feat(scf): Open the configuration file referenced by a systemd service's ExecStart

Signed-off-by: Dict Xiong <me@dxng.cn>
feat(zshrc): nor use nh if available
2026-11-02 10:08:15 +08:00 · 2026-08-26 18:01:07 +08:00 · 2026-08-22 01:56:06 +08:00 · 2026-08-20 16:37:43 +08:00 · 2026-08-17 18:33:33 +08:00 · 2026-08-13 20:10:55 +08:00
44 changed files with 3878 additions and 504 deletions
--- a/.eid/authorized_certificates
+++ b/.eid/authorized_certificates
@@ -0,0 +1,61 @@
+-----BEGIN CERTIFICATE-----
+MIIFIDCCAwigAwIBAgIUK1zXH5UosBim7i+kIZyPGpowU9cwDQYJKoZIhvcNAQEL
+BQAwgZUxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdCRUlKSU5HMRAwDgYDVQQHDAdC
+RUlKSU5HMRIwEAYDVQQKDAlEaWN0IFRlY2gxEDAOBgNVBAsMB1Jvb3QgQ0ExHjAc
+BgNVBAMMFURpY3QgVGVjaCBSb290IENBIC0gMDEcMBoGCSqGSIb3DQEJARYNbWVA
+YmVhcmRpYy5jbjAeFw0yMjA3MjIxNzU5MjNaFw0yNTA3MjExNzU5MjNaMEkxEjAQ
+BgNVBAoMCURpY3QgVGVjaDEQMA4GA1UECAwHQkVJSklORzELMAkGA1UEBhMCQ04x
+FDASBgNVBAMMC3NrMC5pYmQuaW5rMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAlDeyFxeJ5RXFX4B3rIIpNyyAIl5VTGCT5t8g9dxFWq0MeY6nQYJPA8IJ
+IH+KzzujBabyKYpzshDvMzkuhx0Kwi2VL+ckxWg5FLge3kNBJqYnBm5pPWx6o9R5
+DmcWqG5KRH0FJhSmL5KeBHsVcOurDtKn174x2eB+sggCSyuWlJyn4KxPLTg8z/Nr
+FP5qSY1vj6t7mpzau+eIGh8IcQiFxteN/86fKswQHint/MVaqg6vX05BuIb8xb5E
+XUvPIupdc/vtD959BxnTo7UoOz+3zu/u2cj2K9IDubwe9tDpv88aj6xnfXInFouD
+/mlSmvtLo1h/6arn1hurgoylh5wbOwIDAQABo4GyMIGvMAkGA1UdEwQCMAAwCwYD
+VR0PBAQDAgTwMB0GA1UdDgQWBBR9DxLqtR0+zUWoPyFoDRrnyJyDBTAfBgNVHSME
+GDAWgBRsprmVI/Tjey+sw4qoZpLd7PT0gTBVBgNVHSUETjBMBggrBgEFBQcDAgYI
+KwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCN0MBAQYKKwYBBAGC
+N0MBAgYKKwYBBAGCNxQCAjANBgkqhkiG9w0BAQsFAAOCAgEA7BJXiRg32shmZWyY
+gPjq52ffN9RDNe58KadajJ1PnVP1yNJySgsOG3eSxONQX3ITr36Ihsfb3fZneBfX
+/IcXgjyvy1CDcvBBAyee91hdR8orMCePqMpeOSNP9CUp9Ctd4V+an0DE8Z1yrezA
+ieaYgBZCDxuZdloYSmj9Z/Rqn2dy4dcUAxKrEwW/6VPqQNrJETTtadS1SF0EsDxV
+XZpDqNYaS/N7/ciSm7TaQJud62A4m+FWWHNnttTp9IjLESr3U80+qtRY8yDNpulb
+/eNL8KK9aORiFUz9789l6M62HPi6vCsMflI0iHUeoi69GKX8mKf0WFR1KxoDsJiN
+DG9/1gCfj6whFCrT6fJTKAGl8Hp5toWMOeDprbsE5gf4Ik3p+sKMV9t43zNm3gvA
+1zNPtgQUffPU0kONlavIxUNfCmD8qVwK5ECT7wh0hrB8fRYfxTZHgN6Yvu7M9HNz
+SNt5JZCLBT4nLt0uQp9O/xctdHElZw+/W8OfnP5vxnPdccIeVOxpGIyzErwjD0+E
+9mNiqOa5JV9OMAJ+0I9cbOnuMaXm4mvHZadnetUzq2ZUw1Jba7z62zIJTciNRq9i
+ZJc6v5e+iqbE1ECZLco5LjWqqfvFfYCrkqeOhCRsRkVPsXnGPo2QDDYdTm4EGCmg
+dVZ6R452SZsrE4V+3LR011BxzEg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFQDCCAyigAwIBAgIRAJmQ852eXApHBvrQujWaFAEwDQYJKoZIhvcNAQELBQAw
+ODESMBAGA1UEChMJRGljdCBUZWNoMSIwIAYDVQQDExlEaWN0IFRlY2ggSXNzdWlu
+ZyBDQSAyMDI2MB4XDTI2MDgxMjE1NTQyM1oXDTI5MDgyMTExMDAwMFowKzESMBAG
+A1UEChMJRGljdCBUZWNoMRUwEwYDVQQDEwxzazEuZHhuZy5uZXQwggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAkkF0Qc1YhhgmgZcujjfyn3liCxAAJSGl
+Eme0eD6s908zm95mGd64fQJSoYVaFt5y9wrQLdWX16c+gvRyNaQdPfs5jxaP+G8V
+r6PkkE79hwauEOQOTbr+q3bQJmfLe56cMV7oHrKVFffkJQTvp1mcK4+CYytsxJP5
+v0m5TDyv4op6VcZ2m0gdrFEBV3DMMgsqF6/tSPkqbTTj9fMMSOFzXPq7qEQWgYmx
+T+M0iQdgEiG7Z+INkofM56tBmQ7jSeO65/FTytB6ZMiI23NGmTmYvHPyxSDWXL0X
+7tX42S0/A7QhxZHN0GUD0NGaSExLfgTawRLhARVHbUXC9iu5aCArAgMBAAGjggFQ
+MIIBTDAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0lBCQwIgYIKwYBBQUHAwIGCisGAQQB
+gjcUAgIGCisGAQQBgjdDAQEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUOyThWF2A
+BkoQv9xljyo3fFOclq0wHwYDVR0jBBgwFoAU9qXPjCjcil59akpPVISS8Yu/Jc0w
+SgYIKwYBBQUHAQEEPjA8MDoGCCsGAQUFBzAChi5odHRwOi8vdG9vbHMuZHhuZy5j
+bi9jZXJ0cy9pc3N1aW5nLWNhLTIwMjYuY2VyMCoGA1UdHwQjMCEwH6AdoBuGGWh0
+dHA6Ly9jYS5pYmQuaW5rLzEuMC9jcmwwRwYMKwYBBAGCpGTGKEABBDcwNQIBAQQD
+cGl2BCtaMnFWY05lMzlUaHZyc3RIbFVFWE5laXg1QXd2aFU3MjBlWEFFZWRlUG4w
+MA0GCSqGSIb3DQEBCwUAA4ICAQCKSLjnMOlQiZ381IaBEl4iT7pCvY0QQxsVEMDD
+RWYhIImx3JJDt7kiZXcJwlH70VG0opSz9eKrT3cw7OY6DnNm7Bm0JT2fJgyCSnWo
+nG7J1soE74Rl2MiNnP1JTqhFlZKLrmIb6eP4U0eM+ZaJ7luyxizqiJAeRyJB+YCe
+DM9uZ7rC33DYZeZ46V4f7DfJ23TjVJvaX/NFu0Ab/7ylF6X7frT8xf11XLlE2IyR
+MmnLtQiREXXETaw9l5suMuH8fmVg01QrqnOHmz4r9Nuzh7vHxogEsJtgBLhv2Min
+X6IfaKABhFXk1cVZGNgaC0Pao6cYbaWJwF2zcVHGq5EDKXhkKmCLeDo9em0rOJ2y
+fU23yP3ByMGJ3Xi7nI8E5dfSw6Q39b3t1/kxj1y8T3PGdTN/3vFLVqf5A7XXdQL9
+/uy2lYh3Fud/aZuthZyoL2rkC4O8N4seqfNIOBEHAmfbk5j6LoFFwSTrRGqzCAf4
+4r6ckHjL3KBnR8EeMwwit324iRYd3ppUL3TINkeiHRNFVKU0flUvcG6T0v+hC2sX
+yupYy0wylkonub6L0gUIINqx38nsDCR07eAfsDXJshIwTxUBFrVpKjPK7jVQOZ6+
+9/yPu72BhyGMZs4bgYMEPwqKTbzUNitO2WfBIgXhzGe8YzMA1U2BMTRT0nIQ6oa9
+8YbnQw==
+-----END CERTIFICATE-----
--- a/.gitconfig2
+++ b/.gitconfig2
@@ -1,5 +1,23 @@
 [user]
-	email = me@beardic.cn
+    email = me@dxng.cn
    name = Dict Xiong
+    signingkey = 3E241558655D7FE06C6711A5A5D6250D1806CAA8
 [core]
    editor = vim
+    # test this by `git update-index --test-untracked-cache`
+    # disable this by setting `GIT_DISABLE_UNTRACKED_CACHE`
+    untrackedCache = true
+    quotepath = false  # chinese chars
+[push]
+    autoSetupRemote = true
+[pull]
+    ff = only
+[branch]
+    # Show most recently changed branches first.
+    sort = -committerdate
+[help]
+    autocorrect = 1
+[init]
+    defaultBranch = main
+[log]
+    date = iso
--- a/.github/workflows/gitee_sync.yml
+++ b/.github/workflows/gitee_sync.yml
@@ -1,27 +1,22 @@
 name: sync repos to gitee
 on:
-  push:
-    branches: 
-      - main
-      - dev
-  schedule:
-    - cron: 10 4 * * *
+  push: ~
  workflow_dispatch: ~
 jobs:
  dotfiles:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: DictXiong/dotfiles  # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: DictXiong/dotfiles
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/DictXiong  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/DictXiong
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: user
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "dotfiles"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "dotfiles"
+        timeout: '600s'
--- a/.github/workflows/gitee_sync_dependencies.yml
+++ b/.github/workflows/gitee_sync_dependencies.yml
@@ -5,104 +5,138 @@ on:
  workflow_dispatch: ~
 jobs:
  ohmyzsh:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: ohmyzsh repo  # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: ohmyzsh repo
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/ohmyzsh  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/ohmyzsh
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: org
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "ohmyzsh"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"  # https/ssh
+        debug: true  # print all commands
+        force_update: true
+        static_list: "ohmyzsh"
+        timeout: '600s'
  zsh-users:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: zsh-users repos  # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: zsh-users repos
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/zsh-users  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/zsh-users
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: org
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "antigen,zsh-syntax-highlighting,zsh-autosuggestions,zsh-completions"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "antigen,zsh-syntax-highlighting,zsh-autosuggestions,zsh-completions"
+        timeout: '600s'
+  zdharma-continuum:
+    runs-on: ubuntu-latest
+    steps:
+    - name: zdharma-continuum repos
+      uses: Yikun/hub-mirror-action@v1.5
+      with:
+        src: github/zdharma-continuum
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
+        src_account_type: org
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "fast-syntax-highlighting"
+        timeout: '600s'
  tmux-mem-cpu-load:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: thewtex/tmux-mem-cpu-load  # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: thewtex/tmux-mem-cpu-load
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/thewtex  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/thewtex
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: user
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "tmux-mem-cpu-load"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "tmux-mem-cpu-load"
+        timeout: '600s'
  tmux-plugins:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: tmux-plugins # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: tmux-plugins
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/tmux-plugins  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/tmux-plugins
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: org
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "tpm,tmux-resurrect"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "tpm,tmux-resurrect,tmux-yank"
+        timeout: '600s'
  vundle-vim:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: VundleVim/Vundle-vim # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: VundleVim/Vundle-vim
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/VundleVim  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/VundleVim
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: org
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "Vundle.vim"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "Vundle.vim"
+        timeout: '600s'
  onedark-vim:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
-    - name: joshdick/onedark-vim # 名字随便起
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+    - name: joshdick/onedark-vim
+      uses: Yikun/hub-mirror-action@v1.5
      with:
-        src: github/joshdick  # 源端账户名(github)
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src: github/joshdick
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
        src_account_type: user
-        dst_account_type: user  # 账户类型
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
-        debug: true  # 启用后会显示所有执行命令
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
-        static_list: "onedark.vim"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "onedark.vim"
+        timeout: '600s'
+  fzf:
+    runs-on: ubuntu-latest
+    steps:
+    - name: junegunn/fzf
+      uses: Yikun/hub-mirror-action@v1.5
+      with:
+        src: github/junegunn
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
+        src_account_type: user
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "fzf"
+        timeout: '600s'
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -0,0 +1,90 @@
+name: test
+on: 
+  push: ~
+  workflow_dispatch: ~
+jobs:
+  test-ubuntu:
+    name: test on ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      
+      - name: install dfs
+        run: |
+          rev=`git rev-parse HEAD`
+          pwd
+          set -x
+          DFS_NO_WALL=0 ./install.sh -adl
+          test `git rev-parse HEAD` = "$rev"
+
+      - name: antigen build
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: |
+          echo $SHELL
+          antigen list
+
+      - name: run tests and reset
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: |
+          source tools/test.zsh
+          antigen reset
+          rm -rf $ANTIGEN $HOME/.antigen $HOME/.config/dotfiles
+          ./install.sh -dl
+
+      - name: antigen build with DFS_NO_WALL
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: |
+          echo $SHELL
+          antigen list
+
+      - name: run tests
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: source tools/test.zsh
+  
+  test-autodep:
+    name: test of auto-install dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: remove dependencies
+        run: |
+          sudo apt-get -y remove curl vim
+
+      - name: checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: install dfs
+        run: |
+          rev=`git rev-parse HEAD`
+          set -x
+          ./install.sh -dal
+          test `git rev-parse HEAD` = "$rev"
+
+      - name: antigen build
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: |
+          echo $SHELL
+          antigen list
+
+  test-get-dotfiles-cn:
+    name: test of get.dotfiles.cn script
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: run the script
+        run: |
+          repo=https://github.com/DictXiong/dotfiles bash tools/get.dotfiles.cn -asl
+
+      - name: run tests
+        shell: /bin/zsh -ileo PIPE_FAIL {0}
+        run: |
+          dfs cd
+          source tools/test.zsh
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 *.zwc
+update.sh
--- a/.ssh/authorized_keys2
+++ b/.ssh/authorized_keys2
@@ -1,28 +1,23 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD5VPD5c/pBtQM5mcKMzJ6vC2jDdVJU6ifkP1EvAeV/dKEyy5hOc+EXC8Ws7bAp3a7twvsQGSqNbeXuAO4PzX2KHhI49KiFyRugo8LsUF3TVVluOXtGWKgw+36TBO3rNFgWOnhw5B4IlNtxo2nk4grCkgEsE6w+Ignd+FrEFec457oal2SPN02TjUfRULaEPSpZTl7cA/5Re9/QmlcYjuyA9zbkO98KYA0M71W/eUcjfjNEaWXjn2pcloakoWwEEdi4v/yJ1Fk+gQYcbpoftxpWmWLvFhDGP+qvTZY5QHxDxiPbc3HDdx0qBvMOQW9XSt0J/L/btnxcZvA1lDtkC2bm8zvHxtLBZ9JBRutMbRhdSgkd3+5DwHDIO0EIUqckgCfX3t7avj5RsPAl0j4V40yB637YQim7saN3FWq43SpR3i6buNbQLPdgy2SDN6fAZcAPWvifE1KG7I2BtmiFFYjAy3iU1KD2Hgn6mIpOOCZOJV30/cf3Oq8ZSDfD7PmDu72yOea3h9JlvkKjjqknnF4NdQ5cy1FuIfyebnF6+ugbdA9UqY9PZdnuwy5RkwkmJwC4AVO3GaOfuQDU61UMSoTfYH1yB8x8HHUQcJzLtfExrYpVPAo89tyN1lcIIBUBoHhNMCwVBZipfV/H41cIxs5wkHsolQ02zZaAX6Cgbii9FQ== home
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPmMImRSAhksHUfCwNpcj61izGn0Xkv1KRIuxb0OSdJl pc0/old
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4K5S3zDYbxlw7B45zOdmKud95nXU1V6kSxEvbTOsy2 pc1/old
-
 # keys below are the new security system starting from 2022-07
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGdLJYOrBhWERmkQ+sNM8tGzJ37UBEKkEuhbtE9B65mOAAAABHNzaDo= sk0/fido

