homebrew/bin/pdftoppm", "-png", "-singlefile", "-r", "120", "-f", "1", "-l", "1", str(path), str(tmp.with_suffix(""))],
                capture_output=True, timeout=15,
            )
            if tmp.exists():
                try:
                    from ocrmac import ocrmac
                    chunks = ocrmac.OCR(str(tmp)).recognize()
                    ocr_text = " ".join(t for t, _, _ in chunks).strip()
                    tmp.unlink(missing_ok=True)
                    if len(ocr_text) >= MIN_TEXT_CHARS:
                        return ocr_text[:MAX_TEXT_CHARS], "pdf-ocr"
                except Exception:
                    tmp.unlink(missing_ok=True)
        except Exception:
            pass
        return "", "none"

    if ext in (".jpg", ".jpeg", ".png", ".heic", ".webp", ".tiff", ".bmp"):
        try:
            from ocrmac import ocrmac
            chunks = ocrmac.OCR(str(path)).recognize()
            text = " ".join(t for t, _, _ in chunks).strip()
            if len(text) >= MIN_TEXT_CHARS:
                return text[:MAX_TEXT_CHARS], "ocrmac"
        except Exception:
            pass
        # Image with no text — fall back to "photo" category without LLM call
        return "", "image-no-text"

    if ext in (".txt", ".md", ".csv", ".log", ".rtf"):
        try:
            text = path.read_text(errors="ignore")[:MAX_TEXT_CHARS].strip()
            if len(text) >= MIN_TEXT_CHARS:
                return text, "head"
        except Exception:
            pass
        return "", "none"

    return "", "unsupported-ext"


 def classify_with_ollama(text: str) -> dict:
    import urllib.request

    payload = {
        "model": OLLAMA_MODEL,
        "format": "json",
        "stream": False,
        "options": {"temperature": 0.1, "num_predict": 150},
        "messages": [
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": f"Text:\n{text}"},
        ],
    }
    req = urllib.request.Request(
        OLLAMA_URL,
        data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=60) as r:
        body = json.loads(r.read())
    content = body["message"]["content"].strip()
    return json.loads(content)


 def main():
    if len(sys.argv) != 2:
        emit({"category": "skip", "reason": "usage: classify-file.py <path>"})

    path = Path(sys.argv[1]).expanduser().resolve()
    if not path.is_file():
        emit({"category": "skip", "reason": "not-a-file"})

    if path.stat().st_size < 64:
        emit({"category": "skip", "reason": "too-small"})

    text, source = extract_text(path)

    if source == "image-no-text":
        # We can't classify visually right now (Qwen3-VL is unstable),
        # so route to ~/Pictures/inbox conservatively.
        emit({
            "category": "photo",
            "name": path.stem.lower().replace(" ", "-")[:50],
            "confidence": 0.5,
            "route": ROUTES["photo"],
            "source": source,
        })

    if not text or len(text) < MIN_TEXT_CHARS:
        emit({"category": "skip", "reason": f"no-text({source})"})

    ext = path.suffix.lower()
    file_kind = (
        "screenshot/image (text extracted via OCR)" if source == "ocrmac"
        else "scanned PDF (text via OCR of first page)" if source == "pdf-ocr"
        else "PDF with embedded text" if source == "pdftotext"
        else "plain text file"
    )
    hint = f"File-type hint: {file_kind}. Original filename: '{path.name}'."
    try:
        result = classify_with_ollama(hint + "\n\n" + text)
    except Exception as e:
        emit({"category": "skip", "reason": f"ollama-err: {type(e).__name__}: {e}"})

    cat = result.get("category", "").strip()
    if cat not in CATEGORIES:
        emit({"category": "skip", "reason": f"invalid-category: {cat!r}"})

    name = (result.get("name") or path.stem).strip()
    name = "".join(c for c in name if c.isascii()).replace(" ", "-").lower()[:50] or path.stem.lower()
    conf = float(result.get("confidence", 0))

    emit({
        "category": cat,
        "name": name,
        "confidence": conf,
        "route": ROUTES.get(cat),
        "source": source,
    })


 if __name__ == "__main__":
    main()
diff --git a/claude-file-history-guard.sh b/claude-file-history-guard.sh
 #!/bin/zsh
 # Weekly guard against ~/.claude/file-history growing unbounded
 # (Claude Code Issue #10107: file-history can cascade to hundreds of GB).
 #
 # Behavior: measures ~/.claude/file-history; if size > MAX_GB, prunes oldest
 # checkpoint directories until under threshold. Logs every run + posts a macOS
 # notification if a prune actually fired.
 #
 # Schedule: weekly via ~/Library/LaunchAgents/com.adam.claude-file-history-guard.plist.
 # Manual: zsh ~/.local-bin/claude-file-history-guard.sh
 # Dry-run: DRY_RUN=1 zsh ~/.local-bin/claude-file-history-guard.sh

 set -u
 MAX_GB=${MAX_GB:-2}
 TARGET="$HOME/.claude/file-history"
 LOG="$HOME/.local-ai/logs/claude-file-history-guard.log"
 DRY_RUN=${DRY_RUN:-0}

 mkdir -p "$(dirname "$LOG")"
 log() { print -P "[%D{%Y-%m-%d %H:%M:%S}] $1" >> "$LOG"; }

 [[ -d "$TARGET" ]] || { log "no target ($TARGET); nothing to do"; exit 0; }

 current_kb=$(du -sk "$TARGET" 2>/dev/null | awk '{print $1}')
 current_kb=${current_kb:-0}
 threshold_kb=$(( MAX_GB * 1024 * 1024 ))
 current_gb_display=$(printf "%.2f" $(( current_kb / 1024.0 / 1024.0 )))

 log "=== run start (DRY_RUN=$DRY_RUN, MAX_GB=$MAX_GB, current=${current_gb_display}GB) ==="

 if (( current_kb <= threshold_kb )); then
  log "OK: ${current_gb_display}GB <= ${MAX_GB}GB, no prune"
  log "=== run end ==="
  exit 0
 fi

 log "OVER: ${current_gb_display}GB > ${MAX_GB}GB, pruning oldest entries"

 # Sort children by mtime (oldest first), prune until size <= threshold.
 # Use -mindepth 1 -maxdepth 1 so we only delete top-level checkpoint dirs/files,
 # never the target itself.
 pruned=0
 freed_kb=0

 while IFS= read -r entry; do
  [[ -e "$entry" ]] || continue
  entry_kb=$(du -sk "$entry" 2>/dev/null | awk '{print $1}')
  entry_kb=${entry_kb:-0}

  if (( DRY_RUN )); then
    log "DRY prune: $entry (${entry_kb}KB)"
  else
    if rm -rf -- "$entry" 2>>"$LOG"; then
      log "pruned: $entry (${entry_kb}KB)"
      freed_kb=$(( freed_kb + entry_kb ))
      pruned=$(( pruned + 1 ))
    else
      log "FAILED to prune: $entry"
    fi
  fi

  remaining_kb=$(du -sk "$TARGET" 2>/dev/null | awk '{print $1}')
  remaining_kb=${remaining_kb:-0}
  (( remaining_kb <= threshold_kb )) && break
 done < <(
  find -H "$TARGET" -mindepth 1 -maxdepth 1 \
    -exec stat -f '%m %N' {} \; 2>/dev/null \
    | sort -n \
    | awk '{ $1=""; sub(/^ /,""); print }'
 )

 final_kb=$(du -sk "$TARGET" 2>/dev/null | awk '{print $1}')
 final_kb=${final_kb:-0}
 final_gb_display=$(printf "%.2f" $(( final_kb / 1024.0 / 1024.0 )))
 freed_gb_display=$(printf "%.2f" $(( freed_kb / 1024.0 / 1024.0 )))

 log "pruned $pruned entries, freed ${freed_gb_display}GB, now ${final_gb_display}GB"

 # Notify only if we actually pruned (not dry-run, > 0)
 if (( pruned > 0 && DRY_RUN == 0 )); then
  /usr/bin/osascript -e "display notification \"Pruned ${pruned} entries, freed ${freed_gb_display}GB. Now ${final_gb_display}GB / ${MAX_GB}GB cap.\" with title \"Claude file-history guard\"" 2>/dev/null
 fi

 log "=== run end ==="
diff --git a/com.adam.adhd-cleanup.plist b/com.adam.adhd-cleanup.plist
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.adam.adhd-cleanup</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/zsh</string>
        <string>/Users/adam/.local-bin/adhd-cleanup.sh</string>
    </array>
    <key>StartInterval</key>
    <integer>600</integer>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardOutPath</key>
    <string>/Users/adam/.local-ai/logs/adhd-cleanup.stdout.log</string>
    <key>StandardErrorPath</key>
    <string>/Users/adam/.local-ai/logs/adhd-cleanup.stderr.log</string>
    <key>ProcessType</key>
    <string>Background</string>
    <key>LowPriorityIO</key>
    <true/>
    <key>Nice</key>
    <integer>10</integer>
 </dict>
 </plist>
diff --git a/com.adam.claude-file-history-guard.plist b/com.adam.claude-file-history-guard.plist
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.adam.claude-file-history-guard</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/zsh</string>
        <string>/Users/adam/.local-bin/claude-file-history-guard.sh</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Weekday</key>
        <integer>0</integer>
        <key>Hour</key>
        <integer>3</integer>
        <key>Minute</key>
        <integer>15</integer>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>StandardOutPath</key>
    <string>/Users/adam/.local-ai/logs/claude-file-history-guard.stdout.log</string>
    <key>StandardErrorPath</key>
    <string>/Users/adam/.local-ai/logs/claude-file-history-guard.stderr.log</string>
    <key>ProcessType</key>
    <string>Background</string>
    <key>LowPriorityIO</key>
    <true/>
    <key>Nice</key>
    <integer>15</integer>
 </dict>
 </plist>
diff --git a/com.adam.nexus.plist b/com.adam.nexus.plist
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.adam.nexus</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/zsh</string>
        <string>/Users/adam/.local-ai/start-all.sh</string>
        <string>--no-open</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>ProcessType</key>
    <string>Background</string>
    <key>StandardOutPath</key>
    <string>/Users/adam/.local-ai/logs/launchagent.log</string>
    <key>StandardErrorPath</key>
    <string>/Users/adam/.local-ai/logs/launchagent.log</string>
 </dict>
 </plist>
diff --git a/local-ai-bench-1234.sh b/local-ai-bench-1234.sh
 #!/bin/zsh
 # Waits for the MLX coder server on :1234, then smoke-tests + benchmarks prefill/decode tok/s.
 set -u
 LOG=~/.local-ai/logs/bench-1234.log
 : > "$LOG"
 echo "[$(date +%T)] waiting for :1234 ..." | tee -a "$LOG"

 # Wait up to ~4h for the model to download + server to come up (slow link).
 for i in {1..2880}; do
  if curl -s --max-time 4 http://localhost:1234/v1/models >/dev/null 2>&1; then
    break
  fi
  sleep 5
 done

 MODELS_JSON=$(curl -s --max-time 8 http://localhost:1234/v1/models 2>/dev/null)
 if [ -z "$MODELS_JSON" ]; then
  echo "[$(date +%T)] FAIL: :1234 never came up. Last log lines:" | tee -a "$LOG"
  tail -n 25 ~/.local-ai/logs/vllm-mlx-1234.log | tee -a "$LOG"
  exit 1
 fi
 echo "[$(date +%T)] /v1/models => $MODELS_JSON" | tee -a "$LOG"

 MODEL_ID=$(echo "$MODELS_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['data'][0]['id'])" 2>/dev/null)
 echo "[$(date +%T)] served model id: $MODEL_ID" | tee -a "$LOG"

 # --- Smoke ---
 echo "[$(date +%T)] SMOKE:" | tee -a "$LOG"
 curl -s --max-time 120 http://localhost:1234/v1/chat/completions -H 'Content-Type: application/json' \
  -d "{\"model\":\"$MODEL_ID\",\"messages\":[{\"role\":\"user\",\"content\":\"Write a one-line Python function that reverses a string.\"}],\"max_tokens\":80}" \
  | tee -a "$LOG"
 echo "" | tee -a "$LOG"

 # --- Decode benchmark: short prompt, 256 tokens ---
 echo "[$(date +%T)] DECODE bench (short prompt, 256 new tokens):" | tee -a "$LOG"
 python3 - "$MODEL_ID" <<'PY' | tee -a "$LOG"
 import sys, json, time, urllib.request
 model=sys.argv[1]
 def call(prompt, max_tokens):
    body=json.dumps({"model":model,"messages":[{"role":"user","content":prompt}],"max_tokens":max_tokens,"temperature":0.0}).encode()
    req=urllib.request.Request("http://localhost:1234/v1/chat/completions",data=body,headers={"Content-Type":"application/json"})
    t=time.time(); r=json.load(urllib.request.urlopen(req,timeout=600)); dt=time.time()-t
    u=r.get("usage",{})
    return dt,u.get("prompt_tokens",0),u.get("completion_tokens",0)
 # decode: trivial prompt, generate 256
 dt,pt,ct=call("Count slowly: 1, 2, 3, and keep writing a long story about an M5 chip.",256)
 print(f"  decode: {ct} completion tokens in {dt:.2f}s => {ct/dt:.1f} tok/s (prompt_tokens={pt})")
 # prefill: long prompt (~3000 tokens), generate just 8
 longp=("Analyze the following text and summarize in one sentence.\n\n"+("The quick brown fox jumps over the lazy dog. "*450))
 dt2,pt2,ct2=call(longp,8)
 print(f"  prefill: {pt2} prompt tokens processed in {dt2:.2f}s (gen {ct2}) => ~{pt2/dt2:.0f} prompt tok/s (incl. {ct2} decode)")
 PY
 echo "[$(date +%T)] DONE." | tee -a "$LOG"
diff --git a/local-ai-coder-swap.sh b/local-ai-coder-swap.sh
 #!/bin/zsh
 # Waits for the heavy coder download to finish, then swaps :1234 from the 1.7B to the
 # heavy Qwen3-Coder-Next (served as qwen3-coder-mlx, so opencode/Open WebUI keep working).
 # Only touches the coder venv's serve (.venvs/vllm-mlx/bin) — leaves the :8000 vision server alone.
 LOG=~/.local-ai/logs/coder-swap.log; : > "$LOG"
 echo "[$(date '+%F %T')] waiting for heavy coder download to finish..." >> "$LOG"
 sleep 30
 while pgrep -f "hf download Eldadalbajob" >/dev/null 2>&1; do sleep 30; done
 sleep 5
 echo "[$(date '+%F %T')] download finished; restarting :1234 with the heavy coder" >> "$LOG"
 pkill -f ".venvs/vllm-mlx/bin/vllm-mlx serve" 2>/dev/null
 pkill -f "coder-up.sh" 2>/dev/null
 sleep 3
 nohup /bin/zsh "$HOME/.local-ai/coder-up.sh" >/dev/null 2>&1 &
 echo "[$(date '+%F %T')] coder-up relaunched (heavy model loads ~45GB; ready in ~1 min)" >> "$LOG"
diff --git a/local-ai-coder-up.sh b/local-ai-coder-up.sh
 #!/bin/zsh
 # Resilient chain: download the abliterated MLX coder (retry until complete), then serve on :1234.
 # Survives session end (launched via nohup). Logs to ~/.local-ai/logs/.
 export HF_HUB_DISABLE_XET=1          # classic HTTPS LFS — Xet stalls unauthenticated
 REPO=Eldadalbajob/Huihui-Qwen3-Coder-Next-abliterated-mlx-4Bit  # heavy abliterated MLX coder (44.9 GB). Fast fallback: mlx-community/Josiefied-Qwen3-1.7B-abliterated-v1-4bit
 BIN=~/.venvs/vllm-mlx/bin
 LOG=~/.local-ai/logs/coder-up.log
 echo "[$(date '+%F %T')] coder-up start; repo=$REPO" >> "$LOG"