 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGakUcSuNhuH7tk+Nj9gDfRtxYfGPL9yb8toQ/EpSJAM openpgp:0xD9271B01

-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0.ibd.ink/piv/9a
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJ4FeeBwPcUe25JsZQ7xDmGtFVeO1TQ9332IPjFY0Xm openpgp:0x8774BF70

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV/6cLUGA5YWVI6uPhIBOBZvlNBlZLkehHQN0Gxnc+B ltp0/ubuntu
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0/piv/9a

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILqRfdez8IAOf6m9Ysi3uSNKEG0Xi6GPuhA6R2fci2yB ltp0/windows
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAkkF0Qc1YhhgmgZcujjfyn3liCxAAJSGlEme0eD6s908zm95mGd64fQJSoYVaFt5y9wrQLdWX16c+gvRyNaQdPfs5jxaP+G8Vr6PkkE79hwauEOQOTbr+q3bQJmfLe56cMV7oHrKVFffkJQTvp1mcK4+CYytsxJP5v0m5TDyv4op6VcZ2m0gdrFEBV3DMMgsqF6/tSPkqbTTj9fMMSOFzXPq7qEQWgYmxT+M0iQdgEiG7Z+INkofM56tBmQ7jSeO65/FTytB6ZMiI23NGmTmYvHPyxSDWXL0X7tX42S0/A7QhxZHN0GUD0NGaSExLfgTawRLhARVHbUXC9iu5aCAr sk1/piv/9a

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFO4k0tJ+Bfu95Uavg/5P3EXMKNcq+bMqaTqzkvRZ7ji ltp1/ubuntu
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA71ukY9nzzeAGp9WYstPYiIwexzIANlPwMQ68QNQwqxAAAABHNzaDo= sk1/fido2

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8g34WHLEix6Qt0J/ClYbZeb9wh+p1IOcZkz/vNbZrv ltp1/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMyZILj+GxTUhdCgz2w1TxQ+aTcggnOJIb84qA4u271S ltp0

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0

-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8WHIpwdZl7+HIZfQpwIAhpxT1huI9sd6Ydeokilg5l pc1/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLYgVj+NPino6sOmahULN7SbAMaVAgzqPfDjz2S8zDv pc1

-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ/+BWSTv3w1Ru9ksfse3EUbu4ukJruUU94fCG7Sk+5g3+F80KqJGykP9tHueU07iZfAuaYj7Zcy+IWx9Ih+eYA= ph0/sep
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF52mPmbLEriZ+DfmrMHFtvg2kiO2JpRpitvs7PbJowh home0

 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNvHya5i3GNniGww9Yx5ikos4Z5jevu8zz8hCQi05++SgejFPnbw9UjbHFjODK2M+ZHuhRF5mdf996r4/BxWyP8= pad0/sep
+
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMXu7UND6N1EKcbeSeAj2CwzGA3sM5/bRtLwoY0euWdR4vzB0nwcwd6nct5JCEyozjujJfMt8d7oCzhSt1w/1cU= ip17/sep
--- a/.tmux.conf2
+++ b/.tmux.conf2
@@ -1,5 +1,7 @@
 set -g prefix ^a
-set -g mouse off
+bind ^a send-prefix
+set -g mouse on
+set -g set-clipboard on
 set -g default-terminal "xterm-256color"
 set -g history-limit 10000

@@ -23,8 +25,20 @@ bind - split-window -v -c "#{pane_current_path}"
 bind | split-window -h -c "#{pane_current_path}"

 # other key bindings
+## prefix r: reload conf
 bind r source-file ~/.tmux.conf \; display-message "tmux.conf reloaded"
+## prefix m: toggle mouse mode
 bind m run 'old=$(tmux show -gv mouse); new="off"; if [ "$old" = "off" ]; then new="on"; fi; tmux set -g mouse $new && tmux display-message toggle\ mouse\ mode\ $new'
+## prefix C-x: pane sync
+bind C-x set-window-option synchronize-panes\; display-message "synchronize-panes is now #{?pane_synchronized,on,off}"
+## tmux 3.6+: copy selection without jumping to the end
+bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-selection
+bind -T copy-mode MouseDragEnd1Pane send-keys -X copy-selection
+## F12: passthru
+bind -T root F12 set prefix None \; set key-table off \; set status-bg red \; refresh-client -S
+bind -T off F12 set -u prefix \; set -u key-table \; set -u status-bg \; refresh-client -S
+## ESC: exit copy mode
+bind -T copy-mode-vi Escape send-keys -X cancel

 # styles
 # status bar
--- a/.update.sh
+++ b/.update.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+THIS_FILE=$(basename "${BASH_SOURCE}")
+source "$THIS_DIR/tools/common.sh"
+
+DFS_UPDATED_RET=${DFS_UPDATED_RET:-0}
+DFS_UPDATE_CHANNEL=${DFS_UPDATE_CHANNEL:-"main"}
+
+# send beacon online
+apost_beacon "sys.online"
+
+# update dns
+if [[ "$DFS_DDNS_ENABLE" == "1" ]]; then
+    fmt_info "updating dns ..."
+    if ! is_tty; then
+        time_to_sleep=$((RANDOM%600))
+        fmt_note "sleep for $time_to_sleep seconds"
+        sleep $time_to_sleep
+    fi
+    "$THIS_DIR/tools/frigg-client.sh" ddns || (fmt_error "failed to update dns" && apost_beacon "dfs.ddns.fail")
+fi
+
+# fetch origin
+cd $DOTFILES
+git fetch --all --prune
+if [[ -n "$(git status -s)" ]]; then
+    fmt_error "directory not clean"
+    apost_beacon "dfs.dirty"
+    exit
+fi
+
+# get the specified commit id
+case $DFS_UPDATE_CHANNEL in
+    "main" ) DFS_COMMIT=$(curl $DFS_CURL_OPTIONS -fsSL https://api.beardic.cn/get-var/dfs-commit-id) ;;
+    "dev" ) DFS_COMMIT=$(git rev-parse origin/dev 2> /dev/null) || DFS_COMMIT=$(git rev-parse origin/main) ;;
+    "latest" ) DFS_COMMIT=$(git for-each-ref --sort=-committerdate refs/heads refs/remotes --format='%(objectname)' | head -n 1) ;;
+    * ) fmt_fatal "invalid update channel: $DFS_UPDATE_CHANNEL" ;;
+esac
+if [[ ${#DFS_COMMIT} != 40 ]]; then
+    fmt_error "invalid commit id"
+    apost_beacon "dfs.invalid-commit" "invalid commit id: ${DFS_COMMIT}"
+    exit
+fi
+
+# update
+if [[ "$(git rev-parse HEAD)" == "$DFS_COMMIT" ]]; then
+    fmt_info "nothing to do"
+else
+    fmt_info "checking out to commit $DFS_COMMIT ..."
+    if [[ -z "$DFS_DEV" || "$DFS_DEV" == "0" ]]; then
+        post_beacon "dfs.updated"
+        git -c advice.detachedHead=false checkout $DFS_COMMIT
+        cp ./.update.sh ./update.sh && chmod +x ./update.sh && exit $DFS_UPDATED_RET
+    else
+        fmt_warning "won't really checkout in dev mode"
+    fi
+fi
--- a/.vimrc2
+++ b/.vimrc2
@@ -10,12 +10,14 @@ filetype plugin indent on
 " end vundle
 colorscheme onedark

+syntax on
 set cursorline
-set syntax=on
 set autoindent
 set smartindent
-set tabstop=4
 set expandtab "spaces instead of tabs
+set tabstop=4 softtabstop=4 shiftwidth=4
+autocmd FileType c,cpp,nix,yaml setlocal tabstop=2 softtabstop=2 shiftwidth=2
+set backspace=indent,eol,start
 set number "line numbers
 set history=1000
 set ignorecase "when searching
@@ -30,6 +32,7 @@ hi User3 ctermfg=15 ctermbg=2
 au InsertEnter * hi User3 ctermfg=15 ctermbg=5 
 au InsertLeave * hi User3 ctermfg=15 ctermbg=2
 set statusline=%3*\ %{mode()}\ %*[%n][%F](%{\"\".(&fenc==\"\"?&enc:&fenc).((exists(\"+bomb\")\ &&\ &bomb)?\"+\":\"\").\"\"},%{&ff},%Y)%2*%r%1*%m%*%<%=\'0x%B\'\ [Line:%l/%L,Col:%c][%p%%]
+nnoremap <silent> <C-n> :let [&nu, &rnu] = [!&rnu, &nu+&rnu==1]<cr>

 " When editing a file, always jump to the last known cursor position.
 " Don't do it when the position is invalid, when inside an event handler
--- a/.zshrc2
+++ b/.zshrc2
@@ -1,22 +1,43 @@
+# env for shell
 export TERM="xterm-256color"
-export LC_ALL=C.UTF-8
-export LANG=C.UTF-8
+if (command -v locale >/dev/null) && ( locale -a | grep -qxE "C.UTF-8|C.utf8" ); then
+    export LC_ALL=C.UTF-8
+    export LANG=C.UTF-8
+else
+    export LC_ALL=en_US.UTF-8
+    export LANG=en_US.UTF-8
+fi
+export DOTFILES=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+export PATH="$PATH:$DOTFILES/scripts"
+fpath=($DOTFILES/functions $fpath)
+export EDITOR='vim'
+# env for apps
+export PYTHONIOENCODING='UTF-8'
+export GPG_TTY=$(tty)
+export LESS_TERMCAP_md=$'\E[01;33m'
+export VIRTUAL_ENV_DISABLE_PROMPT=1
+# env for dfs
+if [[ -f ~/.config/dotfiles/env ]]; then set -a; source ~/.config/dotfiles/env; set +a; fi
+export DFS_OS_TYPE="$("$DOTFILES/tools/common.sh" get_os_type)"

 # antigen
-
-# if test -z "$NO_WALL"; then
-#     ANTIGEN_OMZ_REPO_URL="https://mirrors.tuna.tsinghua.edu.cn/git/ohmyzsh.git"
-#     ANTIGEN_URL="https://raw.fastgit.org/zsh-users/antigen/master/bin/antigen.zsh"
-#     GIHUB_PROXY="https://hub.fastgit.xyz/"
-# else
-#     ANTIGEN_URL="git.io/antigen"
-#     GIHUB_PROXY=""
-# fi
-# antigen bundle ${GIHUB_PROXY}zsh-users/zsh-syntax-highlighting
-# antigen bundle ${GIHUB_PROXY}zsh-users/zsh-completions
-# antigen bundle ${GIHUB_PROXY}zsh-users/zsh-autosuggestions
-ANTIGEN_OMZ_REPO_URL="https://gitee.com/dictxiong/ohmyzsh.git"
-ANTIGEN_URL="https://gitee.com/dictxiong/antigen/raw/develop/bin/antigen.zsh"
+if [[ "$DFS_NO_WALL" == "1" ]]; then
+    ANTIGEN_URL="https://raw.githubusercontent.com/zsh-users/antigen/develop/bin/antigen.zsh"
+    ANTIGEN_OMZ_REPO_URL="https://github.com/ohmyzsh/ohmyzsh.git"
+    ANTIGEN_PLUGINS=(
+        "https://github.com/zdharma-continuum/fast-syntax-highlighting"
+        "https://github.com/zsh-users/zsh-completions"
+        "https://github.com/zsh-users/zsh-autosuggestions"
+    )
+else
+    ANTIGEN_URL="https://gitee.com/dictxiong/antigen/raw/develop/bin/antigen.zsh"
+    ANTIGEN_OMZ_REPO_URL="https://gitee.com/dictxiong/ohmyzsh.git"
+    ANTIGEN_PLUGINS=(
+        "https://gitee.com/dictxiong/fast-syntax-highlighting"
+        "https://gitee.com/dictxiong/zsh-completions"
+        "https://gitee.com/dictxiong/zsh-autosuggestions"
+    )
+fi
 ANTIGEN="$HOME/antigen.zsh"
 # Install antigen.zsh if not exist
 if [ ! -f "$ANTIGEN" ]; then
@@ -40,84 +61,175 @@ if [ ! -f "$ANTIGEN" ]; then
 fi
 # config and enable antigen
 source "$ANTIGEN"
-antigen use oh-my-zsh
 # enable plugins
-antigen_plugins=( \
-    "command-not-found" \
-    "docker" \
-    "extract" \
-    "fzf" \
-    "git" \
-    "ripgrep" \
-    "thefuck" \
-    "tmux" \
-    "ufw" \
-    "z" \
-    "https://gitee.com/dictxiong/zsh-syntax-highlighting" \
-    "https://gitee.com/dictxiong/zsh-completions" \
-    "https://gitee.com/dictxiong/zsh-autosuggestions" \
+antigen use oh-my-zsh
+ANTIGEN_PLUGINS+=(
+    "command-not-found"
+    "docker"
+    "extract"
+    "fzf"
+    "git"
+    "magic-enter"
+    "man"
+    "per-directory-history"
+    "pip"
+    "podman"
+    "python"
+    "ripgrep"
+    "rsync"
+    "systemd"
+    "timer"
+    "tmux"
+    "web-search"
+    "z"
 )
-for i in ${antigen_plugins[*]}
-do
+for i in ${ANTIGEN_PLUGINS[*]}; do
    if [[ -z $ANTIGEN_EXCLUDE || ! $i =~ $ANTIGEN_EXCLUDE ]]; then
        antigen bundle $i
    fi
 done
 # select theme
-antigen theme ${ZSH_THEME:-ys}
+TMP_THEME=ys
+if [[ -e /.dockerenv ]]; then
+    TMP_THEME=robbyrussell
+    echo "==========================="
+    echo "This is in docker container"
+    echo "==========================="
+fi
+antigen theme ${ZSH_THEME:-$TMP_THEME}
 # apply 
 antigen apply
 # end of antigen config

-# functions
-export DOTFILES=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
-
-SUDO=''
-if (( $EUID != 0 )); then
-    SUDO='sudo'
-fi
-
-dfs()
-{
-	case $1 in
-		update ) (cd "$DOTFILES" && git pull) ;;
-		force-update ) (cd "$DOTFILES" && git fetch --all && git reset --hard origin/main && git pull) ;;
-		reset  ) 
-			antigen reset 1> /dev/null
-			rm -rf $HOME/.antigen
-			$DOTFILES/install.sh -r
-			dfs update
-			$DOTFILES/install.sh -i
-			echo 'Done. Please open a new shell to see the changes.'
-			;;
-		cd     ) cd "$DOTFILES" ;;
-		*      ) echo "unknown command \"$1\". available: update, force-update, reset, cd" ;;
-	esac
-}
-
-dogo()
-{
-	if [[ -z "$1" || "$1" =~ "-h|--help" ]]; then
-		echo "usage: dogo <container>"
+# beacon
+if [[ -z "$DFS_INITED" && -z "$CI"  ]]; then
+    if [[ "$EUID" == "0" ]]; then
+        "$DOTFILES/tools/common.sh" apost_beacon "sys.login.root" "$(who am i | sed -E 's/ +/ /g' | awk '$1=$1')" 2>/dev/null
    else
-		$SUDO docker exec -it $1 zsh
+        "$DOTFILES/tools/common.sh" apost_beacon "sys.login.user" "$(who am i | sed -E 's/ +/ /g' | awk '$1=$1')" 2>/dev/null
    fi
-}
+fi

 # alias
 alias "pls"='sudo $(fc -ln -1)'
 alias "se"='sudo -sE'
+alias "sl"='sudo zsh -l'
+if [[ "$DFS_OS_TYPE" == "linux" ]]; then alias "ping"='ping -n'; alias "ping6"='ping6 -n'; fi
+if [[ "$DFS_OS_TYPE" == "msys" ]]; then alias "tmux"='script -qO /dev/null -c "tmux -u"'; fi
 alias "pbd"='ping baidu.com'
 alias "p114"='ping 114.114.114.114'
-alias "p666"='ping6 2001:da8::666'
-alias l='ls -lAGh --time-style="+%y-%m-%d %H:%M"'
+alias "p666"='ping6 240c::6666'
+alias "cbd"='curl http://www.baidu.com'
+alias "cbds"='curl https://www.baidu.com'
+alias "gdebug"='git add -A; git commit --allow-empty -m "bug fix ($(date))"'
+alias "ls"='ls --color=tty --time-style="+%y-%m-%d %H:%M"'
+alias "l"='ls -lAGh'
+alias "jc"='journalctl'
+alias "jce"='jc -e'
+alias "jceu"='jc -eu'
+alias "jcf"='jc -f'
+alias "jcfu"='jc -fu'
+alias "sc"='systemctl'
+alias "t"='tmux'
+gbes() { git for-each-ref --sort=-committerdate refs/heads refs/remotes --format="%(authordate:format:%y-%m-%d.%a %H:%M %z)|%(color:red)%(objectname:short)|%(color:yellow)%(refname:short)%(color:reset)|%(color:reset)%(authorname): %(color:green)%(subject)" --color=always | column -ts"|" | less -FX ; }
+sagt() {
+    local output
+    output="$("$DOTFILES/tools/sagent.sh" "$@")" || return $?
+    eval "$output"
+}
+## nixos
+use() { nix --experimental-features nix-command --extra-experimental-features flakes shell "${(*)@/#%(#b)([^#]#)/nixpkgs#$match}" ; }
+bnd() {
+    if [[ -n "$1" && -d "./hosts/$1" ]]; then
+        nixos-rebuild --flake .#$1 build || return $?
+        nix-diff /opt/NixOS-Config/results/hosts/$1 ./result --color=always | less
+    else
+        echo host $1 does not exist
+    fi
+}
+nor() {
+    test -n "$1" || { echo fatal: no verb given; return 1; }
+    local verb="$1"
+    local flake=".${2:+#$2}"
+
+    if command -v nh >/dev/null 2>&1 && [[ "$verb" != dry-build && "$verb" != dry-activate ]]; then
+        nh os "$verb" --bypass-root-check "$flake"
+    else
+        nixos-rebuild "$verb" --flake "$flake"
+    fi
+}
+alias 'nors'='nor switch'
+alias 'norbt'='nor boot'
+alias 'nort'='nor test'
+alias 'norb'='nor build'
+alias 'nordb'='nor dry-build'
+alias 'norda'='nor dry-activate'
+

 # key bindings
-bindkey "^b" beginning-of-line
-bindkey "^e" end-of-line
-bindkey "^[[H" beginning-of-line
-bindkey "^[[F" end-of-line
-bindkey "^[[1~" beginning-of-line
-bindkey "^[[4~" end-of-line
-bindkey "^[OH" beginning-of-line
-bindkey "^[OF" end-of-line
+bindkey "^b" beginning-of-line  # ctrl+b
+bindkey "\eOH" beginning-of-line
+bindkey "\e[H" beginning-of-line  # home; termius
+bindkey "\e[1~" beginning-of-line
+
+bindkey "^e" end-of-line  # ctrl+e
+bindkey "\eOF" end-of-line
+bindkey "\e[F" end-of-line  # end; termius
+bindkey "\e[4~" end-of-line
+
+bindkey "\ef" forward-word  # alt+f
+bindkey "\e[5C" forward-word
+bindkey "\e\e[C" forward-word  # alt+right_arrow; iterm2
+bindkey "\e[1;5C" forward-word  # alt+right_arrow; termius
+
+bindkey "\eb" backward-word  # alt+e
+bindkey "\e[5D" backward-word
+bindkey "\e\e[D" backward-word  # alt+left_arrow; iterm2
+bindkey "\e[1;5D" backward-word  # alt+left_arrow; termius
+
+bindkey "\ed" delete-char  # alt+d
+
+# mods
+autoload zcalc
+
+# dfs
+dfs()
+{
+    setopt local_options err_return pipe_fail
+    case $1 in
+        cd     ) cd "$DOTFILES" ;;
+        update ) "$DOTFILES/update.sh" ;;
+        version ) (cd "$DOTFILES" && git rev-parse HEAD) ;;
+        vversion ) (cd "$DOTFILES" && git show) ;;
+        config )
+            mkdir -p ~/.config/dotfiles
+            $EDITOR ~/.config/dotfiles/env
+            ;;
+        force-update ) (
+            cd "$DOTFILES"
+            git fetch --all
+            ref=$(git symbolic-ref --short HEAD 2> /dev/null)  || ref=$(git rev-parse --short HEAD 2> /dev/null)  || return 0
+            for i in $(git for-each-ref refs/heads --format='%(refname)') ; do git checkout ${i#refs/heads/} ; git pull --ff-only ; done
+            git checkout -c advice.detachedHead=false $ref)
+            ;;
+        reset  )
+            antigen reset 1> /dev/null
+            rm -rf $HOME/.antigen
+            "$DOTFILES/install.sh" -r
+            dfs update
+            "$DOTFILES/install.sh" -i
+            echo 'Done. Please open a new shell to see the changes.'
+            ;;
+        beacon ) "$DOTFILES/tools/common.sh" "post_beacon" "$2" "$3" ;;
+        *      ) echo "unknown command \"$1\". available: update, force-update, version, reset, cd, log" ;;
+    esac
+}
+
+# motd
+if [[ "$DFS_INITED" != "1" && -n "$DFS_UPDATE_CHANNEL" && "$DFS_UPDATE_CHANNEL" != "main" ]]; then
+    echo dotfiles not in the main channel. use with caution.
+fi
+
+# clean
+unset i
+export DFS_INITED=1
--- a/README.md
+++ b/README.md
@@ -1 +1,58 @@
 # dotfiles
+
+My personal shell environment and command-line tools, mainly for Linux and
+NixOS systems.
+
+It includes configurations for zsh, tmux, Vim, Git, and SSH, together with a
+few utility scripts used across my machines.
+
+## Highlights
+
+- `riot`: an SSH wrapper with host presets, jump hosts, port forwarding, tmux
+  sessions, and optional GPG agent forwarding.
+- `sagt`: an SSH/GPG agent manager with support for PIV, 1Password, and
+  OpenPGP smart cards.
+- zsh aliases and completions for the bundled tools.
+- tmux and Vim configurations with plugin setup.
+- automatic updates with selectable `main`, `dev`, and `latest` channels.
+
+## Installation
+
+Quick install:
+
+```sh
+curl -fsSL https://dotfiles.cn | bash
+```
+
+Alternatively, clone the repository so the installer can be reviewed first:
+
+```sh
+git clone https://github.com/DictXiong/dotfiles.git ~/dotfiles
+~/dotfiles/install.sh -a
+```
+
+The installer adds small source/include entries to the existing zsh, tmux,
+Vim, and Git configuration files instead of replacing them entirely.
+
+## Useful commands
+
+```sh
+riot --help                 # show the SSH wrapper manual
+sagt                        # start or reuse an ssh-agent
+sagt gpg                    # use gpg-agent as SSH agent
+sagt gpg-pin                # cache the smart-card signature PIN
+dfs update                  # update dotfiles from the selected channel
+dfs config                  # edit machine-specific settings
+```
+
+## Configuration
+
+Machine-specific settings can be placed in:
+
+```text
+~/.config/dotfiles/env
+~/.config/riot-config.sh
+```
+
+This is a personal dotfiles repository. Review the configuration, SSH keys,
+and installation script before using it on another machine.
--- a/functions/_beam
+++ b/functions/_beam
@@ -0,0 +1,99 @@
+#compdef beam
+
+# =============================================================================
+# Beam-Go Zsh Completion Script
+# =============================================================================
+
+_beam() {
+    local context state state_descr line
+    typeset -A opt_args
+
+    _arguments -C \
+        '1: :_beam_commands' \
+        '*:: :->args'
+
+    case $state in
+        (args)
+            case $line[1] in
+                (serve) _beam_serve ;;
+                (add)   _beam_add ;;
+                (list)  _beam_list ;;
+                (del)   _beam_del ;;
+            esac
+            ;;
+    esac
+}
+
+# --- Subcommand Definitions ---
+
+(( $+functions[_beam_commands] )) ||
+_beam_commands() {
+    local -a commands
+    commands=(
+        'serve:Start the beam server daemon'
+        'add:Share a file or directory'
+        'list:List active shares'
+        'del:Delete a share by path or code'
+    )
+    _describe -t commands 'beam command' commands
+}
+
+_beam_serve() {
+    _arguments \
+        '(-d --database)'{-d,--database}'=[Database directory (Required)]:directory:_path_files -/' \
+        '(-p --port)'{-p,--port}'=[Port to listen on (default :8280)]:port:' \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '--subpath=[Enable subpath sharing]'
+}
+
+_beam_add() {
+    _arguments \
+        '(-d --days)'{-d,--days}'=[Expiration days (default 7)]:days:' \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '1:file to share:_files'
+}
+
+_beam_list() {
+    _arguments \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files'
+}
+
+_beam_del() {
+    _arguments \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '(-c --code)'{-c,--code}'=[Share code]:share code:_beam_active_codes' \
+        '1:shared path:_files'
+}
+
+# --- Helpers ---
+
+# 动态获取当前的 Share Code
+# 它会尝试读取用户当前输入的 -s 参数，去连接正确的 socket
+_beam_active_codes() {
+    local socket_path=""
+
+    # 从 Zsh 解析的参数中提取 socket 路径
+    if [[ -n ${opt_args[-s]} ]]; then
+        socket_path=${opt_args[-s]}
+    elif [[ -n ${opt_args[--socket]} ]]; then
+        socket_path=${opt_args[--socket]}
+    fi
+
+    # 构造查询命令
+    local cmd_args=()
+    cmd_args+=("list")
+    [[ -n $socket_path ]] && cmd_args+=("-s" "$socket_path")
+
+    # 调用 beam list，跳过前两行表头，提取 Code($1) 和 Path($3)
+    # 2>/dev/null 防止服务未启动时报错打印到终端
+    local -a shares
+    shares=("${(@f)$(beam "${cmd_args[@]}" 2>/dev/null | awk 'NR>2 {print $1":"$2" "$3" "$4}')}")
+
+    if [[ ${#shares} -gt 0 ]]; then
+        _describe -t shares 'active share' shares
+    else
+        _message 'no active shares or server not running'
+    fi
+}
+
+_beam "$@"
--- a/functions/_beaml
+++ b/functions/_beaml
@@ -0,0 +1,35 @@
+#compdef beaml
+
+_beaml() {
+    local context state line
+    typeset -A opt_args
+
+    _arguments -C \
+        '1: :->cmds' \
+        '2: :->args'
+
+    case $state in
+        cmds)
+            local commands; commands=(
+                'add:Add a new item'
+                'del:Delete an item'
+                'list:List all items'
+            )
+            _describe -t commands 'beaml commands' commands
+            ;;
+        args)
+            case $line[1] in
+                add)
+                    _files
+                    ;;
+                del)
+                    local -a items
+                    items=( /pss/lite/*(N:t) )
+                    _describe -t items 'item to delete' items
+                    ;;
+            esac
+            ;;
+    esac
+}
+
+_beaml "$@"
--- a/functions/_nixos_config_hosts
+++ b/functions/_nixos_config_hosts
@@ -0,0 +1,3 @@
+#compdef bnd nor
+
+compadd -- /root/NixOS-Config/hosts/*(/:t)
--- a/functions/_riot
+++ b/functions/_riot
@@ -0,0 +1,105 @@
+#compdef riot
+
+_riot() {
+    local context state state_descr line
+    typeset -A opt_args
+
+    _arguments -C -s \
+        '(-4 -6)-4[Force ssh to use IPv4 addresses only]' \
+        '(-4 -6)-6[Force ssh to use IPv6 addresses only]' \
+        '(-D --dry-run)'{-D,--dry-run}'[Print commands without executing them]' \
+        '(-d --dev)'{-d,--dev}'[Enable shell execution tracing]' \
+        '(-g --gpg)'{-g,--gpg}'[Forward the local GPG agent for an interactive login]' \
+        '(-h --help)'{-h,--help}'[Display help and exit]' \
+        '(-l --lite)'{-l,--lite}'[Enable dotfiles lite mode]' \
+        '*-o[Pass an option to ssh]:SSH option:' \
+        '(-p --password)'{-p,--password}'[Use password authentication]' \
+        '(-q --quiet)'{-q,--quiet}'[Enable dotfiles quiet mode]' \
+        '(-t --trust)'{-t,--trust}'[Trust the remote and enable forwarding]' \
+        '*-v[Enable verbose ssh output]' \
+        '--color[Force colored output]' \
+        '--tmux[Open SSH sessions in tmux windows]' \
+        '1:remote:_riot_remotes' \
+        '2:command:_riot_commands' \
+        '*::command argument:->command-args'
+
+    case $state in
+        command-args)
+            case $line[2] in
+                ssh|tmux|zssh)
+                    _riot_complete_with _ssh ssh "$line[1]" "${line[@]:2}"
+                    ;;
+                git)
+                    _riot_complete_with _git git "${line[@]:2}"
+                    ;;
+                sftp)
+                    _riot_complete_with _sftp sftp "$line[1]" "${line[@]:2}"
+                    ;;
+                scp)
+                    _riot_complete_with _scp scp "${line[@]:2}"
+                    ;;
+                sshl|sshr)
+                    _message 'forwarding specification'
+                    ;;
+                sshd)
+                    _guard '[0-9]#' 'local port'
+                    ;;
+                rm|ping|ping4|ping6)
+                    _message 'no more arguments'
+                    ;;
+                *)
+                    _default
+                    ;;
+            esac
+            ;;
+    esac
+}
+
+_riot_commands() {
+    local -a commands=(
+        'ssh:Open an SSH session (default)'
+        'tmux:Open SSH sessions in tmux windows'
+        'git:Run git on the remote host'
+        'sshl:Create local port forwarding with ssh -L'
+        'sshr:Create remote port forwarding with ssh -R'
+        'sshd:Create dynamic port forwarding with ssh -D'
+        'zssh:Open a zssh session'
+        'sftp:Open an SFTP session'
+        'scp:Copy files to or from the remote host'
+        'rm:Remove the remote host key from known_hosts'
+        'ping:Ping the remote host'
+        'ping4:Ping the remote host over IPv4'
+        'ping6:Ping the remote host over IPv6'
+    )
+    _describe -t commands 'riot command' commands
+}
+
+_riot_presets() {
+    local -a config_files presets
+    local file
+
+    [[ -z $DOTFILES ]] || config_files+=("$DOTFILES/riot-config.sh")
+    config_files+=("$HOME/.config/riot-config.sh" "$PWD/riot-config.sh")
+    for file in "${config_files[@]}"; do
+        [[ -r $file ]] || continue
+        presets+=("${(@f)$(sed -nE 's/^([[:alnum:]_.-]+)\.(remote|batch)\(\).*/\1/p' "$file" 2>/dev/null)}")
+    done
+    presets=(${(u)presets})
+    _describe -t presets 'riot preset' presets
+}
+
+_riot_remotes() {
+    _alternative \
+        'presets:riot preset:_riot_presets' \
+        'hosts:host:_hosts'
+}
+
+_riot_complete_with() {
+    local completer=$1
+    shift
+    local -a words=("$@")
+    local CURRENT=$#words
+    "$completer"
+}
+
+_riot "$@"
--- a/functions/_sagt
+++ b/functions/_sagt
@@ -0,0 +1,3 @@
+#compdef sagt
+
+compadd -- gpg gpg-pin kill ls op piv reset
--- a/functions/_scf
+++ b/functions/_scf
@@ -0,0 +1,27 @@
+#compdef scf
+
+_scf() {
+    _arguments -s \
+        '(-r)-r[Recursively inspect referenced files and directories]' \
+        '(-n)-n[Open candidate number directly]:candidate number:' \
+        '--[End of options]' \
+        '1:systemd service:_scf_services'
+}
+
+_scf_services() {
+    local -a services
+
+    if (( $+commands[systemctl] )); then
+        services=("${(@f)$(systemctl list-unit-files --type=service --no-legend --no-pager 2>/dev/null \
+            | awk '$1 ~ /\.service$/ {print $1}' \
+            | sort -u)}")
+    fi
+
+    if (( ${#services} > 0 )); then
+        _describe -t services 'systemd service' services
+    else
+        _message 'systemd service'
+    fi
+}
+
+_scf "$@"
--- a/functions/_use
+++ b/functions/_use
@@ -0,0 +1,3 @@
+#compdef use
+
+compadd -- $(nix eval --impure --expr 'builtins.attrNames ( (import <nixpkgs>) {} )' 2>/dev/null | tr '[]"' ' ')
--- a/install.sh
+++ b/install.sh
@@ -1,243 +1,338 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/tools/common.sh"

-# Color settings
-# Source: https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
-if [ -t 1 ]; then
-    is_tty() {
-        true
-    }
-else
-    is_tty() {
-        false
-    }
+
+if [[ ! "$DOTFILES" == "${HOME}"* ]]; then 
+    fmt_fatal "\"$DOTFILES\" is not under \"$HOME\". aborting ..."
 fi
+DOTFILE_TILDE=${DOTFILES/"$HOME"/\~}