 for i in {1..80}; do
  if "$BIN/hf" download "$REPO" >> ~/.local-ai/logs/dl-coder.log 2>&1; then
    echo "[$(date '+%F %T')] download complete on attempt $i" >> "$LOG"
    break
  fi
  echo "[$(date '+%F %T')] download attempt $i incomplete (slow link); resuming in 15s" >> "$LOG"
  sleep 15
 done

 echo "[$(date '+%F %T')] starting vllm-mlx serve on :1234" >> "$LOG"
 exec "$BIN/vllm-mlx" serve "$REPO" --served-model-name qwen3-coder-mlx --port 1234 \
  --continuous-batching --enable-prefix-cache --enable-metrics \
  >> ~/.local-ai/logs/vllm-mlx-1234.log 2>&1
diff --git a/local-ai-dt-a1111-shim.py b/local-ai-dt-a1111-shim.py
 #!/usr/bin/env python3
 """A1111-compatibility shim for Draw Things.

 Open WebUI's automatic1111 image engine expects a full AUTOMATIC1111 /sdapi/v1 API.
 Draw Things (:7860) implements txt2img + options but with its OWN schema (no
 'sd_model_checkpoint') and 404s on sd-models/samplers/progress. This proxy sits on
 :7861, forwards to DT, and patches exactly the two spots Open WebUI v0.9.5 reads:
  * GET  /sdapi/v1/options  -> inject 'sd_model_checkpoint'  (else KeyError -> HTTP 400)
  * POST /sdapi/v1/txt2img  -> ensure response has 'info'     (else KeyError after images)
 Plus harmless stubs for sd-models/samplers/progress and a pass-through for anything else.
 No third-party deps (stdlib only).
 """
 import json, urllib.request, urllib.error
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

 DT = "http://localhost:7860"
 PORT = 7861

 def dt(method, path, body=None, timeout=600):
    req = urllib.request.Request(DT + path, data=body, method=method)
    req.add_header("Content-Type", "application/json")
    with urllib.request.urlopen(req, timeout=timeout) as r:
        return r.status, r.read()

 class H(BaseHTTPRequestHandler):
    protocol_version = "HTTP/1.1"
    def log_message(self, *a):
        pass

    def _send(self, code, obj=None, raw=None):
        data = raw if raw is not None else json.dumps({} if obj is None else obj).encode()
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_GET(self):
        p = self.path.split("?", 1)[0]
        if p == "/sdapi/v1/options":
            try:
                _, body = dt("GET", "/sdapi/v1/options", timeout=15)
                opt = json.loads(body)
            except Exception:
                opt = {}
            opt.setdefault("sd_model_checkpoint", opt.get("model") or "DrawThings")
            return self._send(200, opt)
        if p == "/sdapi/v1/sd-models":
            return self._send(200, [{"title": "DrawThings", "model_name": "DrawThings",
                                     "hash": None, "sha256": None, "filename": None, "config": None}])
        if p == "/sdapi/v1/samplers":
            return self._send(200, [{"name": n, "aliases": [], "options": {}}
                                    for n in ["Euler a", "Euler", "DPM++ 2M", "DDIM"]])
        if p == "/sdapi/v1/progress":
            return self._send(200, {"progress": 0.0, "eta_relative": 0.0, "state": {},
                                    "current_image": None, "textinfo": None})
        try:
            st, body = dt("GET", p, timeout=30)
            return self._send(st, raw=body)
        except urllib.error.HTTPError as e:
            return self._send(e.code, raw=e.read())
        except Exception:
            return self._send(200, {})

    def do_POST(self):
        p = self.path.split("?", 1)[0]
        n = int(self.headers.get("Content-Length") or 0)
        body = self.rfile.read(n) if n else None
        if p == "/sdapi/v1/options":
            return self._send(200, {})  # no-op; Open WebUI swallows failures here
        if p == "/sdapi/v1/txt2img":
            try:
                _, out = dt("POST", "/sdapi/v1/txt2img", body=body, timeout=600)
                res = json.loads(out)
            except Exception as e:
                return self._send(500, {"error": str(e)})
            res.setdefault("info", "{}")
            res.setdefault("parameters", {})
            return self._send(200, res)
        try:
            st, out = dt("POST", p, body=body, timeout=600)
            return self._send(st, raw=out)
        except urllib.error.HTTPError as e:
            return self._send(e.code, raw=e.read())
        except Exception:
            return self._send(200, {})

 if __name__ == "__main__":
    ThreadingHTTPServer(("127.0.0.1", PORT), H).serve_forever()
diff --git a/local-ai-make-icon.py b/local-ai-make-icon.py
 #!/usr/bin/env python3
 # Nexus app icon — minimalist Apple-style: rounded-square, indigo->violet diagonal
 # gradient, subtle top sheen, white "network hub" glyph (central node + 6 satellites).
 import math, os
 import numpy as np
 from PIL import Image, ImageDraw

 S = 1024          # final size
 SS = 2            # supersample factor
 W = S * SS

 # --- diagonal gradient (top-left light indigo -> bottom-right deep violet) ---
 top = np.array([124, 140, 255], dtype=float)   # #7C8CFF
 bot = np.array([ 58,  47, 150], dtype=float)    # #3A2F96
 xs = np.linspace(0, 1, W)
 gx, gy = np.meshgrid(xs, xs)
 t = (gx + gy) / 2.0
 arr = (top[None, None, :] + (bot - top)[None, None, :] * t[:, :, None]).astype("uint8")
 grad = Image.fromarray(arr, "RGB").convert("RGBA")

 # --- rounded-square mask (Apple ~22.37% corner radius) ---
 mask = Image.new("L", (W, W), 0)
 ImageDraw.Draw(mask).rounded_rectangle([0, 0, W - 1, W - 1], radius=int(0.2237 * W), fill=255)

 img = Image.new("RGBA", (W, W), (0, 0, 0, 0))
 img.paste(grad, (0, 0), mask)

 # --- subtle top sheen for depth ---
 overlay = Image.new("RGBA", (W, W), (0, 0, 0, 0))
 ImageDraw.Draw(overlay).ellipse(
    [int(-0.25 * W), int(-0.62 * W), int(1.25 * W), int(0.42 * W)], fill=(255, 255, 255, 26))
 overlay = Image.composite(overlay, Image.new("RGBA", (W, W), (0, 0, 0, 0)), mask)
 img = Image.alpha_composite(img, overlay)

 # --- network-hub glyph ---
 d = ImageDraw.Draw(img)
 cx = cy = W // 2
 R   = int(0.225 * W)     # satellite ring radius
 nc  = int(0.070 * W)     # central node radius
 ns  = int(0.042 * W)     # satellite radius
 lw  = int(0.013 * W)     # spoke width

 pts = []
 for k in range(6):
    a = math.radians(60 * k - 90)
    pts.append((cx + R * math.cos(a), cy + R * math.sin(a)))

 # faint hexagon ring connecting satellites
 for i in range(6):
    x1, y1 = pts[i]; x2, y2 = pts[(i + 1) % 6]
    d.line([x1, y1, x2, y2], fill=(255, 255, 255, 110), width=int(lw * 0.7))
 # spokes center -> satellites
 for (x, y) in pts:
    d.line([cx, cy, x, y], fill=(255, 255, 255, 235), width=lw)
 # satellite nodes
 for (x, y) in pts:
    d.ellipse([x - ns, y - ns, x + ns, y + ns], fill=(255, 255, 255, 255))
 # central node (with a faint halo)
 d.ellipse([cx - nc * 1.5, cy - nc * 1.5, cx + nc * 1.5, cy + nc * 1.5], fill=(255, 255, 255, 40))
 d.ellipse([cx - nc, cy - nc, cx + nc, cy + nc], fill=(255, 255, 255, 255))

 # --- downscale (anti-alias) + save ---
 out = img.resize((S, S), Image.LANCZOS)
 path = os.path.expanduser("~/.local-ai/nexus-1024.png")
 out.save(path)
 print("wrote", path, out.size)
diff --git a/local-ai-owui-token.sh b/local-ai-owui-token.sh
 #!/bin/zsh
 # Prints a valid Open WebUI bearer token (signed with the local secret) for the admin user.
 python3 - <<'PY'
 import hmac,hashlib,base64,json,sqlite3,os
 sec=open(os.path.expanduser('~/.open-webui/.webui_secret_key')).read().strip()
 u=sqlite3.connect(os.path.expanduser('~/.open-webui/webui.db')).execute("select id from user limit 1").fetchone()
 b=lambda x:base64.urlsafe_b64encode(x).rstrip(b'=')
 h=b(b'{"alg":"HS256","typ":"JWT"}');p=b(json.dumps({"id":u[0]},separators=(',',':')).encode())
 print((h+b'.'+p+b'.'+b(hmac.new(sec.encode(),h+b'.'+p,hashlib.sha256).digest())).decode())
 PY
diff --git a/local-ai-start-all.sh b/local-ai-start-all.sh
 #!/bin/zsh
 # Nexus — launch the whole local-AI stack, then open the UI.
 # Idempotent: only starts what isn't already running. Safe to run repeatedly.
 export PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH
 LOG="$HOME/.local-ai/logs"; mkdir -p "$LOG"
 DOCKER=/Applications/OrbStack.app/Contents/MacOS/xbin/docker
 up() { curl -s --max-time 3 "$1" >/dev/null 2>&1; }
 note() { echo "[$(date +%T)] $1" >> "$LOG/start-all.log"; }
 : > "$LOG/start-all.log"; note "Nexus start"

 # 1) Ollama (brew service)
 up http://localhost:11434/api/tags || { note "starting ollama"; brew services start ollama >/dev/null 2>&1; }

 # 2) MLX coder server :1234  (download-then-serve chain; serves instantly if cached)
 up http://localhost:1234/v1/models || { note "starting MLX :1234"; nohup /bin/zsh "$HOME/.local-ai/coder-up.sh" >/dev/null 2>&1 & }

 # 2b) MLX vision server :8000 — Qwen3-VL (image understanding; model cached). Offline = no online checks.
 up http://localhost:8000/v1/models || { note "starting MLX vision :8000"; nohup env HF_HUB_OFFLINE=1 HF_HUB_DISABLE_XET=1 "$HOME/.venvs/vllm-mlx-vision/bin/vllm-mlx" serve mlx-community/Qwen3-VL-30B-A3B-Instruct-8bit --port 8000 > "$LOG/vllm-mlx-vision-8000.log" 2>&1 & }

 # 3) mlx-audio TTS :8001
 /usr/sbin/lsof -nP -iTCP:8001 -sTCP:LISTEN >/dev/null 2>&1 || { note "starting mlx-audio :8001"; cd "$LOG" && nohup env HF_HUB_OFFLINE=1 HF_HUB_DISABLE_XET=1 "$HOME/.local/bin/mlx_audio.server" --port 8001 --log-dir "$LOG" > "$LOG/mlx-audio-8001.log" 2>&1 & cd - >/dev/null; }

 # 4) OrbStack engine + SearXNG :8888
 if ! "$DOCKER" version >/dev/null 2>&1; then
  note "starting OrbStack"; open -a OrbStack
  for i in {1..45}; do "$DOCKER" version >/dev/null 2>&1 && break; sleep 2; done
 fi
 up "http://localhost:8888/search?q=x&format=json" || { note "starting SearXNG"; "$DOCKER" start searxng >/dev/null 2>&1; }

 # 4b) Draw Things A1111-compat shim :7861 (lets Open WebUI image gen drive Draw Things :7860)
 up http://localhost:7861/sdapi/v1/sd-models || { note "starting DT shim :7861"; nohup python3 "$HOME/.local-ai/dt-a1111-shim.py" > "$LOG/dt-shim-7861.log" 2>&1 & }

 # 5) Open WebUI :8080
 up http://localhost:8080/health || { note "starting Open WebUI :8080"; nohup /bin/zsh "$HOME/.local-ai/webui-up.sh" > "$LOG/open-webui-8080.log" 2>&1 & }

 # wait for the UI, then open it
 note "waiting for :8080"
 for i in {1..150}; do up http://localhost:8080/health && break; sleep 2; done
 if [[ "$1" != "--no-open" && "$NEXUS_NO_OPEN" != "1" ]]; then
  note "opening browser"; open "http://localhost:8080"
 fi
 note "done"
diff --git a/local-ai-stop-all.sh b/local-ai-stop-all.sh
 #!/bin/zsh
 # Nexus — stop the local-AI stack cleanly. Leaves the Ollama service running
 # (it's the lightweight base) but unloads its models to free RAM.
 export PATH=/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH
 LOG="$HOME/.local-ai/logs"; mkdir -p "$LOG"
 DOCKER=/Applications/OrbStack.app/Contents/MacOS/xbin/docker
 note() { echo "[$(date +%T)] $1" >> "$LOG/stop-all.log"; }
 : > "$LOG/stop-all.log"; note "Nexus stop"

 pkill -f "open-webui serve" 2>/dev/null && note "stopped Open WebUI"
 pkill -f "coder-up.sh"  2>/dev/null
 pkill -f "vision-up.sh" 2>/dev/null
 pkill -f "bench-1234.sh" 2>/dev/null
 pkill -f "vllm-mlx serve" 2>/dev/null && note "stopped MLX servers"
 pkill -f "mlx_audio.server" 2>/dev/null && note "stopped TTS"
 "$DOCKER" stop searxng >/dev/null 2>&1 && note "stopped SearXNG"

 # free Ollama RAM by unloading loaded models (keep the service itself running)
 for m in $(ollama ps 2>/dev/null | awk 'NR>1{print $1}'); do ollama stop "$m" >/dev/null 2>&1; done
 note "done"

 osascript -e 'display notification "All local-AI services stopped." with title "Nexus" sound name "Submarine"' 2>/dev/null
diff --git a/local-ai-test-websearch.sh b/local-ai-test-websearch.sh
 #!/bin/zsh
 # Headless test of Open WebUI v0.9.5 SearXNG web search.
 # Usage: TOKEN=<your_api_key_or_jwt> ./test-websearch.sh
 # Get TOKEN from: Open WebUI -> Settings -> Account -> API Keys (or copy the JWT from browser localStorage).
 set -e
 : "${TOKEN:?Set TOKEN to a bearer token (API key from Settings > Account, or a JWT)}"
 BASE="${BASE:-http://127.0.0.1:8080}"

 echo "=== 0. SearXNG itself returns JSON results ==="
 curl -s "http://localhost:8888/search?q=apple+m5+max&format=json" \
  | python3 -c "import sys,json;d=json.load(sys.stdin);print('searxng results:',len(d.get('results',[])))"

 echo "=== 1. Server-side web search endpoint (the real test) ==="
 # Required body = SearchForm: {"queries": [ ... ]}  (queries is an ARRAY, required)
 curl -sS -X POST "$BASE/api/v1/retrieval/process/web/search" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queries": ["what is the Apple M5 Max chip"]}' \
  -w "\nHTTP %{http_code}\n"

 echo "=== 2. (optional) End-to-end via chat completions with web_search feature ==="
 curl -sS -X POST "$BASE/api/chat/completions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3-coder-mlx","messages":[{"role":"user","content":"What is todays date in London?"}],"stream":false,"features":{"web_search":true}}' \
  -w "\nHTTP %{http_code}\n" | python3 -c "import sys,json;d=json.load(sys.stdin);print('has sources:', bool(d.get('sources')))" 2>/dev/null || true
diff --git a/local-ai-vision-mcp.py b/local-ai-vision-mcp.py
 #!/usr/bin/env python3
 """Vision MCP server for opencode/crush — reads local images with the local Qwen3-VL model.

 opencode's native image attachment to custom OpenAI-compatible providers is broken
 (anomalyco/opencode#20802), so this MCP tool is the reliable offline path: it base64-encodes
 a local image and POSTs an OpenAI multimodal (image_url) request to the local vision server
 at :8000, returning the model's text answer. Fully offline (localhost only).
 """
 import base64, json, os, urllib.request
 from mcp.server.fastmcp import FastMCP

 VISION_URL = "http://localhost:8000/v1/chat/completions"
 MODEL = "mlx-community/Qwen3-VL-30B-A3B-Instruct-8bit"

 mcp = FastMCP("vision")

 @mcp.tool()
 def describe_image(path: str, question: str = "Describe this image in detail.") -> str:
    """Look at / read a LOCAL image file and answer a question about it using the local
    vision model. `path` = path to an image file (png/jpg/webp/gif). `question` = what to ask
    about the image (e.g. 'what does this UI mockup show?', 'transcribe the text', 'what's wrong?')."""
    p = os.path.expanduser(path.strip())
    if not os.path.isfile(p):
        return f"ERROR: file not found: {p}"
    ext = (os.path.splitext(p)[1].lstrip(".") or "png").lower()
    if ext == "jpg":
        ext = "jpeg"
    with open(p, "rb") as f:
        data_uri = f"data:image/{ext};base64," + base64.b64encode(f.read()).decode()
    body = json.dumps({
        "model": MODEL,
        "messages": [{"role": "user", "content": [
            {"type": "text", "text": question},
            {"type": "image_url", "image_url": {"url": data_uri}},
        ]}],
        "max_tokens": 1024, "temperature": 0.2,
    }).encode()
    req = urllib.request.Request(VISION_URL, data=body, headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=300) as r:
            d = json.load(r)
        return d["choices"][0]["message"]["content"]
    except Exception as e:
        return f"ERROR calling local vision model at {VISION_URL}: {e}. Is the :8000 server running? (start-all.sh starts it)"

 if __name__ == "__main__":
    mcp.run()
diff --git a/local-ai-vision-up.sh b/local-ai-vision-up.sh
 #!/bin/zsh
 # Resilient chain for the Qwen3-VL vision backend on :8000.
 # Waits until the coder backend (:1234) is live so the two big downloads don't fight the slow
 # link, then downloads (retry-until-complete) and serves the vision model. Survives session end.
 export HF_HUB_DISABLE_XET=1
 REPO=mlx-community/Qwen3-VL-30B-A3B-Instruct-8bit
 BIN=~/.venvs/vllm-mlx-vision/bin
 LOG=~/.local-ai/logs/vision-up.log
 echo "[$(date '+%F %T')] vision-up start; waiting for coder :1234 to be live first" >> "$LOG"

 for i in {1..5760}; do
  curl -s --max-time 4 http://localhost:1234/v1/models >/dev/null 2>&1 && break
  sleep 15
 done
 echo "[$(date '+%F %T')] coder :1234 up — beginning vision download" >> "$LOG"

 for i in {1..120}; do
  if "$BIN/hf" download "$REPO" >> ~/.local-ai/logs/dl-vision.log 2>&1; then
    echo "[$(date '+%F %T')] vision download complete on attempt $i" >> "$LOG"
    break
  fi
  echo "[$(date '+%F %T')] vision download attempt $i incomplete (slow link); resuming in 15s" >> "$LOG"
  sleep 15
 done

 echo "[$(date '+%F %T')] starting vllm-mlx vision serve on :8000" >> "$LOG"
 exec "$BIN/vllm-mlx" serve "$REPO" --port 8000 \
  >> ~/.local-ai/logs/vllm-mlx-vision-8000.log 2>&1
diff --git a/local-ai-webui-up.sh b/local-ai-webui-up.sh
 #!/bin/zsh
 # Open WebUI launcher — best local config:
 #   - auth ON with a persistent secret key (log in once, stay logged in), bound to 127.0.0.1 only
 #   - telemetry OFF; wired to Ollama (:11434) + MLX (:1234)
 #   - web search (SearXNG :8888), audio (mlx-audio :8001 TTS+STT), image-gen (Draw Things :7860)
 export DATA_DIR="$HOME/.open-webui"
 mkdir -p "$DATA_DIR"

 SECRET_FILE="$DATA_DIR/.webui_secret_key"
 [ -f "$SECRET_FILE" ] || openssl rand -hex 32 > "$SECRET_FILE"
 export WEBUI_SECRET_KEY="$(cat "$SECRET_FILE")"

 # Auth stays ON, but the persistent WEBUI_SECRET_KEY above keeps your session valid
 # across restarts → you log in ONCE (adx93@icloud.com) and stay logged in.
 export JWT_EXPIRES_IN=-1                       # token never expires (no surprise logouts)
 # Ollama via its NATIVE API (no dupes); the OpenAI slot is reserved for the MLX backend only.
 export ENABLE_OLLAMA_API=true
 export OLLAMA_BASE_URL="http://localhost:11434"
 export ENABLE_OPENAI_API=true
 # MLX coder (:1234) + MLX vision Qwen3-VL (:8000, when running). Ollama is on its native API above.
 export OPENAI_API_BASE_URLS="http://localhost:1234/v1;http://localhost:8000/v1"
 export OPENAI_API_KEYS="not-required;not-required"
 export ANONYMIZED_TELEMETRY=false
 export DO_NOT_TRACK=true
 export SCARF_NO_ANALYTICS=true
 export OFFLINE_MODE=false                      # internet allowed (required for web search)
 export ENABLE_VERSION_UPDATE_CHECK=false       # ...but still no version pings

 # --- Web search via local SearXNG (names verified vs Open WebUI 0.9.5 source) ---
 export ENABLE_WEB_SEARCH=true
 export WEB_SEARCH_ENGINE=searxng
 export SEARXNG_QUERY_URL="http://localhost:8888/search?q=<query>"   # <query> token required; format=json auto-added
 export WEB_SEARCH_RESULT_COUNT=5
 export WEB_SEARCH_CONCURRENT_REQUESTS=10
 # Feed results straight to the model (no embedding/vectorDB dependency -> no silent "empty" failures):
 export BYPASS_WEB_SEARCH_EMBEDDING_AND_RETRIEVAL=true
 export BYPASS_WEB_SEARCH_WEB_LOADER=true        # use SearXNG snippets, skip per-page fetch (faster/robust)
 export ENABLE_WEB_LOADER_SSL_VERIFICATION=true

 # --- Audio: TTS + STT via local mlx-audio (:8001, OpenAI-compatible) ---
 export AUDIO_TTS_ENGINE=openai
 export AUDIO_TTS_OPENAI_API_BASE_URL="http://localhost:8001/v1"
 export AUDIO_TTS_OPENAI_API_KEY="not-required"
 export AUDIO_TTS_MODEL="mlx-community/Kokoro-82M-bf16"
 export AUDIO_TTS_VOICE="af_heart"
 # STT: Open WebUI's built-in local faster-whisper. (mlx-audio's parakeet transcribe route is
 # broken in this build: "No module named mlx_audio.tts.models.parakeet_tdt_0".) Small model, downloads once.
 export AUDIO_STT_ENGINE=""
 export WHISPER_MODEL="base"

 # --- Image generation via Draw Things (:7860) through the A1111-compat shim (:7861) ---
 # DT's API omits sd_model_checkpoint; ~/.local-ai/dt-a1111-shim.py patches that so Open WebUI works.
 # Requires once: Draw Things.app -> Advanced -> API Server ON, Protocol=HTTP, Port=7860.
 export ENABLE_IMAGE_GENERATION=true
 export IMAGE_GENERATION_ENGINE=automatic1111
 export AUTOMATIC1111_BASE_URL="http://localhost:7861"
 export IMAGE_SIZE=512x512
 export IMAGE_STEPS=8
 # (Leave IMAGE_GENERATION_MODEL unset — select the model inside Draw Things; the A1111 override is flaky.)

 exec uvx --python 3.11 open-webui@latest serve --host 127.0.0.1 --port 8080
diff --git a/local.adam.nexus.plist b/local.adam.nexus.plist
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key>            <string>local.adam.nexus</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/open</string>
        <string>-a</string>
        <string>/Applications/Nexus.app</string>
    </array>
    <key>RunAtLoad</key>        <true/>
    <key>KeepAlive</key>        <false/>
    <key>ProcessType</key>      <string>Interactive</string>
 </dict>
 </plist>
diff --git a/SESSION-HANDOFF.md b/SESSION-HANDOFF.md
diff --git a/setup.sh b/setup.sh
 #!/usr/bin/env zsh
 # ============================================================
 #  Adam M5 Max — fully automated setup
 #
 #  Usage (one command):
 #    ./setup.sh
 #
 #  What it does (idempotent — safe to re-run):
 #    0. Checks prerequisites (Xcode CLT, Homebrew)
 #    1. Creates folder structure (numbered ~/N_* dirs)
 #    2. Runs brew bundle install (Brewfile must be in same dir)
 #    3. Pins mise language versions + activates in this shell
 #    4. Installs npm globals (after Node exists)
 #    5. Installs Python tools via uv (Slither, Halmos, Wake)
 #    6. Installs Foundry via official curl installer
 #    7. Writes ALL config files (~/.zshrc, ~/.gitconfig, ~/.config/*)
 #    8. Generates SSH key + uploads to GitHub (incl. SSH agent + Keychain)
 #    9. Sets macOS defaults (Finder, dock, key repeat)
 #   10. Disables Spotlight ⌘+Space hotkey
 #   11. Starts Ollama + pulls base models in background
 #   12. Downloads Whisper model with size verification
 #   13. Sets GPU memory cap (sysctl live + LaunchDaemon for reboot persistence)
 #   14. Scaffolds MLX project + Python venv
 #   15. Wires fzf keybindings
 #   (then prints remaining manual steps — OAuth logins, license keys)
 # ============================================================

 set -u   # error on unset vars (no `set -e` — we handle errors per-step)

 # Colors
 C_GREEN='\033[0;32m'
 C_BLUE='\033[0;34m'
 C_YELLOW='\033[0;33m'
 C_RED='\033[0;31m'
 C_RESET='\033[0m'

 step() { echo -e "\n${C_BLUE}▶ $1${C_RESET}"; }
 ok()   { echo -e "  ${C_GREEN}✓${C_RESET} $1"; }
 warn() { echo -e "  ${C_YELLOW}⚠${C_RESET} $1"; }
 err()  { echo -e "  ${C_RED}✗${C_RESET} $1"; }

 # Backup an existing file before overwriting
 backup_if_exists() {
  local file="$1"
  if [ -f "$file" ]; then
    cp "$file" "${file}.bak-$(date +%s)"
    warn "Backed up existing $file → ${file}.bak-*"
  fi
 }

 # ============================================================
 # 0. Prerequisites
 # ============================================================
 step "0. Checking prerequisites"

 if ! xcode-select -p &> /dev/null; then
  err "Xcode CLI tools not installed. Run: xcode-select --install"
  exit 1
 fi
 ok "Xcode CLI tools ready"

 if ! command -v brew &> /dev/null; then
  err "Homebrew not installed. Run: /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""
  exit 1
 fi
 ok "Homebrew ready"

 if [ "$(uname -m)" != "arm64" ]; then
  err "This script is for Apple Silicon Macs (M1/M2/M3/M4/M5)"
  exit 1
 fi
 ok "Apple Silicon detected"