-supports_truecolor() {
-    case "$COLORTERM" in
-    truecolor|24bit) return 0 ;;
-    esac
+CRON_JOB="0 * * * * ${DOTFILES}/update.sh"
+declare -a DFS_CONFIGS
+declare -a HOME_FILES_PATH
+declare -a HOME_FILES_CONTENT
+HOME_FILES_PATH[0]=".zshrc"
+HOME_FILES_CONTENT[0]="source ${DOTFILE_TILDE}/.zshrc2"
+HOME_FILES_PATH[1]=".tmux.conf"
+HOME_FILES_CONTENT[1]="source-file ${DOTFILE_TILDE}/.tmux.conf2"
+HOME_FILES_PATH[2]=".vimrc"
+HOME_FILES_CONTENT[2]="source ${DOTFILE_TILDE}/.vimrc2"
+HOME_FILES_PATH[3]=".gitconfig"
+HOME_FILES_CONTENT[3]="[include] path = \"${DOTFILE_TILDE}/.gitconfig2\""

-    case "$TERM" in
-    iterm           |\
-    tmux-truecolor  |\
-    linux-truecolor |\
-    xterm-truecolor |\
-    screen-truecolor) return 0 ;;
-    esac
+declare -a HOME_SYMLINKS_SRC
+declare -a HOME_SYMLINKS_DST
+HOME_SYMLINKS_SRC[0]=".ssh/authorized_keys2"
+HOME_SYMLINKS_DST[0]=".ssh/authorized_keys2"
+HOME_SYMLINKS_SRC[1]=".eid/authorized_certificates"
+HOME_SYMLINKS_DST[1]=".eid/authorized_certificates"

-    return 1
-}
-
-fmt_fatal() {
-    printf '%sfatal: %s%s\n' "${FMT_BOLD}${FMT_RED}" "$*" "$FMT_RESET" >&2
-    exit
-}
-
-fmt_error() {
-    printf '%serror: %s%s\n' "${FMT_RED}" "$*" "$FMT_RESET" >&2
-}
-
-fmt_warning() {
-    echo "${FMT_YELLOW}warning: $1 ${FMT_RESET}" 
-}
-
-fmt_note() {
-    echo "${FMT_GREEN}$1 ${FMT_RESET}"
-}
-
-setup_color() {
-    # Only use colors if connected to a terminal
-    if ! is_tty; then
-        FMT_RAINBOW=""
-        FMT_RED=""
-        FMT_GREEN=""
-        FMT_YELLOW=""
-        FMT_BLUE=""
-        FMT_BOLD=""
-        FMT_RESET=""
-    return
-    fi
-
-    if supports_truecolor; then
-    FMT_RAINBOW="
-        $(printf '\033[38;2;255;0;0m')
-        $(printf '\033[38;2;255;97;0m')
-        $(printf '\033[38;2;247;255;0m')
-        $(printf '\033[38;2;0;255;30m')
-        $(printf '\033[38;2;77;0;255m')
-        $(printf '\033[38;2;168;0;255m')
-        $(printf '\033[38;2;245;0;172m')
-    "
-    else
-    FMT_RAINBOW="
-        $(printf '\033[38;5;196m')
-        $(printf '\033[38;5;202m')
-        $(printf '\033[38;5;226m')
-        $(printf '\033[38;5;082m')
-        $(printf '\033[38;5;021m')
-        $(printf '\033[38;5;093m')
-        $(printf '\033[38;5;163m')
-    "
-    fi
-
-    FMT_RED=$(printf '\033[31m')
-    FMT_GREEN=$(printf '\033[32m')
-    FMT_YELLOW=$(printf '\033[33m')
-    FMT_BLUE=$(printf '\033[34m')
-    FMT_BOLD=$(printf '\033[1m')
-    FMT_RESET=$(printf '\033[0m')
-}
-# END of color settings
-
-dotfile_path=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
-home_slashes=${HOME//\//\\\/}
-if [[ ! $dotfile_path == ${home_slashes}* ]]; then 
-    fmt_fatal "\"$dotfile_path\" is not under \"$HOME\". aborting ..."
-fi
-dotfile_home_path=${dotfile_path/${home_slashes}/\~}
-dotfile_relative_path=${dotfile_path#${home_slashes}\/}
-crontab_job="0 * * * * cd ${dotfile_path} && env git pull"
-
-ask_for_yN()
+install_dependencies()
 {
-    while true; do
-        read -p "${FMT_YELLOW}$1${FMT_RESET} [yN]: " yn
-        case $yn in
-            [Yy]* ) return 1;;
-            [Nn]* ) return 0;;
-            * ) return 0;;
+    local ret=0
+    fmt_note "installing dependencies ..."
+    set +e
+    case $(get_os_name) in
+        "ubuntu"|"debian" )
+            $SUDOE "$DOTFILES/tools/ubuntu.sh" apt-install
+            ret=$?
+            ;;
+        "alpine" )
+            $SUDOE "$DOTFILES/tools/alpine.sh" apk-add
+            ret=$?
+            ;;
+        "macos" )
+            "$DOTFILES/tools/macos.sh" brew-install
+            ret=$?
+            ;;
+        "msys" )
+            "$DOTFILES/tools/msys2.sh" pacman-S
+            ret=$?
+            ;;
+        * ) fmt_error "dfs auto-install is not implemented on OS: $(get_os_name). skipping ..."
    esac
+    set -e
+    if [[ "$ret" != "0" ]]; then
+        fmt_error "failed to install dependencies."
+    fi
+}
+
+preinstall_check()
+{
+    fmt_note "checking requirements ..."
+    local mandatory_commands=( "git" "zsh" "curl" "grep" "cat" "cp" "bash" "mkdir" )
+    local optional_commands=( "vim" "tmux" "ping" )
+    for i in "${mandatory_commands[@]}"; do
+        if ! command -v $i 1>/dev/null; then
+            fmt_info "all this utils are required: ${mandatory_commands[@]}"
+            fmt_info "install them manually or check scripts in tools/"
+            fmt_fatal "\"$i\" not found. aborting ..."
+        fi
+    done
+    for i in "${optional_commands[@]}"; do
+        if ! command -v $i 1>/dev/null; then
+            fmt_warning "\"$i\" not found"
+            yn=$(ask_for_Yn "continue anyway?")
+            if [[ "$yn" == "0" ]]; then
+                fmt_info "all this utils are suggested: ${optional_commands[@]}"
+                fmt_info "install them manually or check scripts in tools/"
+                fmt_fatal "aborting ..."
+            fi
+        fi
    done
 }

-insert_if_not_exist()
+prepare_config()
 {
-    filename=$1
-    line=$2
-    fmt_note "installing \"$line\" into \"$filename\" ..."
+    local remote=$(cd "$DOTFILES" && git remote get-url origin)
+    if [[ -z "$DFS_NO_WALL" && $remote == *github* ]]; then
+        DFS_CONFIGS+=("DFS_NO_WALL=1")
+    fi
+    if [[ ${#DFS_CONFIGS[@]} == 0 ]]; then
+        return
+    fi
+    fmt_note "preparing dotfiles configurations ..."
+    local key value
+    for i in "${DFS_CONFIGS[@]}"; do
+        if [[ "$i" == *"="* ]]; then
+            key=${i%%=*}
+            value=${i#*=}
+        else
+            key=$i
+            value=$(eval echo \$$key)
+        fi
+        HOME_FILES_PATH+=(".config/dotfiles/env")
+        HOME_FILES_CONTENT+=("$key=$value")
+        echo -n "$key=$value "
+        export $key=$value
+    done
+    echo
+}
+
+append_hist()
+{
+    fmt_note "appending zsh history ..."
+    "$DOTFILES/tools/append_zsh_hist.sh" "$@"
+}
+
+install_file_content()
+{
+    fmt_note "installing file content ..."
+    for ((i=0; i<${#HOME_FILES_PATH[@]}; i++)); do
+        local filename="$HOME/${HOME_FILES_PATH[$i]}"
+        local content="${HOME_FILES_CONTENT[$i]}"
+        fmt_info "installing \"$content\" into \"$filename\" ..."
        mkdir -p $(dirname "$filename")
        if [ ! -f "$filename" ]; then
            touch $filename
        fi
-    grep -qxF -- "$line" "$filename" || echo "$line" >> "$filename"
+        grep -qxF -- "$content" "$filename" || echo "$content" >> "$filename"
+    done
 }

-delete_if_exist()
+uninstall_file_content()
 {
-    filename=$1
-    line=$2
-    fmt_note "removing \"$line\" from \"$filename\" ..."
+    fmt_note "uninstalling file content ..."
+    for ((i=0; i<${#HOME_FILES_PATH[@]}; i++)); do
+        local filename="$HOME/${HOME_FILES_PATH[$i]}"
+        local content=${HOME_FILES_CONTENT[$i]}
+        fmt_info "removing \"$content\" from \"$filename\" ..."
        if [ -f "$filename" ]; then
-        grep -vxF -- "$line" "$filename" | tee "$filename"
+            grep -vxF -- "$content" "$filename" | tee "$filename"
        fi
+    done
 }

-create_symlink()
+install_symlink()
 {
-    src=$1
-    dest=$2
-    fmt_note "creating symlink \"$dest\" --> \"$src\" ..."
+    fmt_note "installing symlinks ..."
+    for ((i=0; i<${#HOME_SYMLINKS_SRC[@]}; i++)); do
+        if [[ -z "${HOME_SYMLINKS_SRC[$i]}" ]]; then
+            continue
+        fi
+        local src="$DOTFILES/${HOME_SYMLINKS_SRC[$i]}"
+        local dst="$HOME/${HOME_SYMLINKS_DST[$i]}"
+        fmt_info "creating symlink \"$dst\" --> \"$src\" ..."
        if [ ! -f "$src" ]; then
            fmt_error "\"$src\" does not exist! aborting this job ..."
-        return 1
+            continue
        fi
-    mkdir -p $(dirname "$dest")
-    if [ -f "$dest" ]; then
-        if [ "$(readlink $dest)" -ef "$src" ]; then
-            return 0
+        mkdir -p $(dirname "$dst")
+        if [ -f "$dst" ]; then
+            if [ "$(readlink $dst)" -ef "$src" ]; then
+                continue
            fi
-        fmt_warning "\"$dest\" already exists! stat output:"
+            fmt_warning "\"$dst\" already exists! stat output:"
            echo ----------
-        stat $dest
+            stat $dst
            echo ----------
-        ask_for_yN "would you like to replace ${dest}?"
-        if [ $? -eq 1 ]; then 
-            rm $dest
+            yn=$(ask_for_yN "would you like to replace ${dst}?")
+            if [[ "$yn" == "1" ]]; then
+                rm $dst
            else
-            fmt_error "\"$dest\" already exists! aborting this job ..."
-            return 1
+                fmt_error "aborting this job ..."
+                continue
            fi
        fi
-    ln -s $src $dest
-    return $?
+        ln -s $src $dst
+    done
 }

-delete_link_if_match()
+uninstall_symlink()
 {
-    src=$1
-    dest=$2
-    if [ "$(readlink $dest)" -ef "$src" ]; then
-        fmt_note "removing symlink \"$dest\" ..."
+    fmt_note "uninstalling symlinks ..."
+    local src
+    for src in "${!HOME_SYMLINKS[@]}"; do
+        local dst=${HOME_SYMLINKS[$src]}
+        src="$DOTFILES/$src"
+        dst="$HOME/$dst"
+        if [ "$(readlink $dst)" -ef "$src" ]; then
+            fmt_info "removing symlink \"$dst\" ..."
            echo ----------
-        stat $dest
+            stat $dst
            echo ----------
-        rm $dest
+            rm $dst
+        fi
+    done
+}
+
+install_crontab()
+{
+    if [[ -x $(command -v crontab) ]]; then
+        fmt_note "installing \"$CRON_JOB\" to crontab ..."
+        if [[ -z "$(crontab -l 2>/dev/null || true)" ]]; then
+            echo "$CRON_JOB" | crontab -
+        elif !( crontab -l | grep -qxF "${CRON_JOB}"); then
+            ( crontab -l; echo "$CRON_JOB" ) | crontab -
+        fi
+    else
+        fmt_warning "crontab does not exist. skipping ..."
    fi
 }

-install_crontab(){
-    fmt_note "installing \"$crontab_job\" to crontab ..."
-    ( crontab -l | grep -vxF "${crontab_job}" | grep -v "no crontab for"; echo "$crontab_job" ) | crontab -
+uninstall_crontab()
+{
+    if [[ -x $(command -v crontab) ]]; then
+        fmt_note "removing \"$CRON_JOB\" from crontab ..."
+        ( crontab -l | grep -vxF "$CRON_JOB" ) | crontab -
+    else
+        fmt_note "crontab does not exist. skipping ..."
+    fi
 }

-uninstall_crontab(){
-    fmt_note "removing \"$crontab_job\" from crontab ..."
-    ( crontab -l | grep -vxF "$crontab_job" ) | crontab - 
-}
-
-install_tmux_tpm(){
+install_tmux_tpm()
+{
    TMUX_TPM="$HOME/.tmux/plugins/tpm"
    if [[ -x $(command -v tmux) && ! -d "$TMUX_TPM" ]]; then
        fmt_note "installing tmux tpm ..."
        git clone https://gitee.com/dictxiong/tpm "$TMUX_TPM"
        if [[ -x $(command -v g++) && -x $(command -v cmake) && -x $(command -v make) ]]; then
+            if [[ -z "$DFS_LITE" || "$DFS_LITE" == "0" ]]; then
                fmt_note "initializing tmux plugins ..."
                ~/.tmux/plugins/tpm/bin/install_plugins
+            else
+                fmt_warning "in lite mode, tmux plugins are downloaded but not complied"
+                fmt_info "try <prefix + I> or ~/.tmux/plugins/tpm/bin/install_plugins to complie manually"
+            fi
        else
            fmt_warning "pls install g++,cmake,make and then init tmux plugins by <prefix + I> or ~/.tmux/plugins/tpm/bin/install_plugins"
        fi
    fi
 }

-install_vim_vundle(){
+install_vim_vundle()
+{
    VIM_VUNDLE="$HOME/.vim/bundle/Vundle.vim"
    if [[ -x $(command -v vim) && ! -d "$VIM_VUNDLE" ]]; then
        fmt_note "installing vim vundle ..."
        git clone https://gitee.com/dictxiong/Vundle.vim "$VIM_VUNDLE"
        fmt_note "initializing vim plugins ..."
-        vim +PluginInstall +qall
+        echo | vim +PluginInstall +qall
    fi
 }

-install(){
+install_update()
+{
+    fmt_note "installing update.sh ..."
+    cp "${DOTFILES}/.update.sh" "${DOTFILES}/update.sh"
+    chmod +x "${DOTFILES}/update.sh"
+    fmt_note "running update.sh ..."
+    set +e
+    DFS_UPDATED_RET=85 ${DOTFILES}/update.sh
+    RET=$?
+    if [[ $RET == 85 ]]; then
+        fmt_note "dfs updated. re-running install.sh ..."
+        "${DOTFILES}/install.sh" "${ORIGIN_ARGS[@]}" && exit
+    elif [[ $RET != 0 ]]; then
+        fmt_fatal "update.sh failed with exit code $RET"
+    fi
+    set -e
+}
+
+uninstall_update()
+{
+    fmt_note "removing update.sh ..."
+    rm "${DOTFILES}/update.sh"
+}
+
+install()
+{
+    if [[ "$INSTALL_DEP" == "1" ]]; then install_dependencies; fi
+    prepare_config
+    install_update
+    preinstall_check
    install_crontab
-    insert_if_not_exist "${HOME}/.zshrc" "source ${dotfile_home_path}/.zshrc2"
-    insert_if_not_exist "${HOME}/.tmux.conf" "source-file ${dotfile_home_path}/.tmux.conf2"
-    insert_if_not_exist "${HOME}/.vimrc" "source ${dotfile_home_path}/.vimrc2"
-    insert_if_not_exist "${HOME}/.gitconfig" "[include] path = \"${dotfile_home_path}/.gitconfig2\""
-    create_symlink "${dotfile_path}/.ssh/authorized_keys2" "${HOME}/.ssh/authorized_keys2"
+    install_file_content
+    install_symlink
+    apost_beacon "dfs.installed"
    # those that won't be uninstalled in the future
    install_tmux_tpm
    install_vim_vundle
+    if [[ -n "$DFS_HIST" ]]; then append_hist "$DFS_HIST"; fi
    fmt_note "done installing!"
 }

-uninstall(){
-    ask_for_yN "do you really want to uninstall?"
-    if [[ $? == 1 ]]; then
-        uninstall_crontab
-        delete_if_exist "${HOME}/.zshrc" "source ${dotfile_home_path}/.zshrc2"
-        delete_if_exist "${HOME}/.tmux.conf" "source-file ${dotfile_home_path}/.tmux.conf2"
-        delete_if_exist "${HOME}/.vimrc" "source ${dotfile_home_path}/.vimrc2"
-        delete_if_exist "${HOME}/.gitconfig" "[include] path = \"${dotfile_home_path}/.gitconfig2\""
-        delete_link_if_match "${dotfile_path}/.ssh/authorized_keys2" "${HOME}/.ssh/authorized_keys2"
-        fmt_note "done uninstalling!"
+uninstall()
+{
+    yn=$(ask_for_yN "do you really want to uninstall?")
+    if [[ "$yn" != "1" ]]; then
+        fmt_fatal "aborting this job ..."
    fi
+    uninstall_update
+    uninstall_crontab
+    uninstall_file_content
+    uninstall_symlink
+    apost_beacon "dfs.uninstalled"
+    fmt_note "done uninstalling!"
 }