 # ============================================================
 # 1. Folder structure (numbered for ADHD Finder ordering)
 # ============================================================
 step "1. Creating folder structure"
 mkdir -p ~/0_INBOX ~/1_PROJECTS ~/2_KNOWLEDGE ~/3_ADMIN ~/9_ARCHIVE ~/backup
 mkdir -p ~/Pictures/Screenshots ~/.config
 mkdir -p ~/.config/{ghostty,atuin,mise} ~/.claude
 ok "Folder tree ready"

 # ============================================================
 # 2. Brewfile install (all CLI + GUI apps)
 # ============================================================
 step "2. Installing everything from Brewfile"
 if [ -f "$(dirname "$0")/Brewfile" ]; then
  brew bundle install --file="$(dirname "$0")/Brewfile"
  ok "Brewfile installed (~30 formulae + ~25 casks)"
 else
  warn "Brewfile not found alongside setup.sh — skipping brew bundle"
  warn "Make sure you cloned the full gist: git clone https://gist.github.com/fad46568b34a09bf453fd48a57123252.git ~/m5-setup"
 fi

 # ============================================================
 # 3. mise — pin language versions, activate inline
 # ============================================================
 step "3. Setting up mise (polyglot version manager)"
 mise use --global node@lts python@3.13 rust@stable go@latest
 # Activate mise in THIS shell so npm/python/etc are on PATH
 eval "$(mise activate zsh)"
 ok "mise active — node $(node --version 2>/dev/null), python $(python --version 2>/dev/null | awk '{print $2}')"

 # ============================================================
 # 4. npm globals (NOW node exists)
 # ============================================================
 step "4. Installing npm globals"
 npm install -g @anthropic-ai/claude-code vercel pnpm 2>&1 | tail -5
 ok "Claude Code + Vercel + pnpm installed"

 # opencode — local agentic coding TUI (drives local Ollama/MLX models; see §22.5 / §23)
 command -v opencode >/dev/null 2>&1 || curl -fsSL https://opencode.ai/install | bash
 command -v opencode >/dev/null 2>&1 && ok "opencode installed (local Claude-Code-like TUI)"

 # ============================================================
 # 5. Python tools via uv (Solidity stack)
 # ============================================================
 step "5. Installing Solidity Python tools"
 uv tool install slither-analyzer 2>&1 | tail -1
 uv tool install halmos 2>&1 | tail -1
 uv tool install eth-wake 2>&1 | tail -1   # PyPI name is eth-wake, NOT wake
 ok "Slither + Halmos + Wake installed"

 # ============================================================
 # 6. Foundry (Ethereum toolkit — official curl installer)
 # ============================================================
 step "6. Installing Foundry"
 if ! command -v foundryup &> /dev/null; then
  curl -L https://foundry.paradigm.xyz | bash
  export PATH="$HOME/.foundry/bin:$PATH"
  foundryup
  ok "Foundry installed (forge/cast/anvil/chisel)"
 else
  ok "Foundry already installed"
 fi

 # ============================================================
 # 7. Write config files (with backup of existing)
 # ============================================================
 step "7. Writing config files"

 # --- ~/.zshrc ---
 backup_if_exists ~/.zshrc
 cat > ~/.zshrc <<'ZSHRC'
 # ============================================================
 #  ~/.zshrc — M5 Max (auto-generated by setup.sh)
 # ============================================================

 # ----- PATH -----
 export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:$PATH"
 export PATH="$HOME/.local/bin:$PATH"           # uv tools
 export PATH="$HOME/.foundry/bin:$PATH"         # Foundry

 # ----- Antidote: zsh plugin manager -----
 source $(brew --prefix)/opt/antidote/share/antidote/antidote.zsh
 antidote load << 'EOF'
 zsh-users/zsh-autosuggestions
 zsh-users/zsh-syntax-highlighting
 zsh-users/zsh-completions
 zdharma-continuum/fast-syntax-highlighting
 EOF

 # ----- Prompt + interactive tools -----
 eval "$(starship init zsh)"
 eval "$(zoxide init zsh)"
 eval "$(atuin init zsh)"
 eval "$(mise activate zsh)"
 eval "$(direnv hook zsh)"
 [ -f ~/.fzf.zsh ] && source ~/.fzf.zsh

 # ----- Claude Code (Ghostty paste workaround for issue #54700) -----
 if [ "$TERM_PROGRAM" = "ghostty" ]; then
  alias cc='TERM=xterm-256color claude'
 else
  alias cc='claude'
 fi
 export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
 export CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY=15
 export CLAUDE_CODE_DISABLE_TERMINAL_TITLE=1
 export CLAUDE_CODE_EFFORT_LEVEL=xhigh
 export BASH_DEFAULT_TIMEOUT_MS=300000

 # NOTE: do NOT set ANTHROPIC_BASE_URL — the `claude` CLI must stay on Anthropic cloud
 # (Claude Max subscription). Local-model coding uses a SEPARATE tool (opencode / Cursor
 # / Cline / Aider), wired to Ollama at localhost:11434 via that tool's own config — never
 # by repointing claude. See walkthrough §22.5 for the local-AI lane setup.

 # ----- HF token via 1Password (uncomment after 1P CLI setup) -----
 # export HF_TOKEN="$(op item get 'HuggingFace' --field credential 2>/dev/null)"

 # ----- Aliases -----
 alias ls='eza --icons --git'
 alias ll='eza -la --icons --git'
 alias lt='eza --tree --level=2 --icons'
 alias cat='bat --paging=never'
 alias grep='rg'
 alias find='fd'
 alias top='btop'
 alias du='dust'
 alias df='duf'
 alias g='git'
 alias lg='lazygit'
 alias gst='git status'
 alias gco='git checkout'
 alias gp='git push'
 alias gpl='git pull'
 alias dev='cd ~/1_PROJECTS'
 alias bl='cd ~/projects/bounty-lab'
 alias kb='cd ~/2_KNOWLEDGE'

 # ----- MLX max-power functions -----
 mlx_max() {
  export MLX_METAL_FAST_SYNCH=1
  defaults write NSGlobalDomain NSAppSleepDisabled -bool YES
  caffeinate -di &
  echo "MLX max: fast sync ON, sleep OFF, caffeinate"
 }
 mlx_revert() {
  unset MLX_METAL_FAST_SYNCH
  defaults delete NSGlobalDomain NSAppSleepDisabled
  pkill caffeinate 2>/dev/null
  echo "MLX max reverted"
 }

 # ----- fzf theme: Neon Noir -----
 export FZF_DEFAULT_OPTS="
  --color=bg+:#15151F,bg:#0A0A14,spinner:#FF006E,hl:#00D4FF
  --color=fg:#F5F5F7,header:#00D4FF,info:#7C3AED,pointer:#FF006E
  --color=marker:#34D399,fg+:#F5F5F7,prompt:#00D4FF,hl+:#FF006E
 "
 ZSHRC
 ok "~/.zshrc written"

 # --- ~/.gitconfig ---
 backup_if_exists ~/.gitconfig
 cat > ~/.gitconfig <<'GITCONFIG'
 [user]
    name = Adam Boudjemaa
    email = boudjemaa.adam@gmail.com
    signingkey = ~/.ssh/id_ed25519.pub
 [gpg]
    format = ssh
 [gpg "ssh"]
    program = /Applications/1Password.app/Contents/MacOS/op-ssh-sign
 [commit]
    gpgsign = true
 [init]
    defaultBranch = main
 [pull]
    rebase = false
 [push]
    autoSetupRemote = true
    default = current
 [fetch]
    prune = true
 [merge]
    conflictstyle = zdiff3
 [diff]
    algorithm = histogram
    colorMoved = default
 [color]
    ui = auto
 [alias]
    st = status
    co = checkout
    br = branch
    cm = commit -m
    lg = log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit
    last = log -1 HEAD
    unstage = reset HEAD --
    amend = commit --amend --no-edit
    sw = switch
    ll = log --oneline -20
 GITCONFIG
 ok "~/.gitconfig written (SSH commit signing via 1Password ready)"

 # --- ~/.config/starship.toml ---
 backup_if_exists ~/.config/starship.toml
 cat > ~/.config/starship.toml <<'STARSHIP'
 "$schema" = "https://starship.rs/config-schema.json"

 format = """
 [](#7C3AED)\
 $os$username\
 [](bg:#0A0A14 fg:#7C3AED)\
 $directory\
 [](fg:#0A0A14 bg:#0A0A14)\
 $git_branch$git_status\
 [](fg:#0A0A14 bg:#0A0A14)\
 $nodejs$python$rust$golang\
 [](fg:#0A0A14 bg:#15151F)\
 $time\
 [ ](fg:#15151F)\
 $line_break$character"""

 palette = "neon_noir"

 [palettes.neon_noir]
 cyan = "#00D4FF"
 magenta = "#FF006E"
 violet = "#7C3AED"
 green = "#34D399"
 dark = "#0A0A14"
 surface = "#15151F"

 [character]
 success_symbol = "[❯](bold cyan)"
 error_symbol = "[❯](bold magenta)"

 [directory]
 style = "bold cyan"
 truncation_length = 3
 truncate_to_repo = true

 [git_branch]
 style = "bold magenta"
 symbol = " "

 [git_status]
 style = "bold magenta"

 [time]
 disabled = false
 format = '[ $time ]($style)'
 style = "fg:#71717A"
 time_format = "%H:%M"

 [cmd_duration]
 min_time = 500
 format = "[took $duration]($style) "
 style = "fg:#FBBF24"
 STARSHIP
 ok "~/.config/starship.toml written"

 # --- ~/.config/ghostty/config (Liquid Glass + Neon Noir) ---
 backup_if_exists ~/.config/ghostty/config
 cat > ~/.config/ghostty/config <<'GHOSTTY'
 # Neon Noir — Liquid Glass on macOS Tahoe (26.x)
 # Translucent design matching brand: #00D4FF / #FF006E / #7C3AED / #0A0A14

 # === Theme (cyberdream = closest match to Neon Noir; falls back to tokyonight_storm if missing) ===
 theme = cyberdream

 # === Liquid Glass (macOS 26+) ===
 background-opacity = 0.85
 background-blur = macos-glass-regular
 macos-titlebar-style = transparent
 macos-icon = retro

 # === Window ===
 window-decoration = auto
 window-padding-x = 14
 window-padding-y = 12
 window-padding-balance = true
 window-vsync = true
 window-save-state = always
 window-colorspace = display-p3

 # === Font (install JetBrainsMono Nerd Font first: brew install --cask font-jetbrains-mono-nerd-font) ===
 font-family = JetBrainsMono Nerd Font
 font-size = 14
 font-thicken = true
 font-feature = +liga
 font-feature = +calt
 font-feature = +ss01
 font-feature = +zero
 adjust-cell-height = 15%

 # === Cursor + mouse ===
 cursor-style = bar
 cursor-style-blink = true
 mouse-hide-while-typing = true

 # === Shell + behavior ===
 shell-integration = detect
 shell-integration-features = cursor,sudo,title
 copy-on-select = clipboard
 clipboard-read = allow
 clipboard-write = allow
 clipboard-paste-protection = true
 confirm-close-surface = false
 unfocused-split-opacity = 0.85

 # === Neon Noir accents (paint cyan/magenta/violet OVER cyberdream) ===
 cursor-color = #00D4FF
 selection-background = #7C3AED
 selection-foreground = #FFFFFF

 # === Keybinds ===
 keybind = cmd+t=new_tab
 keybind = cmd+d=new_split:right
 keybind = cmd+shift+d=new_split:down
 keybind = cmd+w=close_surface
 keybind = cmd+shift+enter=toggle_split_zoom
 keybind = cmd+enter=toggle_fullscreen

 # === v2 polish (Scout A, 2026-05-27) — 10 verified items, all sourced to ghostty.org/docs ===

 # Quick Terminal — Quake-style drop-down via cmd+` (global hotkey)
 keybind = global:cmd+grave_accent=toggle_quick_terminal
 quick-terminal-position = top
 quick-terminal-animation-duration = 0.18
 quick-terminal-screen = main
 quick-terminal-autohide = true

 # Command Palette (cmd+shift+p) — VS Code muscle memory for in-app actions
 keybind = cmd+shift+p=toggle_command_palette

 # Dynamic tab title: CWD basename + git branch (re-runs via shell integration)
 title-command = printf '%s  %s' "$(basename "$PWD")" "$(git branch --show-current 2>/dev/null)"

 # Bell: visual + soft audio, no dock-bounce (1.3.0)
 bell-features = visual,audio,no-system
 bell-audio-volume = 0.4

 # Notify on long commands when unfocused (1.3.0)
 notify-on-command-finish = unfocused
 notify-on-command-finish-action = notify
 notify-on-command-finish-after = 10s

 # Granular working-directory inheritance (1.3.0)
 window-inherit-working-directory = true
 tab-inherit-working-directory = true
 split-inherit-working-directory = true

 # Native Tahoe overlay scrollbar (1.3.0)
 scrollbar = system

 # Left option = Alt (unlocks tmux/helix); right option stays free for français accents
 macos-option-as-alt = left

 # Brand-color unfocused-split fill (overlays #0A0A14 instead of alpha hack)
 unfocused-split-fill = #0A0A14

 # Resize/padding/blending polish trio
 resize-overlay = after-first
 window-padding-color = extend
 alpha-blending = native
 GHOSTTY
 ok "~/.config/ghostty/config written (Liquid Glass + Neon Noir)"

 # Add Neon Noir custom theme (fallback if cyberdream not bundled)
 mkdir -p ~/.config/ghostty/themes
 cat > ~/.config/ghostty/themes/neon-noir <<'NEONNOIR'
 background = 0A0A14
 foreground = E0E0FF
 cursor-color = 00D4FF
 selection-background = 7C3AED
 selection-foreground = FFFFFF
 palette = 0=#0A0A14
 palette = 1=#FF006E
 palette = 2=#34D399
 palette = 3=#FBBF24
 palette = 4=#7C3AED
 palette = 5=#FF006E
 palette = 6=#00D4FF
 palette = 7=#F5F5F7
 palette = 8=#71717A
 palette = 9=#FF4D8F
 palette = 10=#6EE7B7
 palette = 11=#FCD34D
 palette = 12=#A78BFA
 palette = 13=#FF6BA8
 palette = 14=#7DF0FF
 palette = 15=#FFFFFF
 NEONNOIR
 ok "~/.config/ghostty/themes/neon-noir written (custom palette fallback)"

 # Install JetBrains Mono Nerd Font if not already installed
 if ! brew list --cask font-jetbrains-mono-nerd-font &> /dev/null; then
  brew install --cask font-jetbrains-mono-nerd-font 2>&1 | tail -1
  ok "JetBrainsMono Nerd Font installed"
 else
  ok "JetBrainsMono Nerd Font already installed"
 fi

 # --- ~/.config/mise/config.toml ---
 backup_if_exists ~/.config/mise/config.toml
 cat > ~/.config/mise/config.toml <<'MISE'
 [tools]
 node = "lts"
 python = "3.13"
 rust = "stable"
 go = "latest"

 [settings]
 experimental = true
 trusted_config_paths = ["~/projects", "~/1_PROJECTS"]
 MISE
 ok "~/.config/mise/config.toml written"

 # --- ~/.config/atuin/config.toml ---
 backup_if_exists ~/.config/atuin/config.toml
 cat > ~/.config/atuin/config.toml <<'ATUIN'
 enter_accept = false
 filter_mode = "global"
 filter_mode_shell_up_key_arrow = "session"
 style = "compact"
 inline_height = 20
 show_preview = true
 show_help = true
 auto_sync = true
 sync_frequency = "10m"

 [stats]
 common_prefix = ["sudo", "time"]
 ATUIN
 ok "~/.config/atuin/config.toml written"

 # --- ~/.claude/settings.json ---
 backup_if_exists ~/.claude/settings.json
 cat > ~/.claude/settings.json <<'CLAUDE'
 {
  "model": "claude-opus-4-7",
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
    "CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY": "15",
    "CLAUDE_CODE_EFFORT_LEVEL": "xhigh",
    "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1"
  },
  "permissions": {
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(cat /.env*)",
      "Bash(cat ~/.ssh/*)",
      "Bash(cat ~/.aws/*)"
    ],
    "ask": [
      "Bash(git push --force*)",
      "Bash(rm -rf*)",
      "Bash(npm publish*)"
    ]
  },
  "cleanupPeriodDays": 30
 }
 CLAUDE
 ok "~/.claude/settings.json written"

 # --- ~/.ssh/config (with Keychain integration) ---
 mkdir -p ~/.ssh
 chmod 700 ~/.ssh
 if ! grep -q "Host github.com" ~/.ssh/config 2>/dev/null; then
  cat >> ~/.ssh/config <<'SSHCONFIG'

 Host github.com
  HostName github.com
  User git
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519
 SSHCONFIG
  chmod 600 ~/.ssh/config
 fi
 ok "~/.ssh/config written (Keychain integration)"

 # ============================================================
 # 8. SSH key gen + upload to GitHub via gh CLI
 # ============================================================
 step "8. SSH key + GitHub upload"

 if [ ! -f ~/.ssh/id_ed25519 ]; then
  ssh-keygen -t ed25519 -C "boudjemaa.adam@gmail.com" -f ~/.ssh/id_ed25519 -N ""
  ok "SSH key generated at ~/.ssh/id_ed25519"
 else
  ok "SSH key already exists"
 fi

 # Add to SSH agent + Keychain
 ssh-add --apple-use-keychain ~/.ssh/id_ed25519 2>/dev/null || true
 ok "SSH key added to agent + Keychain"

 # Check gh CLI auth status
 if ! gh auth status &> /dev/null; then
  warn "gh CLI not authenticated. Opening browser for login..."
  warn "Choose: GitHub.com → HTTPS → Login with browser"
  gh auth login --web --hostname github.com --git-protocol https
 fi

 if gh auth status &> /dev/null; then
  # Upload as auth key
  if ! gh ssh-key list 2>/dev/null | grep -q "M5 Max auth"; then
    gh ssh-key add ~/.ssh/id_ed25519.pub --title "Adam M5 Max auth"
    ok "SSH key uploaded as auth key"
  fi
  # Upload as signing key
  if ! gh ssh-key list --type signing 2>/dev/null | grep -q "M5 Max signing"; then
    gh ssh-key add ~/.ssh/id_ed25519.pub --type signing --title "Adam M5 Max signing"
    ok "SSH key uploaded as signing key"
  fi

  # Verify auth works
  if ssh -T git@github.com 2>&1 | grep -q "successfully authenticated"; then
    ok "GitHub SSH authentication verified"
  else
    warn "GitHub SSH verification failed. Try: ssh -T git@github.com"
  fi
 else
  warn "gh CLI auth skipped — run later: gh auth login && gh ssh-key add ~/.ssh/id_ed25519.pub"
 fi

 # ============================================================
 # 9. macOS defaults
 # ============================================================
 step "9. macOS defaults (Finder, dock, key repeat, screenshots)"

 # Finder
 defaults write com.apple.finder AppleShowAllFiles -bool true
 defaults write com.apple.finder _FXShowPosixPathInTitle -bool true
 defaults write com.apple.finder ShowPathbar -bool true
 defaults write com.apple.finder ShowStatusBar -bool true

 # Key repeat
 defaults write -g KeyRepeat -int 2
 defaults write -g InitialKeyRepeat -int 15

 # Kill smart quotes/dashes/spell
 defaults write -g NSAutomaticDashSubstitutionEnabled -bool false
 defaults write -g NSAutomaticQuoteSubstitutionEnabled -bool false
 defaults write -g NSAutomaticSpellingCorrectionEnabled -bool false

 # Dock
 defaults write com.apple.dock autohide -bool true
 defaults write com.apple.dock autohide-delay -float 0
 defaults write com.apple.dock autohide-time-modifier -float 0.3
 defaults write com.apple.dock show-recents -bool false

 # Screenshots → ~/Pictures/Screenshots
 defaults write com.apple.screencapture location ~/Pictures/Screenshots

 ok "macOS defaults applied"

 # ============================================================
 # 10. Disable Spotlight ⌘+Space (so Raycast can take it)
 # ============================================================
 step "10. Disabling Spotlight ⌘+Space hotkey (for Raycast)"
 defaults write com.apple.symbolichotkeys AppleSymbolicHotKeys -dict-add 64 \
  '<dict><key>enabled</key><false/></dict>' 2>/dev/null || true
 defaults write com.apple.symbolichotkeys AppleSymbolicHotKeys -dict-add 65 \
  '<dict><key>enabled</key><false/></dict>' 2>/dev/null || true
 ok "Spotlight ⌘+Space disabled (Raycast can claim it after first launch)"

 # Apply defaults
 killall Finder Dock SystemUIServer 2>/dev/null || true

 # ============================================================
 # 11. Ollama service + base model pulls (background)
 # ============================================================
 step "11. Starting Ollama + pulling base models (background)"
 brew services start ollama 2>&1 | tail -1
 sleep 3

 # Ollama tuning (M5): keep models warm + large context. Ollama's tiny default context
 # silently truncates long prompts → broken tool calls; raise it to 16384. Plus flash-attn
 # and q8 KV cache. Persisted in the brew LaunchAgent plist's EnvironmentVariables.
 OLLAMA_PLIST="$HOME/Library/LaunchAgents/homebrew.mxcl.ollama.plist"
 if [ -f "$OLLAMA_PLIST" ]; then
  /usr/libexec/PlistBuddy -c "Add :EnvironmentVariables dict" "$OLLAMA_PLIST" 2>/dev/null || true
  for kv in OLLAMA_FLASH_ATTENTION=1 OLLAMA_KV_CACHE_TYPE=q8_0 OLLAMA_KEEP_ALIVE=-1 OLLAMA_CONTEXT_LENGTH=16384; do
    k="${kv%%=*}"; v="${kv#*=}"
    /usr/libexec/PlistBuddy -c "Set :EnvironmentVariables:$k $v" "$OLLAMA_PLIST" 2>/dev/null \
      || /usr/libexec/PlistBuddy -c "Add :EnvironmentVariables:$k string $v" "$OLLAMA_PLIST"
  done
  launchctl bootout "gui/$(id -u)/homebrew.mxcl.ollama" 2>/dev/null || true
  launchctl bootstrap "gui/$(id -u)" "$OLLAMA_PLIST" 2>/dev/null || true
  ok "Ollama env tuned (KEEP_ALIVE=-1, CONTEXT_LENGTH=16384, flash-attn, q8 KV cache)"
 fi

 # Pull in background — don't block setup.
 # Uncensored/abliterated equivalents of the qwen3 set (Adam's intentional choice).
 (
  ollama pull huihui_ai/qwen3-abliterated:30b                          # daily driver text (≈ qwen3:30b)
  ollama pull huihui_ai/qwen3-coder-abliterated:30b-a3b-instruct-q8_0  # coding base (≈ qwen3-coder:30b)
  ollama pull nomic-embed-text                                         # RAG embeddings
  ollama pull huihui_ai/qwen3.5-abliterated:122B                       # flagship reasoning (~81 GB)
 ) &
 OLLAMA_PID=$!
 ok "Ollama pulls running in background (PID $OLLAMA_PID) — ~131 GB total"

 # ============================================================
 # 12. Whisper model (with truncation guard)
 # ============================================================
 step "12. Downloading Whisper model"
 mkdir -p ~/.cache/whisper-cpp
 if [ ! -f ~/.cache/whisper-cpp/ggml-large-v3-turbo.bin ]; then
  curl -L --fail --retry 3 -o ~/.cache/whisper-cpp/ggml-large-v3-turbo.bin \
    "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin?download=true" \
    2>&1 | tail -1
  size=$(stat -f%z ~/.cache/whisper-cpp/ggml-large-v3-turbo.bin)
  if [ "$size" -lt 1500000000 ]; then
    warn "Whisper model truncated ($size bytes, expected ~1.6 GB). Removing — re-run setup.sh"
    rm ~/.cache/whisper-cpp/ggml-large-v3-turbo.bin
  else
    ok "Whisper model downloaded ($(echo "scale=2; $size/1073741824" | bc) GB)"
  fi
 else
  ok "Whisper model already downloaded"
 fi

 # ============================================================
 # 13. GPU memory cap (sysctl live + LaunchDaemon for reboot persistence)
 # ============================================================
 # Modern macOS (Tahoe 26.x) does NOT auto-load /etc/sysctl.conf at boot.
 # The reliable persistence path is a LaunchDaemon that runs `sysctl` on every boot.
 step "13. Setting GPU memory cap to 120 GB — sysctl live + LaunchDaemon persistence (needs sudo)"
 GPU_PLIST=/Library/LaunchDaemons/com.adam.iogpu-wired-limit.plist
 if [ "$(sysctl -n iogpu.wired_limit_mb 2>/dev/null)" != "122880" ]; then
  sudo sysctl iogpu.wired_limit_mb=122880
  ok "GPU cap set live to 122880 MB (120 GB)"
 else
  ok "GPU cap already at 122880 MB"
 fi

 if [ ! -f "$GPU_PLIST" ]; then
  sudo tee "$GPU_PLIST" > /dev/null <<'PLIST'
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.adam.iogpu-wired-limit</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/sbin/sysctl</string>
        <string>iogpu.wired_limit_mb=122880</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <false/>
 </dict>
 </plist>
 PLIST
  sudo chown root:wheel "$GPU_PLIST"
  sudo chmod 644 "$GPU_PLIST"
  sudo launchctl load -w "$GPU_PLIST" 2>/dev/null || true
  ok "GPU cap persisted via LaunchDaemon ($GPU_PLIST)"
 else
  ok "GPU cap LaunchDaemon already present"
 fi

 # High Power Mode (AC profile) — sustains GPU clocks under long MLX loads. Engages on AC.
 if [ "$(pmset -g custom 2>/dev/null | awk '/AC Power/{f=1} f&&/powermode/{print $2; exit}')" != "2" ]; then
  sudo pmset -c powermode 2 && ok "High Power Mode enabled for AC (powermode 2)"
 else
  ok "High Power Mode already enabled for AC (powermode 2)"
 fi

 # Touch ID for sudo (scriptable) — Touch-ID-backed sudo via the system template
 if [ ! -f /etc/pam.d/sudo_local ] && [ -f /etc/pam.d/sudo_local.template ]; then
  sudo sed 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local >/dev/null
  ok "Touch ID for sudo enabled (/etc/pam.d/sudo_local)"
 fi

 # ============================================================
 # 14. MLX project scaffold
 # ============================================================
 step "14. Scaffolding MLX lab project"
 if [ ! -d ~/1_PROJECTS/mlx-lab ]; then
  mkdir -p ~/1_PROJECTS/mlx-lab
  cd ~/1_PROJECTS/mlx-lab
  uv init -q --no-readme 2>/dev/null
  uv add mlx mlx-lm mlx-lm-lora mlx-vlm mlx-audio mlx-embeddings mflux 2>&1 | tail -3
  cd - > /dev/null
  ok "MLX lab venv created at ~/1_PROJECTS/mlx-lab"
 else
  ok "MLX lab already exists"
 fi

 # ============================================================
 # 15. fzf keybindings
 # ============================================================
 step "15. Wiring fzf keybindings"
 yes | $(brew --prefix)/opt/fzf/install --all --no-update-rc 2>/dev/null > /dev/null || true
 ok "fzf keybindings ready (Ctrl+R, Ctrl+T, Alt+C)"