-setup_color
-case $1 in
-    ""|-i ) install ;;
-    -r    ) uninstall ;;
-    *     ) fmt_warning "unknown command \"$1\". available: -i, -r" ;;
-esac
+echo "this is the dotfiles installer, version $(cd "$DOTFILES" && git describe --tags --always --dirty)"
+echo "install options:" "${GOT_OPTS[@]}"
+FUNC=install
+INSTALL_DEP=0
+store_config=0
+store_hist=0
+for i in ${GOT_OPTS[@]}; do
+    if [[ "$store_config" == "1" ]]; then
+        store_config=0
+        DFS_CONFIGS+=("$i")
+        continue
+    fi
+    if [[ "$store_hist" == "1" ]]; then
+        store_hist=0
+        DFS_HIST=$i
+        continue
+    fi
+    case $i in
+        -i ) FUNC=install ;;
+        -r ) FUNC=uninstall ;;
+        -a|--auto ) INSTALL_DEP=1 ;;
+        -H|--hist|--history ) store_hist=1 ;;
+        -x ) store_config=1 ;;
+        --no-auth-info ) HOME_SYMLINKS_SRC=(); HOME_SYMLINKS_DST=() ;;
+        * ) fmt_fatal "unknown option \"$i\"" ;;
+    esac
+done
+$FUNC
--- a/riot-config.sh
+++ b/riot-config.sh
@@ -0,0 +1,69 @@
+#!/bin/false
+
+# batches
+nasps.batch() {
+    remotes+=(
+        g1.nasp
+        g2.nasp
+        g3.nasp
+        g4.nasp
+        g5.nasp
+        g6.nasp
+        g7.nasp
+        g8.nasp
+        g9.nasp
+        g10.nasp
+        g11.nasp
+        g12.nasp
+        g13.nasp
+        g14.nasp
+        dictxiong@g15.nasp
+        dictxiong@g16.nasp
+        g17.nasp
+    )
+}
+
+# remotes
+nasp.remote() {
+    remote=jump.nasp.fit
+    RET_PORT=${RET_PORT:-36022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+# domains
+.domain() {
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_PORT=${RET_PORT:-12022}
+    RET_HOSTNAME=${remote%.}
+}
+
+dxng.domain() {
+    if [[ "$host" =~ ^sed([0-9]{1,2})$ ]]; then
+        RET_HOSTNAME=192.168.98.$((100+BASH_REMATCH[1]))
+    else
+        RET_HOSTNAME=$host.dxng.net
+    fi
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+42.domain() {
+    RET_HOSTNAME=$host.i.bd.dn42
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+nasp.domain() {
+    RET_HOSTNAME=$host
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_JUMP_SERVER="ssh@jump.nasp.fit:36022"
+    RET_TRUST_SERVER=1
+}
+
+default.domain() {
+    dxng.domain
+}
--- a/scripts/dogo
+++ b/scripts/dogo
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/../tools/common.sh"
+
+DOCKER_FORMAT="{{.ID}} {{.Image}} {{.Names}}"
+if [[ -z "$1" || "$1" =~ ^(-h|--help)$ ]]; then
+    fmt_info "usage: $0 <container> or -[0-9]*"
+    exit
+elif [[ "$1" =~ ^-[0-9]*$ ]]; then
+    LAST="${1:1}"
+    if [[ "$LAST" == "0" ]]; then
+        # the latest running container
+        CONTAINER_META=($($SUDO docker container ls -l --filter "status=running" --format "$DOCKER_FORMAT"))
+    else
+        # the last nth container (all status)
+        CONTAINER_META=($($SUDO docker container ls -n ${LAST:-1} --format "$DOCKER_FORMAT" | tail -n 1))
+    fi
+    CONTAINER=${CONTAINER_META[0]}
+else
+    CONTAINER_META="$1"
+    CONTAINER="$1"
+fi
+
+if [[ -z "$CONTAINER" ]]; then
+    fmt_fatal "container not found"
+else
+    fmt_note "--> ${CONTAINER_META[@]}"
+    $SUDO docker exec -it $CONTAINER sh -c 'export DFS="bash <(curl dfs.beardic.cn) -a"; if [ -x "$(command -v zsh)" ]; then echo "--> zsh"; unset DFS; zsh; elif [ -x "$(command -v bash)" ]; then echo "--> bash"; bash; else echo "--> sh"; sh; fi'
+fi
--- a/scripts/doll
+++ b/scripts/doll
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/../tools/common.sh"
+
+DOCKER_FORMAT="{{.ID}} {{.Repository}}:{{.Tag}}"
+if [[ -z "$1" || "$1" =~ ^(-h|--help)$ ]]; then
+    fmt_info "usage: $0 <image> or -[0-9]*"
+    exit
+elif [[ "$1" =~ ^-[0-9]*$ ]]; then
+    LAST="${1:1}"
+    # the last nth image
+    IMAGE_META=($($SUDO docker image ls --format "$DOCKER_FORMAT" | head -n ${LAST:-1} | tail -n 1))
+    IMAGE=${IMAGE_META[0]}
+else
+    IMAGE_META="$1"
+    IMAGE="$1"
+fi
+
+if [[ -z "$IMAGE" ]]; then
+    fmt_fatal "image not found"
+else
+    fmt_note "--> ${IMAGE_META[@]}"
+    $SUDO docker run ${2:+"--name"} $2 -itd --restart=unless-stopped $IMAGE sh
+fi
--- a/scripts/pbin
+++ b/scripts/pbin
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/../tools/common.sh"
+
+get()
+{
+    local key=$1
+    if [[ -z "$key" ]]; then
+        fmt_fatal "missing key"
+    fi
+    local output=${2:-/dev/stdout}
+    local url="https://pastebin.com/raw/$key"
+    curl -fsSL "$url" > "$output"
+}
+
+put()
+{
+    local input=${1:-/dev/stdin}
+    (echo -n api_paste_code=; cat "$input") | curl -fsSL -X POST -d 'api_dev_key=SKZLfq9y_zW2hkgQOKZz1b5rw8hGiqxZ' -d 'api_option=paste' --data-binary @- "https://pastebin.com/api/api_post.php"
+}
+
+route()
+{
+    local cmd=$1
+    if [[ -z "$cmd" ]]; then
+        put
+        exit
+    else
+        shift
+    fi
+    case $cmd in
+        get )
+            get "$@"
+            ;;
+        put )
+            put "$@"
+            ;;
+        * )
+            fmt_fatal "unknown command: $cmd"
+    esac
+}
+
+route "${GOT_OPTS[@]}"
--- a/scripts/riot
+++ b/scripts/riot
@@ -0,0 +1,722 @@
+#!/usr/bin/env bash
+# connect to iot services
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+DFS_SKIP_ARG_PARSE=1
+source "$THIS_DIR/../tools/common.sh"
+unset DFS_SKIP_ARG_PARSE
+RIOT_TRUST_CLIENT=${RIOT_TRUST_CLIENT:-${DFS_TRUST:-0}}
+RIOT_TRUST_SERVER=${RIOT_TRUST_SERVER:-0}
+EXTRA_SSH_OPTIONS=()
+GPG_FORWARD=0
+
+# config
+RIOT_CONFIG_FILES=(
+    "$DOTFILES/riot-config.sh"
+    "$HOME/.config/riot-config.sh"
+    "riot-config.sh"
+)
+load_riot_config() {
+    local file
+    for file in "${RIOT_CONFIG_FILES[@]}"; do
+        if [[ -f "$file" ]]; then
+            source "$file"
+        fi
+    done
+}
+
+# check if port number valid
+check_port() {
+    [[ "$1" =~ ^[1-9][0-9]{0,4}$ ]] || return 1
+    [[ $1 -lt 65536 && $1 -gt 0 ]] || return 1
+    return 0
+}
+
+# check if username valid
+check_username() {
+    [[ "$1" =~ ^[a-z][-a-z0-9_]*$ ]] || return 1
+    return 0
+}
+
+# get single server setting
+# may be called more than once
+get_server_meta() {
+    # returns:
+    RET_HOSTNAME=""
+    RET_TRUST_SERVER=0
+    RET_PORT=""  # optional
+    RET_USERNAME=""  # optional
+    RET_JUMP_SERVER=""  # optional
+    # body
+    local remote="$1"
+    # extract username from user@...
+    if [[ "$remote" == *@* ]]; then
+        RET_USERNAME=${remote%%@*}
+        remote=${remote#*@}
+        check_username $RET_USERNAME || fmt_warning \"$RET_USERNAME\" is not a valid unix username
+    fi
+    # extract port from ...:port
+    if [[
+        "$remote" =~ ^[^:]+:[1-9][0-9]*$  # contains only one colon
+        || "$remote" =~ ^\[.+\]:[1-9][0-9]*$  # in the form of [host]:port
+        || "$remote" =~ :::[1-9][0-9]*$  # in the form of :::port
+        || "$remote" =~ ^([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}:[1-9][0-9]*$  # full ipv6 address with port
+        || "$remote" =~ ^[0-9A-Fa-f:]+%.+:[1-9][0-9]*$  # ipv6 address with scope and port
+    ]]; then
+        RET_PORT=${remote##*:}
+        remote=${remote%:*}
+        check_port $RET_PORT || fmt_fatal invalid port number \"$RET_PORT\"
+    fi
+    # remove square brackets
+    if [[ "$remote" =~ ^\[.*\]$ ]]; then
+        remote=${remote:1:-1}
+    fi
+    # presets -- match remote
+    local remote_func="$remote.remote"
+    if is_function "$remote_func"; then
+        "$remote_func"
+    fi
+    # presets -- match domain
+    RET_HOSTNAME=${remote}
+    local domain=${remote##*.}
+    local host=${remote%.*}
+    # if it contains no dot and is not ipv6
+    if [[ "$remote" != *.* && "$remote" != *:* ]]; then
+        domain="default"
+    fi
+    local domain_func="$domain.domain"
+    if is_function "$domain_func"; then
+        "$domain_func"
+    elif is_function ".domain"; then
+        ".domain"
+    fi
+}
+
+parse_remote() {
+    # remote setting, including jump servers
+    # called for every remote
+    # provides:
+    SERVER=""
+    TRUST_SERVER=1
+    PORT=""  # optional
+    USERNAME=""  # optional
+    SSH_OPTIONS=("-o" "ServerAliveInterval=60")
+    if [[ -t 1 ]]; then
+        SSH_OPTIONS+=("-o" "RequestTTY=yes")
+    fi
+    if [[ "$RIOT_TRUST_CLIENT" == "1" ]]; then
+        SSH_OPTIONS+=("-o" "PermitLocalCommand=yes")
+        if [[ "$(get_os_type)" != "msys" ]]; then
+            test "$DFS_DRY_RUN" = "1" || mkdir -p ~/.ssh/master-socket
+            SSH_OPTIONS+=("-o" "ControlMaster=auto" "-o" "ControlPersist=5s" "-o" "ControlPath=~/.ssh/master-socket/%C")
+        fi
+    fi
+    # handle input
+    local remote="$1"
+    local jump_servers=""
+    # loop for jump servers
+    while [[ -n $remote ]]; do
+        local server=${remote%%/*}
+        remote=${remote#*/}
+        get_server_meta "$server"
+        if [[ -n "$RET_JUMP_SERVER" ]]; then
+            jump_servers="$jump_servers${jump_servers:+,}$RET_JUMP_SERVER"
+        fi
+        # only if all servers are trusted
+        TRUST_SERVER=$((TRUST_SERVER*RET_TRUST_SERVER))
+        if [[ "$server" == "$remote" || -z "$remote" ]]; then
+            SERVER="$RET_HOSTNAME"
+            PORT="$RET_PORT"
+            USERNAME="$RET_USERNAME"
+            remote=""
+        else
+            jump_servers="$jump_servers${jump_servers:+,}$RET_USERNAME${RET_USERNAME:+@}$RET_HOSTNAME${RET_PORT:+:}$RET_PORT"
+        fi
+    done
+    # construct cmd
+    if [[ "$RIOT_TRUST_SERVER" == "1" || "$TRUST_SERVER" == "1" ]]; then
+        SSH_OPTIONS+=("-o" "ForwardX11=yes" "-o" "ForwardAgent=yes")
+    fi
+    if [[ -n "$jump_servers" ]]; then
+        SSH_OPTIONS+=("-o" "ProxyJump=$jump_servers")
+    fi
+}
+
+check_local_gpg_agent() {
+    LOCAL_GPG_EXTRA_SOCKET=""
+    GPG_FORWARD_ERROR=""
+
+    if ! command -v gpgconf > /dev/null 2>&1 || ! command -v gpg-connect-agent > /dev/null 2>&1; then
+        GPG_FORWARD_ERROR="gpgconf or gpg-connect-agent is not available"
+        return 1
+    fi
+
+    local agent_info
+    agent_info=$(gpg-connect-agent --no-autostart 'GETINFO pid' /bye 2>/dev/null || true)
+    if ! grep -qE '^D [1-9][0-9]*$' <<< "$agent_info"; then
+        GPG_FORWARD_ERROR="local gpg-agent is not running"
+        return 1
+    fi
+
+    LOCAL_GPG_EXTRA_SOCKET=$(gpgconf --list-dirs agent-extra-socket 2>/dev/null || true)
+    if [[ -z "$LOCAL_GPG_EXTRA_SOCKET" || "$LOCAL_GPG_EXTRA_SOCKET" != /* \
+        || "$LOCAL_GPG_EXTRA_SOCKET" == *:* || "$LOCAL_GPG_EXTRA_SOCKET" == *$'\r'* \
+        || "$LOCAL_GPG_EXTRA_SOCKET" == *$'\n'* || ! -S "$LOCAL_GPG_EXTRA_SOCKET" ]]; then
+        GPG_FORWARD_ERROR="local gpg-agent extra socket is unavailable"
+        return 1
+    fi
+
+    local extra_info
+    extra_info=$(gpg-connect-agent --raw-socket "$LOCAL_GPG_EXTRA_SOCKET" 'GETINFO version' /bye 2>/dev/null || true)
+    if ! grep -qE '^D [^[:space:]]+' <<< "$extra_info"; then
+        GPG_FORWARD_ERROR="local gpg-agent extra socket exists but is not accepting connections"
+        return 1
+    fi
+}
+
+probe_remote_gpg_socket() {
+    REMOTE_GPG_SOCKET=""
+
+    # The probe must be an independent connection: reusing or creating a
+    # multiplex master here races with the immediately following login.
+    local query_cmd=(ssh "-S" "none" "-o" "ClearAllForwardings=yes")
+    if [[ -n "$PORT" ]]; then
+        query_cmd+=("-p" "$PORT")
+    fi
+    query_cmd+=(
+        "${SSH_OPTIONS[@]}"
+        "${EXTRA_SSH_OPTIONS[@]}"
+        "-T"
+        "$USERNAME${USERNAME:+@}$SERVER"
+        'socket=$(gpgconf --list-dirs agent-socket 2>/dev/null) || exit 10
+case "$socket" in /*/S.gpg-agent) ;; *) exit 11;; esac
+case "$socket" in *:*) exit 11;; esac
+case "$socket" in *"
+"*) exit 11;; esac
+carriage_return=$(printf "\r")
+case "$socket" in *"$carriage_return"*) exit 11;; esac
+if [ -e "$socket" ] && [ ! -S "$socket" ]; then exit 12; fi
+if [ -S "$socket" ] && command -v gpg-connect-agent >/dev/null 2>&1; then
+    agent_mode=$(gpg-connect-agent --raw-socket "$socket" "GETINFO restricted" /bye 2>/dev/null || true)
+    case "$agent_mode" in *"D 1"*) exit 13;; esac
+fi
+systemd_socket=0
+if command -v systemctl >/dev/null 2>&1 && systemctl --user is-active --quiet gpg-agent.socket >/dev/null 2>&1; then
+    systemd_socket=1
+fi
+gpgconf --kill gpg-agent >/dev/null 2>&1 || exit 14
+rm -f "$socket" || exit 15
+printf "%s\n%s\n" "$socket" "$systemd_socket"'
+    )
+
+    local output status
+    if output=$("${query_cmd[@]}"); then
+        status=0
+    else
+        status=$?
+    fi
+    case "$status" in
+    0) ;;
+    10) GPG_FORWARD_ERROR="gpgconf is unavailable on the remote host" ;;
+    11) GPG_FORWARD_ERROR="remote gpgconf returned an invalid agent socket" ;;
+    12) GPG_FORWARD_ERROR="refusing to remove the non-socket remote gpg-agent path" ;;
+    13) GPG_FORWARD_ERROR="another forwarded gpg-agent is already using the remote socket; close that session first" ;;
+    14) GPG_FORWARD_ERROR="failed to stop the remote gpg-agent (the socket may belong to another forwarding session)" ;;
+    15) GPG_FORWARD_ERROR="failed to remove the stale remote gpg-agent socket" ;;
+    *) GPG_FORWARD_ERROR="failed to query or clean the remote gpg-agent socket (ssh status $status)" ;;
+    esac
+    if [[ "$status" != "0" ]]; then
+        return 1
+    fi
+
+    local remote_systemd_socket
+    REMOTE_GPG_SOCKET=${output%%$'\n'*}
+    remote_systemd_socket=${output#*$'\n'}
+    if [[ -z "$REMOTE_GPG_SOCKET" || "$REMOTE_GPG_SOCKET" == *$'\r'* || "$REMOTE_GPG_SOCKET" == *$'\n'* \
+        || "$REMOTE_GPG_SOCKET" != /*/S.gpg-agent || "$REMOTE_GPG_SOCKET" == *:* \
+        || "$remote_systemd_socket" != "0" && "$remote_systemd_socket" != "1" ]]; then
+        GPG_FORWARD_ERROR="remote gpgconf returned an invalid agent socket: $output"
+        return 1
+    fi
+    if [[ "$remote_systemd_socket" == "1" ]]; then
+        fmt_warning "remote gpg-agent.socket is active and may race with GPG forwarding; consider disabling its socket activation"
+    fi
+}
+
+prepare_gpg_forwarding() {
+    if [[ "$DFS_DRY_RUN" == "1" ]]; then
+        REMOTE_GPG_SOCKET="<remote-gpg-agent-socket>"
+        LOCAL_GPG_EXTRA_SOCKET="<local-gpg-agent-extra-socket>"
+    else
+        if ! check_local_gpg_agent; then
+            fmt_fatal "cannot forward gpg-agent: $GPG_FORWARD_ERROR"
+        fi
+        if ! probe_remote_gpg_socket; then
+            fmt_fatal "cannot forward gpg-agent: $GPG_FORWARD_ERROR"
+        fi
+    fi
+
+    SSH_OPTIONS+=(
+        # The probe already removed the old socket. Do not let the main SSH
+        # connection unlink a path recreated during the gap between them.
+        "-o" "StreamLocalBindUnlink=no"
+        "-o" "ExitOnForwardFailure=yes"
+        "-R" "$REMOTE_GPG_SOCKET:$LOCAL_GPG_EXTRA_SOCKET"
+    )
+}
+
+print_cmd() {
+    local output=""
+    for s in "${CMD[@]}"; do
+        if [[ "$s" =~ [\ \\\'\"] ]]; then  # needs to be escaped
+            s="${s@Q}"
+        fi
+        output+="$s "
+    done
+    fmt_note "--> ${output% }"
+}
+
+eval_or_echo() {
+    local DO=""
+    tmux_win=${tmux_win:-0}
+    if [[ "$DFS_DRY_RUN" == "1" ]]; then
+        DO=echo
+    fi
+    if [[ "$USE_TMUX" == "1" ]]; then
+        if [[ -z "$TMUX_SESS" ]]; then
+            TMUX_SESS=riot-$(date +%s)
+            $DO tmux new-session -d -s $TMUX_SESS bash -l
+        else
+            tmux_win=$((tmux_win+1))
+            $DO tmux new-window -t $TMUX_SESS:$tmux_win -d bash -l
+        fi
+        local command
+        printf -v command '%q ' "${CMD[@]}"
+        $DO tmux send-keys -l -t "$TMUX_SESS:$tmux_win" "${command% }"
+        $DO tmux send-keys -t "$TMUX_SESS:$tmux_win" Enter
+    else
+        $DO "${CMD[@]}"
+    fi
+}
+
+# ssh series
+prepare_ssh_cmd() {
+    local ssh_bin="${1:-ssh}"
+    if [[ "$ssh_bin" == "scp" || "$ssh_bin" == "sftp" ]]; then
+        local port_param='-P'
+    else
+        local port_param='-p'
+    fi
+    CMD=(
+        "$ssh_bin"
+        "${PORT:+$port_param}" "$PORT"
+        "${SSH_OPTIONS[@]}"
+        "${EXTRA_SSH_OPTIONS[@]}"
+        "$SCP_SRC"
+        "$USERNAME${USERNAME:+@}$SERVER"
+        "$SCP_DST"
+        "${@:2}"
+    )
+    for i in ${!CMD[@]}; do if [[ -z "${CMD[i]}" ]]; then unset CMD[i]; fi; done
+}
+
+# ssh
+run_ssh()
+{
+    prepare_ssh_cmd "$@"
+    print_cmd
+    eval_or_echo
+}
+
+# sshl
+run_sshl()
+{
+    local arg left right localsock access
+    local res="${1//[^:]}"
+    local lorr="-L"
+    if [[ "${FUNCNAME[1]}" == "run_sshr" ]]; then
+        lorr="-R"
+    fi
+    if [[ ${#res} -eq 2 ]]; then
+        arg="$1"
+    elif [[ ${#res} -eq 0 ]]; then
+        if [[ "$lorr" == "-R" ]]; then
+            arg="$1"
+        else
+            arg="$(get_free_port):localhost:$1"
+        fi
+    else
+        left=${1%%:*}
+        right=${1##*:}
+        if check_port "$left"; then
+            arg="$1"
+        elif check_port "$right"; then
+            arg="$(get_free_port):$1"
+        else
+            arg="$1"
+            localsock=1
+        fi
+    fi
+    if [[ "$localsock" == "1" ]]; then
+        access="unix://${arg%%:*}"
+    else
+        access="localhost:${arg%%:*}"
+    fi
+    SSH_OPTIONS+=("-NC" "$lorr" "$arg")
+    prepare_ssh_cmd ssh
+    print_cmd
+    fmt_note "  > please access $access"
+    eval_or_echo
+}
+
+# sshr
+run_sshr()
+{
+    run_sshl "$1"
+}
+
+# sshd
+run_sshd()
+{
+    local port=${1:-$(get_free_port)}
+    SSH_OPTIONS+=("-NC" "-D" "$port")
+    prepare_ssh_cmd ssh
+    print_cmd
+    fmt_note "  > please access localhost:$port"
+    eval_or_echo
+}
+
+# scp
+run_scp() {
+    local src="$1"
+    local dst="$2"
+    local dst_is_remote=1
+    # whoever is ./*, it can't be the remote; whoever not exists on local, it's possible the remote.
+    # it is suggested to use ./* for local files.
+    if [[ "$src" != "./"* && ( "$dst" == "./"* || ( ! -e "$src" && -e "$dst" ) ) ]]; then
+        dst_is_remote=0
+    fi
+    if [[ "$dst_is_remote" == "1" ]]; then
+        SCP_SRC="$src"
+        SERVER="$SERVER":"$dst"
+    else
+        SERVER="$SERVER":"$src"
+        SCP_DST="$dst"
+    fi
+    SSH_OPTIONS+=("-r")
+    prepare_ssh_cmd scp
+    print_cmd
+    eval_or_echo
+}
+
+# ping
+run_ping() {
+    CMD=(ping)
+    if [[ "$1" == "ping4" ]]; then
+        CMD+=(-4)
+    elif [[ "$1" == "ping6" ]]; then
+        CMD+=(-6)
+    fi
+    CMD+=(-c 4 "$SERVER")
+    print_cmd
+    eval_or_echo
+}
+
+# remove host keys
+remove_hostkey() {
+    local key
+    if [[ -z "$PORT" || "$PORT" == "22" ]]; then
+        key=$SERVER
+    else
+        key="[$SERVER]:$PORT"
+    fi
+    ssh-keygen -R "$key"
+}
+
+# main
+print_help()
+{
+    local pager=(cat)
+    if [[ -t 1 ]] && command -v less > /dev/null 2>&1; then
+        pager=(less -R)
+    fi
+
+    cat <<EOF | "${pager[@]}"
+NAME
+    riot - connect to remote hosts using SSH presets
+
+SYNOPSIS
+    ${0##*/} [OPTION]... REMOTE [OPTION]... [COMMAND [COMMAND-ARG]...]
+
+DESCRIPTION
+    Connect to REMOTE using the matching configuration from riot-config.sh.
+    COMMAND defaults to ssh. Separate multiple remotes with commas and jump
+    hosts with slashes. OPTIONs may appear before COMMAND. Once COMMAND is
+    found, all remaining arguments are passed to it without further parsing.
+
+OPTIONS
+    -4
+        Force ssh to use IPv4 addresses only.
+
+    -6
+        Force ssh to use IPv6 addresses only.
+
+    -D, --dry-run
+        Print commands without executing them.
+
+    -d, --dev
+        Enable shell execution tracing.
+
+    -g, --gpg
+        Forward the local GPG agent during an interactive SSH login. Use only
+        with trusted remote hosts.
+
+    -h, --help
+        Display this help and exit.
+
+    -l, --lite
+        Enable dotfiles lite mode for loaded configuration.
+
+    -o SSH-OPTION
+        Pass an option to ssh. This option may be specified multiple times.
+
+    -p, --password
+        Use password authentication instead of public-key authentication.
+
+    -q, --quiet
+        Enable dotfiles quiet mode for loaded configuration.
+
+    -t, --trust
+        Trust the remote and enable X11 and SSH agent forwarding.
+
+    -v
+        Enable verbose ssh output.
+
+    --color
+        Force colored output.
+
+    --tmux
+        Open SSH sessions in tmux windows.
+
+    --
+        End option parsing.
+
+COMMANDS
+    ssh [SSH-ARG]...
+        Open an SSH session. This is the default command.
+
+    tmux [SSH-ARG]...
+        Open SSH sessions in multiple tmux windows.
+
+    git [GIT-ARG]...
+        Run git on the remote host.
+
+    sshl [LOCAL-PORT:REMOTE-HOST:]REMOTE-PORT
+        Create local port forwarding with ssh -L.
+
+    sshr [REMOTE-HOST:]REMOTE-PORT
+        Create remote port forwarding with ssh -R.
+
+    sshd [LOCAL-PORT]
+        Create dynamic port forwarding with ssh -D.
+
+    zssh [SSH-ARG]...
+        Open a zssh session.
+
+    sftp [SFTP-ARG]...
+        Open an SFTP session.
+
+    scp SOURCE DESTINATION
+        Copy files to or from the remote host.
+
+    rm
+        Remove the remote host key from known_hosts.
+
+    ping, ping4, ping6
+        Ping the remote host.
+EOF
+}
+
+router() {
+    local positional=()
+    local arg=""
+    local option=""
+    local remaining=""
+    local option_value=""
+    while [[ $# -gt 0 || -n "$arg" ]]; do
+        if [[ -z "$arg" ]]; then
+            arg=$1
+            shift
+        fi
+
+        # Normalize a long option or one item from a short-option group.
+        remaining=""
+        case "$arg" in
+            -- )
+                positional+=("$@")
+                break
+                ;;
+            --* )
+                option=$arg
+                arg=""
+                ;;
+            -?* )
+                option=${arg:0:2}
+                remaining=${arg:2}
+                arg=${remaining:+-$remaining}
+                ;;
+            * )
+                positional+=("$arg")
+                arg=""
+                if [[ "${#positional[@]}" -ge 2 ]]; then
+                    positional+=("$@")
+                    break
+                fi
+                continue
+                ;;
+        esac
+
+        case "$option" in
+            -h|--help )
+                print_help
+                exit 0
+                ;;
+            -t|--trust )
+                RIOT_TRUST_SERVER=1
+                ;;
+            -g|--gpg )
+                GPG_FORWARD=1
+                ;;
+            --tmux )
+                USE_TMUX=1
+                ;;
+            -p|--password )
+                EXTRA_SSH_OPTIONS+=("-o" "PasswordAuthentication=yes" "-o" "PubkeyAuthentication=no")
+                ;;
+            -D|--dry-run )
+                export DFS_DRY_RUN=1
+                ;;
+            -d|--dev )
+                export DFS_DEV=1
+                set -x
+                ;;
+            -l|--lite )
+                export DFS_LITE=1
+                ;;
+            -q|--quiet )
+                export DFS_QUIET=1
+                ;;
+            --color )
+                export DFS_COLOR=1
+                setup_color
+                ;;
+            -4|-6|-v )
+                EXTRA_SSH_OPTIONS+=("$option")
+                ;;
+            -o )
+                if [[ -n "$remaining" ]]; then
+                    option_value=$remaining
+                    arg=""
+                else
+                    [[ $# -gt 0 ]] || fmt_fatal "option '-o' requires an argument"
+                    option_value=$1
+                    shift
+                fi
+                EXTRA_SSH_OPTIONS+=("-o" "$option_value")
+                ;;
+            * )
+                fmt_fatal "unknown option: '$option'"
+                ;;
+        esac
+    done
+
+    if [[ "${positional[2]}" == "--" ]]; then
+        positional=("${positional[@]:0:2}" "${positional[@]:3}")
+    fi
+
+    IFS=',' read -ra remotes <<< "${positional[0]}"
+    for i in ${!remotes[@]}; do if [[ -z "${remotes[i]}" ]]; then unset remotes[i]; fi; done
+    if [[ "${#positional[@]}" == "0" || "${#remotes[@]}" == "0" ]]; then
+        print_help
+        exit 1
+    fi
+    load_riot_config
+    if [[ "$GPG_FORWARD" == "1" && ( \
+        ( "${positional[1]}" != "" && "${positional[1]}" != "ssh" && "${positional[1]}" != "tmux" ) \
+        || "${#positional[@]}" -gt 2 ) ]]; then
+        fmt_fatal "gpg-agent forwarding is only supported for interactive SSH login"
+    fi
+    for i in ${!remotes[@]}; do
+        remote="${remotes[i]}"
+        local batch_func="${remote}.batch"
+        if is_function "$batch_func"; then
+            "$batch_func"
+            continue
+        fi
+        parse_remote "$remote"
+        case "${positional[1]}" in
+            ssh|tmux|"" )
+                [[ "${positional[1]}" == tmux ]] && USE_TMUX=1
+                if [[ "$GPG_FORWARD" == "1" ]]; then
+                    prepare_gpg_forwarding
+                fi
+                run_ssh ssh "${positional[@]:2}"
+                ;;
+            git )
+                if printf '%s\0' "${positional[@]:2}" | grep -Fxqz -- '-C'; then
+                    run_ssh ssh git "${positional[@]:2}"
+                else
+                    run_ssh ssh git -C "$(pwd)" "${positional[@]:2}"
+                fi
+                ;;
+            ping|ping4|ping6 )
+                test "${#positional[@]}" -eq 2 || fmt_fatal "ping requires no arguments"
+                run_ping "${positional[1]}"
+                ;;
+            zssh )
+                run_ssh zssh "${positional[@]:2}"
+                ;;
+            sftp )
+                run_ssh sftp "${positional[@]:2}"
+                ;;
+            sshl )
+                test -n "${positional[2]}" || fmt_fatal "no target address provided"
+                test "${#positional[@]}" -eq 3 || fmt_fatal "sshl requires exactly one argument"
+                run_sshl "${positional[2]}"
+                ;;
+            sshr )
+                test -n "${positional[2]}" || fmt_fatal "no target address provided"
+                test "${#positional[@]}" -eq 3 || fmt_fatal "sshr requires exactly one argument"
+                run_sshr "${positional[2]}"
+                ;;
+            sshd )
+                test "${#positional[@]}" -le 3 || fmt_fatal "sshd requires one or no arguments"
+                if [[ "${#positional[@]}" -eq 3 ]]; then
+                    check_port "${positional[2]}" || fmt_fatal "invalid port number: ${positional[2]}"
+                    run_sshd "${positional[2]}"
+                else
+                    run_sshd
+                fi
+                ;;
+            scp )
+                test "${#positional[@]}" -eq 4 || fmt_fatal "scp requires exactly two arguments: source and destination"
+                test -n "${positional[2]}" || fmt_fatal "no source path specified"
+                test -n "${positional[3]}" || fmt_fatal "no destination path specified"
+                run_scp "${positional[2]}" "${positional[3]}"
+                ;;
+            rm )
+                test "${#positional[@]}" -eq 2 || fmt_fatal "rm requires no arguments"
+                remove_hostkey
+                ;;
+            * )
+                print_help
+                fmt_fatal "unknown command: ${positional[1]}"
+                ;;
+        esac
+    done
+
+    if [[ -n "$TMUX_SESS" && "$DFS_DRY_RUN" != "1" ]]; then
+        tmux attach-session -t $TMUX_SESS
+    fi
+}
+
+router "$@"
--- a/scripts/scf
+++ b/scripts/scf
@@ -0,0 +1,378 @@
+#!/usr/bin/env bash
+# Author: OpenAI Codex
+# AI-assisted implementation, generated and reviewed with OpenAI Codex.
+
+set -euo pipefail
+# Keep glob expansion and sorting stable across locales, so -n remains
+# repeatable when the service and filesystem contents have not changed.
+scf_lc_all_was_set=false
+scf_original_lc_all=""
+if [[ -n ${LC_ALL+x} ]]; then
+  scf_lc_all_was_set=true
+  scf_original_lc_all=$LC_ALL
+fi
+export LC_ALL=C
+
+restore_locale() {
+  if [[ $scf_lc_all_was_set == true ]]; then
+    export LC_ALL=$scf_original_lc_all
+  else
+    unset LC_ALL
+  fi
+}
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: scf [-r] [-n NUM] SERVICE
+
+Open the configuration file referenced by a systemd service's ExecStart.
+SERVICE may be given with or without the .service suffix.
+
+  -r  recursively inspect referenced files and directories (maximum reference depth: 3)
+  -n  open candidate NUM directly, without displaying the selection list
+
+Environment:
+  SCF_MAX_CANDIDATES  maximum number of candidates (default: 20)
+  SCF_MAX_DEPTH       maximum reference depth (default: 3)
+EOF
+  exit 2
+}
+
+recursive=false
+selection_number=""
+service=""
+while (( $# > 0 )); do
+  argument=$1
+  shift
+
+  if [[ $argument == -- ]]; then
+    [[ -z $service && $# -eq 1 ]] || usage
+    service=$1
+    shift
+    break
+  fi
+
+  if [[ $argument == -* ]]; then
+    options=${argument#-}
+    [[ -n $options ]] || usage
+    while [[ -n $options ]]; do
+      option=${options:0:1}
+      options=${options:1}
+      case $option in
+        r) recursive=true ;;
+        n)
+          if [[ -n $options ]]; then
+            selection_number=$options
+            options=""
+          else
+            (( $# > 0 )) || usage
+            selection_number=$1
+            shift
+          fi
+          ;;
+        *) usage ;;
+      esac
+    done
+  else
+    [[ -z $service ]] || usage
+    service=$argument
+  fi
+done
+
+if [[ -z $service ]]; then
+  usage
+fi
+
+interactive=false
+if [[ -t 0 && -t 1 && -t 2 ]]; then
+  interactive=true
+fi
+
+# Prompts and candidate details are written to stderr.  Keep pipelines and
+# redirected output free of escape sequences.
+if [[ $interactive == true ]]; then
+  color_item=$'\033[1;36m'
+  color_detail=$'\033[2;37m'
+  color_prompt=$'\033[1;33m'
+  color_reset=$'\033[0m'
+else
+  color_item=""
+  color_detail=""
+  color_prompt=""
+  color_reset=""
+fi
+
+if [[ -n $selection_number && ! $selection_number =~ ^[0-9]+$ ]]; then
+  echo "scf: invalid candidate number: $selection_number" >&2
+  exit 2
+fi
+if [[ -n $selection_number ]]; then
+  # Bash arithmetic treats numbers with a leading zero as octal.
+  selection_number=$((10#$selection_number))
+  if (( selection_number < 1 )); then
+    echo "scf: invalid candidate number: 0" >&2
+    exit 2
+  fi
+fi
+
+service_argument=$service
+if [[ $service != *.service ]]; then
+  service+=.service
+fi
+
+# Keep the argument a unit name, rather than allowing it to become a
+# systemctl option.  This also makes accidental shell syntax harmless.
+if [[ ! $service =~ ^[A-Za-z0-9_.@:%+-]+\.service$ ]]; then
+  echo "scf: invalid service name: $service_argument" >&2
+  exit 2
+fi
+
+if ! exec_start=$(systemctl show --no-pager --property=ExecStart --value "$service"); then
+  echo "scf: cannot inspect $service" >&2
+  exit 1
+fi
+
+if [[ -z $exec_start || $exec_start == "{}" ]]; then
+  echo "scf: $service has no ExecStart" >&2
+  exit 1
+fi
+
+# Keep recursion bounded even when configuration files refer to each other.
+max_candidates=${SCF_MAX_CANDIDATES:-20}
+max_reference_depth=${SCF_MAX_DEPTH:-3}
+if [[ ! $max_candidates =~ ^[0-9]+$ ]]; then
+  echo "scf: SCF_MAX_CANDIDATES must be a positive integer" >&2
+  exit 2
+fi
+if [[ ! $max_reference_depth =~ ^[0-9]+$ ]]; then
+  echo "scf: SCF_MAX_DEPTH must be a non-negative integer" >&2
+  exit 2
+fi
+# Normalize user-provided decimal values before using Bash arithmetic.
+max_candidates=$((10#$max_candidates))
+max_reference_depth=$((10#$max_reference_depth))
+if (( max_candidates < 1 )); then
+  echo "scf: SCF_MAX_CANDIDATES must be a positive integer" >&2
+  exit 2
+fi
+declare -A candidate_seen=()
+declare -A candidate_depth=()
+declare -A candidate_source=()
+declare -A candidate_source_detail=()
+config_paths=()
+other_paths=()
+recursive_paths=()
+recursive_depths=()
+declare -A recursive_seen=()
+
+path_pattern="/[^[:space:];,'\"})]+"
+
+extract_paths() {
+  grep -a -oE "$path_pattern" || true
+}
+
+has_config_extension() {
+  local path=$1
+  [[ $path =~ \.(conf|cfg|cnf|ini|json|toml|ya?ml|xml|properties)$ ]]
+}
+
+is_config_path() {
+  local path=$1
+  has_config_extension "$path" \
+    || [[ $path == *config* || $path == *configuration* ]]
+}
+
+add_candidate() {
+  local path=$1
+  local depth=$2
+  local source=$3
+  local source_detail=${4:-}
+
+  [[ -f $path ]] || return 1
+  [[ -n ${candidate_seen[$path]+seen} ]] && return 0
+  (( ${#candidate_seen[@]} < max_candidates )) || return 1
+
+  candidate_seen[$path]=1
+  candidate_depth[$path]=$depth
+  candidate_source[$path]=$source
+  candidate_source_detail[$path]=$source_detail
+  if is_config_path "$path"; then
+    config_paths+=("$path")
+  else
+    other_paths+=("$path")
+  fi
+}
+
+enqueue_recursive() {
+  local path=$1
+  local depth=$2
+
+  [[ $recursive == true ]] || return 0
+  (( depth <= max_reference_depth )) || return 0
+  [[ -f $path ]] || return 0
+  [[ -n ${recursive_seen[$path]+seen} ]] && return 0
+
+  recursive_seen[$path]=1
+  recursive_paths+=("$path")
+  recursive_depths+=("$depth")
+}
+
+expand_directory() {
+  local directory=$1
+  local depth=$2
+  local source=$3
+  local path
+  local entries
+
+  [[ $recursive == true && -d $directory ]] || return 0
+
+  # dotglob also catches hidden configuration files.  nullglob prevents the
+  # literal pattern from being treated as a candidate for an empty directory.
+  shopt -s dotglob nullglob
+  entries=("$directory"/*)
+  shopt -u dotglob nullglob
+
+  for path in "${entries[@]}"; do
+    # A service's configuration often contains runtime directories such as
+    # Python's bin directory.  Only configuration-looking files from a
+    # directory should consume the candidate budget.
+    has_config_extension "$path" || continue
+    add_candidate "$path" "$depth" "$source" "directory $directory" || continue
+    enqueue_recursive "$path" "$depth"
+  done
+}
+
+consider_initial_path() {
+  local path=$1
+
+  if [[ -f $path ]]; then
+    add_candidate "$path" 0 "ExecStart" || true
+  elif [[ -d $path ]]; then
+    expand_directory "$path" 0 "ExecStart"
+  fi
+}
+
+# systemctl's ExecStart value contains both `path=` and `argv[]=`.  Pull out
+# absolute path tokens, then drop the first one (the executable itself).
+# NixOS-generated configuration files are normally immutable regular files in
+# /nix/store, but the same also works for /etc and /run paths.
+mapfile -t initial_paths < <(
+  printf '%s\n' "$exec_start" \
+    | extract_paths \
+    | awk '!seen[$0]++'
+)
+
+if (( ${#initial_paths[@]} > 0 )); then
+  initial_paths=("${initial_paths[@]:1}")
+fi
+
+for path in "${initial_paths[@]}"; do
+  consider_initial_path "$path"
+done
+
+paths=("${config_paths[@]}")
+if (( ${#paths[@]} == 0 )); then
+  paths=("${other_paths[@]}")
+fi
+
+if [[ $recursive == true ]]; then
+  for path in "${paths[@]}"; do
+    enqueue_recursive "$path" 0
+  done
+
+  recursive_index=0
+  while (( recursive_index < ${#recursive_paths[@]} )); do
+    path=${recursive_paths[recursive_index]}
+    depth=${recursive_depths[recursive_index]}
+    recursive_index=$((recursive_index + 1))
+    (( depth < max_reference_depth )) || continue
+    next_depth=$((depth + 1))
+
+    mapfile -t referenced_paths < <(extract_paths < "$path")
+    for referenced_path in "${referenced_paths[@]}"; do
+      if [[ -f $referenced_path ]]; then
+        add_candidate "$referenced_path" "$next_depth" "$path" || continue
+        enqueue_recursive "$referenced_path" "$next_depth"
+      elif [[ -d $referenced_path ]]; then
+        expand_directory "$referenced_path" "$next_depth" "$path"
+      fi
+    done
+  done
+
+  paths=("${config_paths[@]}")
+  if (( ${#paths[@]} == 0 )); then
+    paths=("${other_paths[@]}")
+  fi
+fi
+
+if (( ${#paths[@]} == 0 )); then
+  echo "scf: no existing configuration path found in ExecStart of $service" >&2
+  echo "ExecStart: $exec_start" >&2
+  exit 1
+fi
+
+if [[ $interactive == false && -z $selection_number ]]; then
+  selection_number=1
+fi
+
+if [[ -n $selection_number ]]; then
+  if (( selection_number > ${#paths[@]} )); then
+    echo "scf: candidate number $selection_number is out of range (1-${#paths[@]})" >&2
+    exit 2
+  fi
+  config_path=${paths[selection_number - 1]}
+elif (( ${#paths[@]} > 1 )); then
+  declare -A displayed_indices=()
+  for i in "${!paths[@]}"; do
+    displayed_indices["${paths[i]}"]=$((i + 1))
+  done
+
+  printf '%sscf: multiple possible configuration files for %s:%s\n' \
+    "$color_prompt" "$service" "$color_reset" >&2
+  for i in "${!paths[@]}"; do
+    path=${paths[i]}
+    source=${candidate_source[$path]}
+    if [[ $source == ExecStart ]]; then
+      source_label=ExecStart
+    elif [[ -n ${displayed_indices[$source]+seen} ]]; then
+      source_label="#${displayed_indices[$source]}"
+    else
+      source_label=$source
+    fi
+    source_detail=${candidate_source_detail[$path]}
+    if [[ -n $source_detail ]]; then
+      source_label+=" ($source_detail)"
+    fi
+    printf '%s  %d) %s%s\n' \
+      "$color_item" "$((i + 1))" "$path" "$color_reset" >&2
+    printf '%s     depth: %d; derived from: %s%s\n' \
+      "$color_detail" "${candidate_depth[$path]}" "$source_label" "$color_reset" >&2
+  done
+  read -r -p "${color_prompt}Select a file [1]: ${color_reset}" selection
+  selection=${selection:-1}
+  if [[ ! $selection =~ ^[0-9]+$ ]]; then
+    echo "scf: invalid selection" >&2
+    exit 2
+  fi
+  selection=$((10#$selection))
+  if (( selection < 1 || selection > ${#paths[@]} )); then
+    echo "scf: invalid selection" >&2
+    exit 2
+  fi
+  config_path=${paths[selection - 1]}
+else
+  config_path=${paths[0]}
+fi
+
+if [[ $interactive == false ]]; then
+  restore_locale
+  exec cat -- "$config_path"
+fi
+
+editor=${VISUAL:-${EDITOR:-vim}}
+read -r -a editor_command <<< "$editor"
+if (( ${#editor_command[@]} == 0 )); then
+  editor_command=(vim)
+fi
+restore_locale
+exec "${editor_command[@]}" "$config_path"
--- a/scripts/sne
+++ b/scripts/sne
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+if [ "$#" -eq 0 ]; then
+    echo "usage: sne <filename or regex pattern>"
+    echo "example: sne config.yaml"
+    exit 1
+fi
+
+SEARCH_PATTERN="$1"
+files=()
+while IFS= read -r -d $'\0' file; do
+    files+=("$file")
+done < <(fd "$SEARCH_PATTERN" --type f --print0)
+file_count=${#files[@]}
+if [ "$file_count" -eq 0 ]; then
+    echo "no file match '$SEARCH_PATTERN'"
+    exit 0
+fi
+echo "🔎 found $file_count files:"
+for file in "${files[@]}"; do
+    echo "  📄 $file"
+done
+echo "----------------------------------------"
+
+read -r -p "edit? [Y/n] " response
+response=${response:-Y}
+if [[ "$response" =~ ^[Yy]$ ]]; then
+    vim "${files[@]}"
+else
+    echo "❌ aborted"
+fi
--- a/tools/alpine.sh
+++ b/tools/alpine.sh
@@ -1,29 +1,23 @@
-#!/bin/bash
-
-if [[ $USER != "root" ]]; then
-    echo "must run as root!"
-    exit 1
-fi
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"