 # ============================================================
 # DONE
 # ============================================================
 echo ""
 echo -e "${C_GREEN}═════════════════════════════════════════════════════${C_RESET}"
 echo -e "${C_GREEN}  ✅ Automated setup complete${C_RESET}"
 echo -e "${C_GREEN}═════════════════════════════════════════════════════${C_RESET}"
 echo ""
 echo "Manual steps remaining (cannot be automated — UI logins / licenses):"
 echo ""
 echo -e "  ${C_BLUE}1.${C_RESET} Restart your shell to load the new ~/.zshrc:"
 echo "       exec zsh"
 echo ""
 echo -e "  ${C_BLUE}2.${C_RESET} Sign in to GUI apps:"
 echo "       • Cursor (sign in via UI)"
 echo "       • Claude Code → run 'claude' for OAuth"
 echo "       • 1Password (sign in to your account)"
 echo "       • Notion / Slack / Zoom / etc."
 echo ""
 echo -e "  ${C_BLUE}3.${C_RESET} Configure Raycast:"
 echo "       • Open Raycast → Settings → General → Hotkey: ⌥+Space"
 echo "       • (Spotlight ⌘+Space already disabled by this script)"
 echo ""
 echo -e "  ${C_BLUE}4.${C_RESET} Licenses to activate (paid apps):"
 echo "       • Hazel (\$42) — open Hazel, paste license"
 echo "       • CleanShot X (\$30) — sign in to setapp/setapp.com or buy license"
 echo "       • Cold Turkey Pro (\$39) — sign in"
 echo ""
 echo -e "  ${C_BLUE}5.${C_RESET} Wait for Ollama pulls to finish (~80 GB) — check progress:"
 echo "       ollama list"
 echo ""
 echo -e "  ${C_BLUE}6.${C_RESET} Smoke tests:"
 echo "       python -c \"import sys; sys.path.insert(0,'\$HOME/1_PROJECTS/mlx-lab/.venv/lib/python3.13/site-packages'); import mlx.core as mx; print('MLX Metal:', mx.metal.is_available())\""
 echo "       ssh -T git@github.com"
 echo "       forge --version"
 echo "       cc --bare -p 'hello'"
 echo ""
 echo "Reference docs: open adam-mac-setup.md in this gist for full explanations."
 echo ""
diff --git a/template-claude-settings.json b/template-claude-settings.json
 {
  "cleanupPeriodDays": 30,
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
    "CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY": "32",
    "CLAUDE_CODE_EFFORT_LEVEL": "xhigh",
    "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1"
  },
  "permissions": {
    "allow": [
      "Bash",
      "Read",
      "Edit",
      "Write",
      "Grep",
      "Glob"
    ],
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(cat /.env*)",
      "Bash(cat ~/.ssh/*)",
      "Bash(cat ~/.aws/*)"
    ],
    "ask": [
      "Bash(git push --force*)",
      "Bash(rm -rf*)",
      "Bash(npm publish*)"
    ]
  },
  "model": "opus",
  "effortLevel": "xhigh",
  "skipDangerousModePermissionPrompt": true,
  "skipWorkflowUsageWarning": true,
  "theme": "dark",
  "fileCheckpointingEnabled": true,
  "disableDeepLinkRegistration": "disable",
  "enabledPlugins": {
    "swift-lsp@claude-plugins-official": true
  }
 }
diff --git a/template-vscode-settings.json b/template-vscode-settings.json
 {
  "[solidity]": {
    "editor.defaultFormatter": "NomicFoundation.hardhat-solidity",
    "editor.formatOnSave": true
  },
  "solidity.formatter": "forge",
  "solidity.packageDefaultDependenciesContractsDirectory": "src",
  "solidity.packageDefaultDependenciesDirectory": "lib",
  "todo-tree.ripgrep.ripgrep": "/opt/homebrew/bin/rg",
  "security.workspace.trust.untrustedFiles": "open"
 }
diff --git a/template-zshrc-claude-wrappers.zsh b/template-zshrc-claude-wrappers.zsh
 # === Claude Code: ultracode + bypass-perms by default, Ghostty paste fix (Anthropic #54700) ===
 # Defaults: --settings='{"ultracode":true}' forces ultracode (settings.json drops it silently),
 #           --dangerously-skip-permissions bypasses the per-tool ask/allow prompts.
 # Escape hatches: use `command claude` or `\claude` to launch without the defaults.
 cc() {
  if [ "$TERM_PROGRAM" = "ghostty" ]; then
    TERM=xterm-256color command claude --settings='{"ultracode":true}' --dangerously-skip-permissions "$@"
  else
    command claude --settings='{"ultracode":true}' --dangerously-skip-permissions "$@"
  fi
 }
 # Same defaults applied when typing `claude` directly
 claude() {
  command claude --settings='{"ultracode":true}' --dangerously-skip-permissions "$@"
 }
diff --git a/verify.sh b/verify.sh
 #!/usr/bin/env zsh
 # ============================================================
 #  Adam M5 Max — verification script
 #
 #  Usage:  ./verify.sh
 #
 #  Checks:
 #    1. Foundation (Xcode, Homebrew, paths)
 #    2. Every Brewfile formula/cask is installed → reports missing
 #    3. Dropped/redundant items still installed → offers to uninstall
 #    4. Dev runtimes via mise (node/python/rust/go)
 #    5. Python tools via uv (slither, halmos, eth-wake)
 #    6. Foundry (forge/cast/anvil/chisel)
 #    7. npm globals (Claude Code, vercel, pnpm)
 #    8. Ollama service + base models
 #    9. Whisper model file + size
 #   10. SSH key + GitHub auth
 #   11. macOS defaults applied
 #   12. sysctl GPU cap set
 #   13. Config files exist (.zshrc, .gitconfig, .config/*, .claude/settings.json)
 #   14. Claude Code env vars present in shell
 #   15. MLX project venv
 #
 #  Exit 0 = all green. Non-zero = issues found (counted at bottom).
 # ============================================================

 C_GREEN='\033[0;32m'
 C_BLUE='\033[0;34m'
 C_YELLOW='\033[0;33m'
 C_RED='\033[0;31m'
 C_GRAY='\033[0;90m'
 C_RESET='\033[0m'

 PASS=0
 FAIL=0
 WARN=0
 TO_INSTALL=()
 TO_REMOVE=()

 ok()    { echo -e "  ${C_GREEN}✓${C_RESET} $1"; PASS=$((PASS+1)); }
 miss()  { echo -e "  ${C_RED}✗${C_RESET} $1"; FAIL=$((FAIL+1)); }
 warn()  { echo -e "  ${C_YELLOW}⚠${C_RESET} $1"; WARN=$((WARN+1)); }
 info()  { echo -e "  ${C_GRAY}·${C_RESET} $1"; }
 section() { echo -e "\n${C_BLUE}▶ $1${C_RESET}"; }   # renamed from head() — was shadowing /usr/bin/head and breaking line 190

 # ============================================================
 # 1. Foundation
 # ============================================================
 section "1. Foundation"
 xcode-select -p &>/dev/null && ok "Xcode CLI tools" || { miss "Xcode CLI tools — run: xcode-select --install"; }
 command -v brew &>/dev/null && ok "Homebrew at $(which brew)" || miss "Homebrew not installed"
 [[ "$(which brew)" == "/opt/homebrew/bin/brew" ]] && ok "Homebrew on Apple Silicon path" || warn "Brew not at /opt/homebrew (Intel/Rosetta?)"
 [[ "$(uname -m)" == "arm64" ]] && ok "Apple Silicon arch" || warn "Not Apple Silicon"

 # ============================================================
 # 2. Required formulae (Brewfile spec)
 # ============================================================
 section "2. Required brew formulae"
 REQUIRED_FORMULAE=(
  antidote starship atuin
  eza bat fd ripgrep fzf zoxide
  lazygit yazi gh jq yq tree
  htop btop dust duf
  direnv tldr gnupg
  mkcert mas xh doggo
  wget watch imagemagick yt-dlp ncdu
  mise uv git
  ollama whisper-cpp ffmpeg llama.cpp
  echidna solana aptos
  awscli doctl cloudflared
 )
 INSTALLED_FORMULAE=$(brew list --formula 2>/dev/null)
 for f in "${REQUIRED_FORMULAE[@]}"; do
  if echo "$INSTALLED_FORMULAE" | grep -qx "$f"; then
    ok "formula $f"
  else
    miss "formula $f"
    TO_INSTALL+=("brew install $f")
  fi
 done

 # ============================================================
 # 3. Required casks
 # ============================================================
 section "3. Required brew casks"
 REQUIRED_CASKS=(
  ghostty visual-studio-code
  brave-browser google-chrome firefox
  raycast jordanbaird-ice obsidian
  tailscale-app
  lm-studio draw-things comfyui
  orbstack
  cleanshot
  1password 1password-cli
  postman
  whatsapp telegram zoom
  alt-tab stats appcleaner the-unarchiver
  iina voiceink
  font-jetbrains-mono-nerd-font
 )
 INSTALLED_CASKS=$(brew list --cask 2>/dev/null)
 for c in "${REQUIRED_CASKS[@]}"; do
  if echo "$INSTALLED_CASKS" | grep -qx "$c"; then
    ok "cask $c"
  else
    miss "cask $c"
    TO_INSTALL+=("brew install --cask $c")
  fi
 done

 # Tap formulae
 echo "$INSTALLED_FORMULAE" | grep -q "^aderyn$" && ok "formula aderyn (cyfrin/tap)" || { miss "aderyn (needs cyfrin/tap)"; TO_INSTALL+=("brew install cyfrin/tap/aderyn"); }
 echo "$INSTALLED_FORMULAE" | grep -q "^supabase$" && ok "formula supabase (core)" || { miss "supabase CLI"; TO_INSTALL+=("brew install supabase"); }
 echo "$INSTALLED_FORMULAE" | grep -q "^stripe$" && ok "formula stripe (tap)" || { miss "stripe CLI"; TO_INSTALL+=("brew install stripe/stripe-cli/stripe"); }
 echo "$INSTALLED_FORMULAE" | grep -q "^sui$" && ok "formula sui (core)" || { miss "sui CLI"; TO_INSTALL+=("brew install sui"); }

 # ============================================================
 # 4. Dropped/redundant items (offer to uninstall)
 # ============================================================
 section "4. Dropped items still installed (cleanup candidates)"
 DROPPED_FORMULAE=(procs bottom httpie)
 DROPPED_CASKS=(mstystudio msty rectangle sleeve wezterm spotify zen-browser pinokio notion notion-calendar slack signal)

 for f in "${DROPPED_FORMULAE[@]}"; do
  if echo "$INSTALLED_FORMULAE" | grep -qx "$f"; then
    warn "formula $f installed — dropped in latest spec (redundant)"
    TO_REMOVE+=("brew uninstall $f")
  fi
 done
 for c in "${DROPPED_CASKS[@]}"; do
  if echo "$INSTALLED_CASKS" | grep -qx "$c"; then
    warn "cask $c installed — dropped in latest spec"
    TO_REMOVE+=("brew uninstall --cask $c")
  fi
 done

 # Spotify reframe
 if echo "$INSTALLED_CASKS" | grep -qx "spotify"; then
  warn "spotify installed — you use Apple Music. If true, uninstall: brew uninstall --cask spotify"
 fi

 # Docker Desktop check (we want OrbStack instead)
 if echo "$INSTALLED_CASKS" | grep -qx "docker"; then
  warn "Docker Desktop installed — OrbStack recommended instead (10× lighter)"
  TO_REMOVE+=("brew uninstall --cask docker")
 fi

 # Cursor check (switched to VS Code for unrestricted local-LLM support)
 if echo "$INSTALLED_CASKS" | grep -qx "cursor"; then
  warn "Cursor installed — VS Code is the chosen editor (Continue.dev wires local Ollama/MLX)"
  TO_REMOVE+=("brew uninstall --cask cursor")
 fi

 # Zen browser if Brave is primary
 if echo "$INSTALLED_CASKS" | grep -qx "zen" && echo "$INSTALLED_CASKS" | grep -qx "brave-browser"; then
  info "Both Brave + Zen installed — fine if you use both. If not: brew uninstall --cask zen"
 fi

 # ============================================================
 # 5. Dev runtimes (via mise)
 # ============================================================
 section "5. Dev runtimes (mise)"
 if command -v mise &>/dev/null; then
  CURRENT=$(mise current 2>/dev/null)
  # `mise current` prints "<tool> <version>" — 2 fields, version is $2 (NOT $3 — that bug returned empty since mise 2025.x)
  echo "$CURRENT" | grep -q "node" && ok "node ($(echo "$CURRENT" | grep node | awk '{print $2}'))" || miss "node not pinned via mise"
  echo "$CURRENT" | grep -q "python" && ok "python ($(echo "$CURRENT" | grep python | awk '{print $2}'))" || miss "python not pinned via mise"
  echo "$CURRENT" | grep -q "rust" && ok "rust ($(echo "$CURRENT" | grep rust | awk '{print $2}'))" || miss "rust not pinned via mise"
  echo "$CURRENT" | grep -q "go" && ok "go ($(echo "$CURRENT" | grep go | awk '{print $2}'))" || miss "go not pinned via mise"
 else
  miss "mise not installed"
 fi

 # ============================================================
 # 6. Python tools (uv)
 # ============================================================
 section "6. Python tools (via uv)"
 UV_TOOLS=$(uv tool list 2>/dev/null)
 for t in slither-analyzer halmos eth-wake; do
  echo "$UV_TOOLS" | grep -q "^$t " && ok "uv tool $t" || { miss "uv tool $t"; TO_INSTALL+=("uv tool install $t"); }
 done

 # ============================================================
 # 7. Foundry
 # ============================================================
 section "7. Foundry"
 command -v forge &>/dev/null && ok "forge ($(forge --version 2>/dev/null | head -1))" || { miss "forge — run: curl -L https://foundry.paradigm.xyz | bash && foundryup"; }
 command -v cast &>/dev/null && ok "cast" || miss "cast"
 command -v anvil &>/dev/null && ok "anvil" || miss "anvil"

 # ============================================================
 # 8. npm globals
 # ============================================================
 section "8. npm globals"
 NPM_GLOBALS=$(npm list -g --depth=0 2>/dev/null || echo "")
 echo "$NPM_GLOBALS" | grep -q "@anthropic-ai/claude-code" && ok "claude-code" || { miss "claude-code"; TO_INSTALL+=("npm install -g @anthropic-ai/claude-code"); }
 echo "$NPM_GLOBALS" | grep -q "vercel" && ok "vercel" || { miss "vercel"; TO_INSTALL+=("npm install -g vercel"); }
 echo "$NPM_GLOBALS" | grep -q "pnpm" && ok "pnpm" || { miss "pnpm"; TO_INSTALL+=("npm install -g pnpm"); }

 # ============================================================
 # 9. Ollama service + models
 # ============================================================
 section "9. Ollama"
 if pgrep -x ollama &>/dev/null || brew services list 2>/dev/null | grep -q "ollama.*started"; then
  ok "Ollama running"
 else
  miss "Ollama not running — run: brew services start ollama"
 fi