 set_mirror()
 {
-    #MIRROR=${1:="mirrors.tuna.tsinghua.edu.cn"}
-    #MIRROR=${MIRROR//\//\\\/}
-    #sed -i 's/(archive|security).ubuntu.com/${MIRROR}/g' /etc/apt/sources.list
-    echo "to-do ..."
+    MIRROR=${1:-"mirrors.tuna.tsinghua.edu.cn"}
+    sed -i "s@dl-cdn.alpinelinux.org@${MIRROR}@g" /etc/apk/repositories
 }

 apk_add()
 {
    apk update
-
-    # mass installation
-    apk add zsh git tmux vim curl wget bash python3 htop gcc g++ cmake make fzf perl linux-headers bind-tools iputils man-db
-    #for i in {fzf,ripgrep}; do apk add $i -y; done
-
-    # who am i
-    git config --global user.email "me@beardic.cn"
-    git config --global user.name "Dict Xiong"
+    # lite
+    apk add zsh bash git tmux vim curl fzf iputils coreutils util-linux
+    # full
+    if [[ -z "$DFS_LITE" || "$DFS_LITE" == "0" ]]; then
+        apk add wget python3 py3-pip htop gcc g++ cmake make perl linux-headers bind-tools man-db
+    fi
 }

 set_timezone()
@@ -39,9 +33,9 @@ router()
    case $1 in
        apk-add ) apk_add ;;
        set-timezone | set-tz ) set_timezone ;;
-        #set-mirror  ) set_mirror $2 ;;  
-        *           ) echo unknown command "$1". available: apk-add, set-timezone;;
+        set-mirror  ) set_mirror $2 ;;
+        *           ) echo unknown command \"$1\". available: apk-add, set-timezone;;
    esac
 }