 OLLAMA_MODELS=$(ollama list 2>/dev/null | tail -n +2 | awk '{print $1}')
 # Adam runs the uncensored/abliterated equivalents of the qwen3 set (intentional, NOT drift):
 #   qwen3:30b → huihui_ai/qwen3-abliterated:30b · qwen3-coder:30b → huihui_ai/qwen3-coder-abliterated:30b-a3b-instruct-q8_0
 # Bonus flagship (not required here): huihui_ai/qwen3.5-abliterated:122B
 for m in "huihui_ai/qwen3-abliterated:30b" "huihui_ai/qwen3-coder-abliterated:30b-a3b-instruct-q8_0" "nomic-embed-text"; do
  # Match both bare name AND :latest tag; retry once on transient miss
  if echo "$OLLAMA_MODELS" | grep -qE "^${m}(:latest)?$"; then
    ok "ollama model $m"
  else
    sleep 1
    OLLAMA_MODELS=$(ollama list 2>/dev/null | tail -n +2 | awk '{print $1}')
    if echo "$OLLAMA_MODELS" | grep -qE "^${m}(:latest)?$"; then
      ok "ollama model $m"
    else
      miss "ollama model $m"; TO_INSTALL+=("ollama pull $m")
    fi
  fi
 done

 # ============================================================
 # 10. Whisper model
 # ============================================================
 section "10. Whisper model"
 WHISPER_BIN=~/.cache/whisper-cpp/ggml-large-v3-turbo.bin
 if [[ -f "$WHISPER_BIN" ]]; then
  size=$(stat -f%z "$WHISPER_BIN" 2>/dev/null || echo 0)
  if [[ "$size" -gt 1500000000 ]]; then
    ok "whisper model present ($(echo "scale=2;$size/1073741824" | bc) GB)"
  else
    warn "whisper model truncated ($size bytes) — re-download"
  fi
 else
  miss "whisper model missing — see setup.sh step 12"
 fi

 # ============================================================
 # 11. SSH + GitHub
 # ============================================================
 section "11. SSH + GitHub"
 [[ -f ~/.ssh/id_ed25519 ]] && ok "SSH key exists" || miss "SSH key missing — run: ssh-keygen -t ed25519 -C \"$(git config user.email)\""
 [[ -f ~/.ssh/config ]] && grep -q "Host github.com" ~/.ssh/config && ok "~/.ssh/config has github" || warn "~/.ssh/config missing github entry"

 if gh auth status &>/dev/null; then
  ok "gh CLI authenticated"
 else
  warn "gh CLI not authenticated — run: gh auth login"
 fi

 if ssh -o BatchMode=yes -o ConnectTimeout=5 -T git@github.com 2>&1 | grep -q "successfully authenticated"; then
  ok "GitHub SSH auth working"
 else
  miss "GitHub SSH auth failing — see Step 7 of gist"
 fi

 # Git commit signing (SSH-backed via 1Password — spec'd in setup.sh §7)
 GIT_SIGNINGKEY=$(git config --global --get user.signingkey 2>/dev/null)
 GIT_GPGFORMAT=$(git config --global --get gpg.format 2>/dev/null)
 GIT_GPGSIGN=$(git config --global --get commit.gpgsign 2>/dev/null)
 if [[ -n "$GIT_SIGNINGKEY" && "$GIT_GPGFORMAT" == "ssh" && "$GIT_GPGSIGN" == "true" ]]; then
  ok "git commit signing configured (SSH, signingkey=$GIT_SIGNINGKEY)"
 else
  warn "git commit signing not fully configured (signingkey='$GIT_SIGNINGKEY' format='$GIT_GPGFORMAT' sign='$GIT_GPGSIGN') — see setup.sh §7"
 fi

 # ============================================================
 # 12. macOS defaults
 # ============================================================
 section "12. macOS defaults"
 [[ "$(defaults read com.apple.finder AppleShowAllFiles 2>/dev/null)" == "1" ]] && ok "Finder shows hidden files" || warn "Finder hidden files OFF"
 [[ "$(defaults read -g KeyRepeat 2>/dev/null)" == "2" ]] && ok "Key repeat = max" || warn "Key repeat not maxed"
 [[ "$(defaults read com.apple.dock autohide 2>/dev/null)" == "1" ]] && ok "Dock auto-hide" || warn "Dock not auto-hiding"
 [[ "$(defaults read -g NSAutomaticDashSubstitutionEnabled 2>/dev/null)" == "0" ]] && ok "Smart dashes OFF" || warn "Smart dashes ON (breaks code paste)"

 # ============================================================
 # 13. sysctl GPU cap (M5 Max)
 # ============================================================
 section "13. M5 GPU memory cap"
 CURRENT_CAP=$(sysctl -n iogpu.wired_limit_mb 2>/dev/null || echo 0)
 if [[ "$CURRENT_CAP" == "122880" ]]; then
  ok "iogpu.wired_limit_mb = 122880 (120 GB)"
 else
  miss "iogpu.wired_limit_mb = $CURRENT_CAP (expected 122880) — run: sudo sysctl iogpu.wired_limit_mb=122880"
 fi
 # Modern macOS (Tahoe 26.x) doesn't auto-load /etc/sysctl.conf at boot. LaunchDaemon is canonical.
 GPU_PLIST=/Library/LaunchDaemons/com.adam.iogpu-wired-limit.plist
 if [[ -f "$GPU_PLIST" ]]; then
  ok "GPU cap persisted via LaunchDaemon ($GPU_PLIST)"
 elif grep -q "iogpu.wired_limit_mb" /etc/sysctl.conf 2>/dev/null; then
  ok "GPU cap persisted in /etc/sysctl.conf (legacy path — LaunchDaemon preferred)"
 else
  warn "GPU cap not persisted (no LaunchDaemon, no /etc/sysctl.conf entry) — re-applies after reboot"
 fi

 # ============================================================
 # 14. Config files
 # ============================================================
 section "14. Config files"
 CONFIGS=(
  "$HOME/.zshrc"
  "$HOME/.gitconfig"
  "$HOME/.config/starship.toml"
  "$HOME/.config/ghostty/config"
  "$HOME/.config/atuin/config.toml"
  "$HOME/.config/mise/config.toml"
  "$HOME/.claude/settings.json"
 )
 for f in "${CONFIGS[@]}"; do
  [[ -f "$f" ]] && ok "$f" || miss "$f"
 done

 # ============================================================
 # 15. Claude Code env in shell
 # ============================================================
 section "15. Claude Code env vars in ~/.zshrc"
 grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" ~/.zshrc 2>/dev/null && ok "DISABLE_NONESSENTIAL_TRAFFIC set" || warn "missing CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC in ~/.zshrc"
 grep -q "CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY" ~/.zshrc 2>/dev/null && ok "MAX_TOOL_USE_CONCURRENCY set" || warn "missing CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY"
 grep -q "TERM=xterm-256color claude" ~/.zshrc 2>/dev/null && ok "Ghostty paste workaround alias 'cc' present" || warn "missing Ghostty 'cc' alias"

 # Subscription guardrail — `claude` CLI MUST NOT be routed to a local endpoint.
 # Setting ANTHROPIC_BASE_URL hijacks the Claude Max subscription endpoint and silently
 # swaps the cloud model for a local Qwen. This check fails LOUDLY if it's set anywhere.
 if grep -qE "^[[:space:]]*export[[:space:]]+ANTHROPIC_BASE_URL=" ~/.zshrc 2>/dev/null; then
  miss "ANTHROPIC_BASE_URL exported in ~/.zshrc — claude CLI is hijacked to local. UNSET it."
 else
  ok "ANTHROPIC_BASE_URL not in ~/.zshrc (claude stays on Claude Max cloud)"
 fi
 if [ -n "$ANTHROPIC_BASE_URL" ]; then
  miss "ANTHROPIC_BASE_URL=$ANTHROPIC_BASE_URL is currently set in shell — unset before running claude"
 fi

 # Ghostty v2 polish marker (setup.sh §21 writes it; Prompt 3 reapplies if missing)
 if [[ -f ~/.config/ghostty/config ]] && grep -q "v2 polish" ~/.config/ghostty/config 2>/dev/null; then
  ok "Ghostty v2 polish marker present"
 else
  warn "Ghostty v2 polish missing — run Prompt 3 to apply (no-op if already present)"
 fi

 # Neon Noir custom palette theme file (setup.sh §21.4b)
 [[ -f ~/.config/ghostty/themes/neon-noir ]] && ok "~/.config/ghostty/themes/neon-noir" || warn "Neon Noir custom palette theme missing"

 # mlx_max / mlx_revert shell helpers (setup.sh §7)
 grep -q "mlx_max" ~/.zshrc 2>/dev/null && ok "mlx_max / mlx_revert helpers in ~/.zshrc" || warn "mlx_max helpers missing from ~/.zshrc"

 # ============================================================
 # 16. MLX project venv
 # ============================================================
 section "16. MLX project"
 if [[ -d ~/1_PROJECTS/mlx-lab ]]; then
  ok "~/1_PROJECTS/mlx-lab exists"
  if [[ -f ~/1_PROJECTS/mlx-lab/pyproject.toml ]]; then
    ok "uv project initialized"
  else
    warn "no pyproject.toml — re-run: cd ~/1_PROJECTS/mlx-lab && uv init"
  fi
 else
  miss "~/1_PROJECTS/mlx-lab missing — see setup.sh step 14"
 fi

 # MLX import test — locked decision: MLX lives in the per-project venv (~/1_PROJECTS/mlx-lab/.venv), NOT global python
 MLX_PY="$HOME/1_PROJECTS/mlx-lab/.venv/bin/python"
 if [[ -x "$MLX_PY" ]] && "$MLX_PY" -c "import mlx.core as mx; print(mx.metal.is_available())" 2>/dev/null | grep -q True; then
  ok "MLX Metal available (mlx-lab venv)"
 elif command -v python &>/dev/null && python -c "import mlx.core as mx; print(mx.metal.is_available())" 2>/dev/null | grep -q True; then
  ok "MLX Metal available (global python)"
 else
  warn "MLX not importable from mlx-lab venv or global python"
 fi

 # ============================================================
 # Summary
 # ============================================================
 echo ""
 echo -e "${C_BLUE}═══════════════════════════════════════════════════════${C_RESET}"
 echo -e "${C_BLUE}  Verification summary${C_RESET}"
 echo -e "${C_BLUE}═══════════════════════════════════════════════════════${C_RESET}"
 echo -e "  ${C_GREEN}✓ PASS: $PASS${C_RESET}"
 echo -e "  ${C_RED}✗ FAIL: $FAIL${C_RESET}"
 echo -e "  ${C_YELLOW}⚠ WARN: $WARN${C_RESET}"

 if [[ ${#TO_INSTALL[@]} -gt 0 ]]; then
  echo ""
  echo -e "${C_BLUE}── To install (run setup.sh, or paste below) ──${C_RESET}"
  for cmd in "${TO_INSTALL[@]}"; do
    echo "  $cmd"
  done
 fi

 if [[ ${#TO_REMOVE[@]} -gt 0 ]]; then
  echo ""
  echo -e "${C_YELLOW}── Dropped items installed — optional cleanup ──${C_RESET}"
  for cmd in "${TO_REMOVE[@]}"; do
    echo "  $cmd"
  done
  echo ""
  echo -ne "${C_YELLOW}  Uninstall all dropped items now? (y/N) ${C_RESET}"
  read -r answer
  if [[ "$answer" =~ ^[Yy]$ ]]; then
    for cmd in "${TO_REMOVE[@]}"; do
      echo "Running: $cmd"
      eval "$cmd"
    done
    echo -e "${C_GREEN}Cleanup done${C_RESET}"
  fi
 fi

 echo ""

 # --status-md flag — regenerate ~/m5-setup/00-STATUS.md so a fresh reader of the gist
 # can see WHERE WE ARE at a glance (✅ DONE / 🟡 PARTIAL / ⬜ TODO / ⚠️ DRIFT).
 if [[ "$1" == "--status-md" ]] || [[ "$STATUS_MD" == "1" ]]; then
  STATUS_OUT="${STATUS_MD_PATH:-$HOME/m5-setup/00-STATUS.md}"
  # Detect Prompt run artifacts on disk
  _audit=$(ls -t /tmp/m5-audit-*.md 2>/dev/null | head -1)
  _install=$(ls -t /tmp/m5-install-fix.log 2>/dev/null | head -1)
  _verify=$(ls -t /tmp/m5-verify-*.md 2>/dev/null | head -1)
  _debug=$(ls -t /tmp/m5-debug-*.md 2>/dev/null | head -1)
  _review=$(ls -t /tmp/m5-review-*.md 2>/dev/null | head -1)
  _polish_done=$(grep -q "v2 polish" ~/.config/ghostty/config 2>/dev/null && echo "yes" || echo "no")
  _mcps=$(claude mcp list 2>/dev/null | grep -c "^" || echo 0)
  _stat() { [ -e "$1" ] && stat -f "%Sm" -t "%Y-%m-%d %H:%M" "$1" 2>/dev/null || echo "—"; }
  _row() { [ -n "$1" ] && echo "✅" || echo "⬜"; }

  cat > "$STATUS_OUT" <<EOF
 # M5 Max — Setup Status

 > Auto-generated by \`~/m5-setup/verify.sh --status-md\`
 > Last run: $(date '+%Y-%m-%d %H:%M %Z') · PASS=$PASS / FAIL=$FAIL / WARN=$WARN
 > Legend: ✅ done · 🟡 partial · ⬜ todo · ⚠️ drift

 ## Command Center — prompts run

 | # | Prompt | Run? | Last run | Artifact |
 |---|---|---|---|---|
 | 0 | Status | ✅ | $(date '+%Y-%m-%d %H:%M') | \`00-STATUS.md\` (this file) |
 | 1 | Audit | $(_row "$_audit") | $(_stat "$_audit") | $_audit |
 | 2 | Install | $(_row "$_install") | $(_stat "$_install") | $_install |
 | 3 | Ghostty Polish | $([ "$_polish_done" = "yes" ] && echo "✅" || echo "⬜") | $(_stat ~/.config/ghostty/config) | "v2 polish" marker in ghostty config |
 | 4 | Claude Code Config | $([ "$_mcps" -ge 4 ] && echo "✅" || echo "⬜") | $(_stat ~/.claude/settings.json) | $_mcps MCPs registered |
 | 5 | Verification | $(_row "$_verify") | $(_stat "$_verify") | $_verify |
 | 6 | Debugging | $([ -n "$_debug" ] && echo "✅ ran" || echo "n/a") | $(_stat "$_debug") | $_debug |
 | 7 | Cleanup + Docs | ⬜ | — | (no on-disk marker — manually tick when done) |
 | 8 | Final Review | $(_row "$_review") | $(_stat "$_review") | $_review |
 EOF
  cat >> "$STATUS_OUT" <<EOF

 | Phase | Status | Note |
 |---|---|---|
 | 1. Foundation (Xcode, brew, arch) | $([ "$PASS" -ge 3 ] && echo ✅ || echo ⬜) | $(uname -m), macOS $(sw_vers -productVersion 2>/dev/null) |
 | 2. Brew formulae (44 required) | $([ "$FAIL" -eq 0 ] && echo ✅ || echo 🟡) | run \`brew bundle install --file=~/m5-setup/Brewfile\` if missing |
 | 3. Brew casks (32 required) | $([ "$FAIL" -eq 0 ] && echo ✅ || echo 🟡) | font-jetbrains-mono-nerd-font required by Ghostty |
 | 4. Dev runtimes (mise: node/python/rust/go) | $(command -v mise >/dev/null && echo ✅ || echo ⬜) | $(mise current 2>/dev/null | head -1 || echo "mise not active") |
 | 5. Python tools (slither/halmos/eth-wake via uv) | $(uv tool list 2>/dev/null | grep -q slither && echo ✅ || echo ⬜) | |
 | 6. Foundry (forge/cast/anvil) | $(command -v forge >/dev/null && echo ✅ || echo ⬜) | curl -L https://foundry.paradigm.xyz \| bash && foundryup |
 | 7. npm globals (claude/vercel/pnpm) | $(command -v claude >/dev/null && echo ✅ || echo ⬜) | $(claude --version 2>/dev/null | head -1) |
 | 8. Ollama daemon + models | $(pgrep -x ollama >/dev/null && echo ✅ || echo ⬜) | $(ollama list 2>/dev/null | tail -n +2 | wc -l | tr -d ' ') models installed |
 | 9. Configs (.zshrc, ghostty, starship, atuin, mise, claude) | $([ -f ~/.config/ghostty/config ] && echo ✅ || echo 🟡) | |
 | 10. Claude Code env in ~/.zshrc | $(grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" ~/.zshrc 2>/dev/null && echo ✅ || echo ⬜) | |
 | 11. ANTHROPIC_BASE_URL guardrail | $([ -z "$ANTHROPIC_BASE_URL" ] && echo ✅ || echo ⚠️) | $([ -n "$ANTHROPIC_BASE_URL" ] && echo "HIJACKED to $ANTHROPIC_BASE_URL — UNSET" || echo "claude stays on Anthropic cloud") |
 | 12. macOS defaults (Finder/KeyRepeat/Dock/dashes) | $([ "$(defaults read -g KeyRepeat 2>/dev/null)" = "2" ] && echo ✅ || echo 🟡) | |
 | 13. GPU cap (live + LaunchDaemon) | $([ "$(sysctl -n iogpu.wired_limit_mb 2>/dev/null)" = "122880" ] && echo ✅ || echo ⬜) | $(sysctl -n iogpu.wired_limit_mb 2>/dev/null) MB |
 | 14. GPU cap persistence (LaunchDaemon) | $([ -f /Library/LaunchDaemons/com.adam.iogpu-wired-limit.plist ] && echo ✅ || echo ⚠️) | reverts on reboot if missing |
 | 15. SSH + GitHub auth | $(ssh -o BatchMode=yes -o ConnectTimeout=3 -T git@github.com 2>&1 | grep -q "successfully authenticated" && echo ✅ || echo ⬜) | gh auth login + gh ssh-key add |
 | 16. Git commit signing (SSH via 1Password) | $([ -n "$(git config --global --get user.signingkey)" ] && [ "$(git config --global --get gpg.format)" = "ssh" ] && echo ✅ || echo ⬜) | |
 | 17. MLX project (~/1_PROJECTS/mlx-lab) | $([ -d ~/1_PROJECTS/mlx-lab ] && echo ✅ || echo ⬜) | |
 | 18. Cleanup (no dropped formulae/casks) | $(brew list --formula 2>/dev/null | grep -qE "^(procs|bottom|httpie)$" && echo ⚠️ || echo ✅) | dropped: procs, bottom, httpie, mstystudio, msty, rectangle, sleeve, wezterm, spotify |

 ## Raw counts
 - ✅ PASS = $PASS
 - ⬜ FAIL = $FAIL
 - ⚠️ WARN = $WARN

 ## Next prompts to run
 $([ "$FAIL" -gt 5 ] && echo "- **Prompt 2 (Install)** — fill the MISSING list, $FAIL items pending" || echo "- Install phase looks clean")
 $(grep -q "v2 polish" ~/.config/ghostty/config 2>/dev/null || echo "- **Prompt 3 (Ghostty Polish)** — apply v2 polish")
 $([ -z "$ANTHROPIC_BASE_URL" ] && echo "- (env guardrail green — claude stays on cloud)" || echo "- **CRITICAL: unset ANTHROPIC_BASE_URL immediately**")
 $([ "$WARN" -gt 0 ] && echo "- **Prompt 7 (Cleanup + Docs)** — $WARN warnings to triage" || echo "- Cleanup phase looks clean")

 ---
 Refresh this file: \`~/m5-setup/verify.sh --status-md\`
 Push to gist: \`gh gist edit fad46568b34a09bf453fd48a57123252 -f 00-STATUS.md ~/m5-setup/00-STATUS.md\`
 EOF
  echo -e "${C_BLUE}  📋 Status written to $STATUS_OUT${C_RESET}"
 fi

 if [[ "$FAIL" -eq 0 ]]; then
  echo -e "${C_GREEN}  ✅ All required items installed${C_RESET}"
  exit 0
 else
  echo -e "${C_RED}  ❌ $FAIL items missing${C_RESET}"
  exit 1
 fi
#	Prompt	Run?	Last run	Artifact
0	Status	✅	2026-05-30 17:55	`00-STATUS.md` (this file)
1	Audit	⬜	—
2	Install	⬜	—
3	Ghostty Polish	⬜	2026-05-30 17:04	"v2 polish" marker in ghostty config
4	Claude Code Config	✅	2026-05-30 16:43	11 MCPs registered
5	Verification	⬜	—
6	Debugging	n/a	—
7	Cleanup + Docs	⬜	—	(no on-disk marker — manually tick when done)
8	Final Review	⬜	—
Phase	Status	Note
1. Foundation (Xcode, brew, arch)	✅	arm64, macOS 26.5
2. Brew formulae (44 required)	🟡	run `brew bundle install --file=~/m5-setup/Brewfile` if missing
3. Brew casks (32 required)	🟡	font-jetbrains-mono-nerd-font required by Ghostty
4. Dev runtimes (mise: node/python/rust/go)	✅	go 1.26.3
5. Python tools (slither/halmos/eth-wake via uv)	✅
6. Foundry (forge/cast/anvil)	✅	curl -L https://foundry.paradigm.xyz \| bash && foundryup
7. npm globals (claude/vercel/pnpm)	✅	2.1.156 (Claude Code)
8. Ollama daemon + models	✅	4 models installed
9. Configs (.zshrc, ghostty, starship, atuin, mise, claude)	✅
10. Claude Code env in ~/.zshrc	✅
11. ANTHROPIC_BASE_URL guardrail	✅	claude stays on Anthropic cloud
12. macOS defaults (Finder/KeyRepeat/Dock/dashes)	✅
13. GPU cap (live + LaunchDaemon)	✅	122880 MB
14. GPU cap persistence (LaunchDaemon)	✅	reverts on reboot if missing
15. SSH + GitHub auth	✅	gh auth login + gh ssh-key add
16. Git commit signing (SSH via 1Password)	✅
17. MLX project (~/1_PROJECTS/mlx-lab)	✅
18. Cleanup (no dropped formulae/casks)	✅	dropped: procs, bottom, httpie, mstystudio, msty, rectangle, sleeve, wezterm, spotify
#	Prompt	What it does	When to run
0	Status	Read `00-STATUS.md` (the 5th gist file) to see ✅ done / 🟡 partial / ⬜ todo / ⚠️ drift for every phase. Regenerable via `~/m5-setup/verify.sh --status-md`	Any time — start here on every session
1	Audit	Reads current state of the Mac, writes a 3-bucket report	First thing on the new machine
2	Install	Installs everything from the MISSING list	After Prompt 1
3	Ghostty Polish	Verifies the 10-item polish block is present in Ghostty config (appends if missing)	After Prompt 2 (config must exist)
4	Claude Code Config	Configures Claude Code itself: settings, env, base MCPs	After Prompt 2
5	Verification	Smoke-tests the critical paths end-to-end	After Prompts 2-4
6	Debugging	When something breaks, investigate scientifically	Any time after install
7	Cleanup + Docs	Removes dropped items, syncs docs with reality	Any time after install
8	Final Review	Adversarial pass over the gist itself	Before declaring done
Tool	Command	What it does	Why you want it
eza	`eza`, `eza -la`	Lists files	Colored, shows git status (`M` modified, `??` untracked), nicer than `ls`
bat	`bat <file>`	Prints files with syntax highlighting + line numbers	`cat` with brain
fd	`fd <name>`	Finds files by name	3× faster than `find`, smart defaults, no `-name "*.py"` syntax
ripgrep	`rg <pattern>`	Greps inside files	10× faster than `grep`, respects `.gitignore` automatically
fzf	`Ctrl+R`, `Ctrl+T`	Fuzzy finder	Interactive picker, pipes into anything
zoxide	`z <dir>`	Smart cd	Learns directories you visit. `z proj` jumps to your most-used "proj"
lazygit	`lazygit`	Git TUI	Stage/commit/branch with keyboard only
yazi	`yazi`	File manager TUI	Vim-keys, image preview, multi-pane
gh	`gh pr create`	GitHub CLI	Create PRs, view issues, clone repos from terminal
jq	`jq '.foo'`	JSON processor	Filter/transform JSON in pipelines (`curl ... \| jq '.items[]'`)
yq	`yq '.foo'`	Same but YAML	For Kubernetes/CI configs
tree	`tree -L 2`	Print directory tree	When you need a visual of a folder structure
htop / btop	`htop`, `btop`	Process monitors	`top` with colors, mouse, killable processes (btop = pretty version)
dust	`dust`	Disk usage	Visual tree of where disk space is going (vs `du -sh *`)
duf	`duf`	Free disk space	Replaces `df`, color tables per filesystem
direnv	auto	Auto-load `.envrc`	Walk into a folder with `.envrc`, it auto-loads env vars. Walk out, they vanish. Magic for per-project secrets
tldr	`tldr <cmd>`	Short man pages	"How do I tar a folder?" → 3 examples instead of 300 lines of man
gnupg	`gpg`	GPG keys / encryption	Formula name is `gnupg`, binary is `gpg`. Used for git commit signing
mkcert	`mkcert example.local`	Local HTTPS certs	When you need HTTPS in dev (cookies, CORS)
mas	`mas install 12345`	Mac App Store CLI	Install paid App Store apps from script
xh	`xh GET ...`	Rust version of httpie	10× faster startup
doggo	`doggo example.com`	DNS lookup	`dig` modernized (the older `dog` is dead since 2020)
wget	`wget <url>`	Download files	Resume support, better than curl for big files
watch	`watch -n 2 ls`	Repeat a command	Re-runs every N seconds, shows the output
imagemagick	`magick convert`	Image processing	Resize, convert formats, optimize from terminal
yt-dlp	`yt-dlp <url>`	YouTube downloader	Maintained fork of youtube-dl
ncdu	`ncdu`	Interactive disk usage	Walk through folders to see what's eating space
Setting	What it does
`user.name` / `user.email`	Stamps every commit with these. Required — git refuses to commit without
`init.defaultBranch main`	New repos start with `main` instead of `master`
`pull.rebase false`	`git pull` does a merge by default (not rebase). Some teams prefer rebase — your call
Extension	What it does	Why for you
Obsidian Web Clipper	Capture any page → markdown → your Obsidian vault, one keybind	ADHD #1 win — capture without context-switch. Official, MIT, local-vault (no cloud)
Rabby Wallet	Multi-chain EVM wallet with tx simulation (preview state changes before signing)	Audit superpower — 100+ EVM chains, SlowMist + Cure53 audited. Pair with Brave Wallet for routine
Tenderly Dev Toolkit	Etherscan overlay: simulate/debug tx in-browser with modified params	bounty-lab essential — replay any exploit tx with different state
1Password browser extension	Autofill + Quick Access in browser, syncs lock state with desktop	You already pay for it via the desktop app — install from `1Password.app → Settings → Browsers → Install` (not the Web Store)
Extension	What it does
Unhook for YouTube	Hides Shorts, autoplay, recommendations, comments. Strips infinite-scroll dopamine trap. 1M+ users, local-only
Control Panel for Twitter	Hides For You feed, trends, "what's happening". Makes X usable for actual signal
ActivityWatch	Passive time tracking, 100% local (open-source). Combats ADHD time-blindness. Skip RescueTime (cloud + had CWS delisting scare)
Extension	What it does
React Developer Tools	Component tree, props, hooks, Profiler. Required for Vespera/Hazelab/Prevue
Refined GitHub	200+ GitHub UX fixes (better file tree, smart PR actions, fix annoyances). FOSS, weekly releases
Gitako	File-tree sidebar for any repo. FOSS, MIT — preferred over Octotree (freemium)
Extension	What it does
OneTab	Collapses 47 tabs to a list with one click. Direct counter to ADHD tab hoarding
Enhancer for YouTube	Picture-in-picture, speed control (0.07-16×), hide recommendations, default quality. Donationware. For podcasts in transit
SponsorBlock	Auto-skip YouTube sponsors/intros via crowdsourced timestamps. FOSS. Pair with Enhancer
Extension	When to install
DeepL Translate	If you write FR business email often — DeepL beats Google Translate on FR↔EN nuance (Hindi/Thai stick with Brave's built-in Google)
Polyteller	Polymarket orderbook + smart-money P&L overlay (your polymarket-agent v2 stack)
Etherscan Extension	Gas alerts + address highlight + quick on-chain lookup. Pair with Tenderly
axe DevTools	a11y audits for Vespera/Prevue (WCAG, keyboard nav)
Perplexity Sidebar	In-page AI Q&A with citations. Replaces "open new tab to Google" loop