-router $@
+router "${GOT_OPTS[@]}"
--- a/tools/append_zsh_hist.sh
+++ b/tools/append_zsh_hist.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"
+
+zsh_hist_file="$HOME/.zsh_history"
+
+do_append()
+{
+    timestamp=$(date +%s)
+    while read -r line; do
+        if [[ -n "$line" ]]; then
+            echo ": $timestamp:0;$line" >> "$zsh_hist_file"
+        fi
+    done
+}
+
+main()
+{
+    key=$1
+    if [[ -z "$key" ]]; then
+        fmt_fatal "missing key"
+    fi
+    IFS=',' read -r -a keys<<<"$key"
+    for k in "${keys[@]}";do
+        if [[ -z "$k" ]]; then
+            continue
+        fi
+        (curl -fsSL "https://pastebin.com/raw/$k" && echo) | sed 's/\r//' | do_append
+    done
+}
+
+main "${GOT_OPTS[@]}"
--- a/tools/common.sh
+++ b/tools/common.sh
@@ -0,0 +1,260 @@
+#!/usr/bin/env bash
+set -e
+THIS_DIR_COMMON_SH=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+export DOTFILES=$( cd "$THIS_DIR_COMMON_SH/.." && pwd )
+if [[ -f ~/.config/dotfiles/env ]]; then set -a; source ~/.config/dotfiles/env; set +a; fi
+if [[ "$DFS_DEV" == "1" ]]; then set -x; fi
+DFS_CURL_OPTIONS="--retry 2 --max-time 20"
+
+# Parse args and set env when sourced, unless the caller handles its own
+# option boundary.
+if [[ "${BASH_SOURCE[0]}" != "${0}" && "$DFS_SKIP_ARG_PARSE" != "1" ]]; then
+    ORIGIN_ARGS=("$@")
+    ARG=""
+    GOT_OPTS=()
+    while [[ $# -gt 0 || -n "$ARG" ]]; do
+        if [[ -z "$ARG" ]]; then
+            if [[ "$1" == "--" ]]; then GOT_OPTS+=("$@"); break; fi
+            ARG="$1"; shift;
+        fi
+        case $ARG in
+            -q*|--quiet ) export DFS_QUIET=1 ;;
+            -l*|--lite ) export DFS_LITE=1 ;;
+            -d*|--dev ) export DFS_DEV=1; set -x ;;
+            -D*|--dry-run ) export DFS_DRY_RUN=1 ;;
+            --color ) export DFS_COLOR=1 ;;
+            --*=* ) GOT_OPTS+=("${ARG%%=*}" "${ARG#*=}") ;;
+            --* ) GOT_OPTS+=("$ARG") ;;
+            -* ) GOT_OPTS+=("${ARG:0:2}") ;;
+            *  ) GOT_OPTS+=("$ARG") ;;
+        esac
+        if [[ "$ARG" == "--"* || ! "$ARG" == "-"* || ${#ARG} -le 2 ]]; then
+            ARG=""
+        else
+            ARG=-${ARG:2}
+        fi
+    done
+    set -- "${ORIGIN_ARGS[@]}"
+    unset ARG
+    # outputs: GOT_OPTS and ORIGIN_ARGS
+fi
+
+# Color settings
+# Source: https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
+is_tty() {
+    [[ -t 1 || "$DFS_COLOR" == "1" ]]
+}
+
+supports_truecolor() {
+    case "$COLORTERM" in
+    truecolor|24bit) return 0 ;;
+    esac
+
+    case "$TERM" in
+    iterm           |\
+    tmux-truecolor  |\
+    linux-truecolor |\
+    xterm-truecolor |\
+    screen-truecolor) return 0 ;;
+    esac
+
+    return 1
+}
+
+fmt_fatal() {
+    printf '%sfatal: %s%s\n' "${FMT_BOLD}${FMT_RED}" "$*" "${FMT_RESET}" >&2
+    exit 1
+}
+
+fmt_error() {
+    printf '%serror: %s%s\n' "${FMT_RED}" "$*" "${FMT_RESET}" >&2
+}
+
+fmt_warning() {
+    printf '%swarning: %s%s\n' "${FMT_YELLOW}" "$*" "${FMT_RESET}" >&2
+}
+
+fmt_info() {
+    printf '%sinfo: %s\n' "${FMT_RESET}" "$*" >&2
+}
+
+fmt_note() {
+    printf '%s%s%s\n' "${FMT_GREEN}" "$*" "${FMT_RESET}" >&2
+}
+
+setup_color() {
+    # Only use colors if connected to a terminal
+    if ! is_tty; then
+        FMT_RAINBOW=""
+        FMT_RED=""
+        FMT_GREEN=""
+        FMT_YELLOW=""
+        FMT_BLUE=""
+        FMT_BOLD=""
+        FMT_RESET=""
+    return
+    fi
+
+    if supports_truecolor; then
+    FMT_RAINBOW="
+        $(printf '\033[38;2;255;0;0m')
+        $(printf '\033[38;2;255;97;0m')
+        $(printf '\033[38;2;247;255;0m')
+        $(printf '\033[38;2;0;255;30m')
+        $(printf '\033[38;2;77;0;255m')
+        $(printf '\033[38;2;168;0;255m')
+        $(printf '\033[38;2;245;0;172m')
+    "
+    else
+    FMT_RAINBOW="
+        $(printf '\033[38;5;196m')
+        $(printf '\033[38;5;202m')
+        $(printf '\033[38;5;226m')
+        $(printf '\033[38;5;082m')
+        $(printf '\033[38;5;021m')
+        $(printf '\033[38;5;093m')
+        $(printf '\033[38;5;163m')
+    "
+    fi
+
+    FMT_RED=$(printf '\033[31m')
+    FMT_GREEN=$(printf '\033[32m')
+    FMT_YELLOW=$(printf '\033[33m')
+    FMT_BLUE=$(printf '\033[34m')
+    FMT_BOLD=$(printf '\033[1m')
+    FMT_RESET=$(printf '\033[0m')
+}
+# END of color settings
+
+SUDO=''
+SUDOE=''
+if [[ "$EUID" != "0" && -x $(command -v sudo) ]]; then
+    SUDO='sudo'
+    SUDOE='sudo -E'
+fi
+
+ask_for_yN()
+{
+    if [[ "$DFS_QUIET" == "1" ]]; then
+        echo 0
+    else
+        read -p "${FMT_YELLOW}$1${FMT_RESET} [yN]: " yn
+        case $yn in
+            [Yy]* ) echo 1;;
+            * ) echo 0;;
+        esac
+    fi
+}
+
+ask_for_Yn()
+{
+    if [[ "$DFS_QUIET" == "1" ]]; then
+        echo 1
+    else
+        read -p "${FMT_YELLOW}$1${FMT_RESET} [Yn]: " yn
+        case $yn in
+            [Nn]* ) echo 0;;
+            * ) echo 1;;
+        esac
+    fi
+}
+
+post_beacon()
+{
+    if [[ $# < 1 || -z "$1" ]]; then
+        fmt_fatal "usage: post_beacon <beacon>"
+    fi
+    "${DOTFILES}/tools/frigg-client.sh" "beacon" "$1" "$2"
+}
+
+apost_beacon()
+{
+    post_beacon "$@" 1>/dev/null &
+}
+
+get_os_type()
+{
+    test -z "$DFS_OS_TYPE" || { echo "$DFS_OS_TYPE"; return; }
+    local ans="unknown"
+    case "$(uname -s)" in
+        Darwin*)    ans="MacOS";;
+        CYGWIN*)    ans="Cygwin";;
+        MSYS*  )    ans="MSYS";;
+        Linux* )    ans="Linux";;
+        *)          ans="unknown";;
+    esac
+    export DFS_OS_TYPE="$ans"
+    echo $ans | tr '[:upper:]' '[:lower:]'
+}
+
+get_linux_dist()
+{
+    test -z "$DFS_LINUX_DIST" || { echo "$DFS_LINUX_DIST"; return; }
+    local ans="unknown"
+    if [ -f /etc/os-release ]; then
+        . /etc/os-release
+        ans="$ID"
+    elif type lsb_release >/dev/null 2>&1; then
+        ans="$(lsb_release -si)"
+    elif [ -f /etc/lsb-release ]; then
+        . /etc/lsb-release
+        ans="$DISTRIB_ID"
+    elif [ -f /etc/debian_version ]; then
+        ans="Debian"
+    elif [ -f /etc/SuSe-release ]; then
+        ans="SUSE"
+    elif [ -f /etc/redhat-release ]; then
+        ans="RedHat"
+    else
+        ans="unknown"
+    fi
+    export DFS_LINUX_DIST="$ans"
+    echo $ans | tr '[:upper:]' '[:lower:]'
+}
+
+get_os_name()
+{
+    local ans=$(get_os_type)
+    if [[ "$ans" == "linux" ]]; then
+        ans=$(get_linux_dist)
+    fi
+    echo $ans
+}
+
+is_port_free() {
+    ( echo $1 | grep -qxE "[1-9][0-9]{0,4}" ) || false
+    local cmd
+    case $(get_os_type) in
+        macos ) cmd="netstat -van | grep -q \".$1\"" ;;
+        cygwin|msys ) cmd="netstat -ano | grep -q \":$1\"" ;;
+        *) cmd="netstat -tuanp | grep -q \":$1\"" ;;
+    esac
+    if eval $cmd; then
+        return 2
+    else
+        return 0
+    fi
+}
+
+get_free_port() {
+    while
+        local port=$(shuf -n 1 -i 49152-65535)
+        ! is_port_free $port
+    do
+        continue
+    done
+    echo $port
+}
+
+is_function() {
+    test "$(type -t "$1")" = "function"
+}
+
+# if bash-ed, else source-d
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    $1 "${@:2}"
+else
+    setup_color
+fi
+
+unset THIS_DIR_COMMON_SH
--- a/tools/frigg-client.sh
+++ b/tools/frigg-client.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"
+
+if [[ "$DFS_ORPHAN" == "1" ]]; then
+    exit 0
+fi
+
+if [[ -n "$DFS_HOSTNAME" ]]; then
+    hostname=$DFS_HOSTNAME
+elif [[ -x $(command -v hostname) ]]; then
+    hostname=$(hostname)
+elif [[ -x $(command -v uname) ]]; then
+    hostname=$(uname -n)
+elif [[ -x $(command -v hostnamectl) ]]; then
+    hostname=$(hostnamectl --static)
+elif [[ -n "$HOSTNAME" ]]; then
+    hostname=$HOSTNAME
+elif [[ -f /proc/sys/kernel/hostname ]]; then
+    hostname=$(cat /proc/sys/kernel/hostname)
+elif [[ -f /etc/hostname ]]; then
+    hostname=$(cat /etc/hostname)
+else
+    fmt_fatal "unable to get hostname"
+fi
+hostname=$(echo $hostname | tr '[:upper:]' '[:lower:]')
+
+init_uuid()
+{
+    if  [[ -f ~/.config/dotfiles/uuid ]]; then
+        uuid=$(cat ~/.config/dotfiles/uuid)
+    else
+        if [[ -x $(command -v uuidgen) ]]; then
+            uuid=$(uuidgen)
+        elif [[ -f /proc/sys/kernel/random/uuid ]]; then
+            uuid=$(cat /proc/sys/kernel/random/uuid)
+        else
+            fmt_fatal "unable to generate uuid"
+        fi
+        mkdir -p ~/.config/dotfiles
+        echo "$uuid" > ~/.config/dotfiles/uuid
+    fi
+}
+
+handle_resp()
+{
+    local resp="$1"
+    if grep -q "200" <<< "$resp"; then
+        echo $resp
+    elif grep -q "403" <<< "$resp"; then
+        echo $resp >&2
+        fmt_error "error accessing api: authentification failed"
+        fmt_info "try to register you hostname and uuid"
+        fmt_info "hostname: $hostname"
+        fmt_info "uuid: $uuid"
+    else
+        echo $resp >&2
+        fmt_fatal "server returned an error"
+        # here return 1 because this is not expected
+    fi
+}
+
+post_beacon()
+{
+    local beacon_type="$1"
+    local meta="$2"
+    if [[ -n "$CI" && "$beacon_type" != "gh.ci" && "$beacon_type" != "dfs.invalid-commit" && "$beacon_type" != "dfs.dirty" ]]; then
+        return
+    fi
+    if [[ -z "$beacon_type" ]]; then
+        fmt_fatal "beacon type is required"
+    fi
+    resp=$(curl $DFS_CURL_OPTIONS -sSL -X POST -H "Content-Type: text/plain" -d "$meta" "https://api.beardic.cn/post-beacon?hostname=$hostname&beacon=$beacon_type")
+    handle_resp "$resp"
+}
+
+update_dns()
+{
+    if [[ -z "$DFS_DDNS_IP4$DFS_DDNS_IP6" ]]; then
+        fmt_fatal "neither DFS_DDNS_IP4 nor DFS_DDNS_IP6 is configured"
+    fi
+    if [[ "$DFS_DDNS_IP4$DFS_DDNS_IP6" == "autoauto" ]]; then
+        fmt_fatal "DFS_DDNS_IP4 and DFS_DDNS_IP6 cannot both be auto"
+    fi
+    init_uuid
+    local ip4
+    local ip6
+    local api_url="https://api.beardic.cn"
+    # get ip4
+    if [[ -z "$DFS_DDNS_IP4" ]]; then
+        ip4=""
+    elif [[ "$DFS_DDNS_IP4" == "auto" ]]; then
+        ip4="auto"
+        api_url="https://api4.beardic.cn"
+    elif [[ "$DFS_DDNS_IP4" == "api" ]]; then
+        ip4=$(curl $DFS_CURL_OPTIONS -sSL "https://api.ipify.org")
+    elif [[ "$DFS_DDNS_IP4" == "http"* ]]; then
+        ip4=$(curl $DFS_CURL_OPTIONS -sSL "$DFS_DDNS_IP4")
+    else
+        ip4=$(ip -4 --brief addr show $DFS_DDNS_IP4 scope global primary | awk '{split($3,a,"/");print a[1]}' | head -n 1)
+    fi
+    if [[ -n "$DFS_DDNS_IP4" && -z "$ip4" ]]; then
+        fmt_fatal "failed getting ip4 address"
+    fi
+    # get ip6
+    if [[ -z "$DFS_DDNS_IP6" ]]; then
+        ip6=""
+    elif [[ "$DFS_DDNS_IP6" == "auto" ]]; then
+        ip6="auto"
+        api_url="https://api6.beardic.cn"
+    elif [[ "$DFS_DDNS_IP6" == "api" ]]; then
+        ip6=$(curl $DFS_CURL_OPTIONS -sSL "https://api6.ipify.org")
+    elif [[ "$DFS_DDNS_IP6" == "http"* ]]; then
+        ip6=$(curl $DFS_CURL_OPTIONS -sSL "$DFS_DDNS_IP6")
+    else
+        ip6=$(ip -6 --brief addr show $DFS_DDNS_IP6 scope global primary | awk '{split($3,a,"/");print a[1]}' | head -n 1)
+    fi
+    if [[ -n "$DFS_DDNS_IP6" && -z "$ip6" ]]; then
+        fmt_fatal "failed getting ip6 address"
+    fi
+    # update dns
+    fmt_note "updating dns record for $hostname with ip4=$ip4 ip6=$ip6"
+    resp=$(curl $DFS_CURL_OPTIONS -sSL "$api_url/update-dns?hostname=$hostname&uuid=$uuid&ip4=$ip4&ip6=$ip6")
+    handle_resp "$resp"
+}
+
+print_help()
+{
+    fmt_info "usage: $0 <beacon|ddns> [beacon_type] [beacon_meta]"
+}
+
+router()
+{
+    case "$1" in
+        -h|--help)
+            print_help
+            ;;
+        beacon)
+            post_beacon "$2" "$3"
+            ;;
+        ddns)
+            update_dns
+            ;;
+        *)
+            print_help
+            fmt_fatal "invalid argument"
+            ;;
+    esac
+}
+
+router "${GOT_OPTS[@]}"
--- a/tools/get.dotfiles.cn
+++ b/tools/get.dotfiles.cn
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -e
+ARG=""
+GOT_OPTS=()
+DFS_USER="$(whoami)"
+while [[ $# > 0||-n "$ARG" ]];do
+    if [[ -z "$ARG" ]];then ARG=$1;shift;fi
+    case $ARG in
+        -s*|--secure)DFS_SECURE=1;;
+        -u*|--user)if [[ "$ARG" == --*=* ]];then
+                DFS_USER="${ARG#*=}"
+            else
+                DFS_USER=$1
+                shift
+            fi
+            if [[ -z "$DFS_USER" ]];then
+                echo "install user is required"
+                exit 1
+            fi;;
+        --*=*)GOT_OPTS+=("${ARG%%=*}" "${ARG#*=}");;
+        --*)GOT_OPTS+=("$ARG");;
+        -*)GOT_OPTS+=("${ARG:0:2}");;
+        *)GOT_OPTS+=("$ARG");;
+    esac
+    if [[ "$ARG" == "--"*||! "$ARG" == "-"*||${#ARG} -le 2 ]];then
+        ARG=""
+    else
+        ARG=-${ARG:2}
+    fi
+done
+IFS=',' read -r -a DFS_USERS<<<"$DFS_USER"
+for u in "${DFS_USERS[@]}";do
+    if [[ -z "$u" ]];then
+        continue
+    fi
+    if ! id -u "$u" >/dev/null 2>&1;then
+        echo "user $u not exists"
+        exit 1
+    fi
+    if [[ "$u" == "$(whoami)" ]];then
+        SUCMD="bash"
+    else
+        SUCMD="su $u"
+    fi
+    echo "install for user $u in 3 seconds ..."
+    sleep 3
+    $SUCMD<<EOF
+set -e
+cd
+if [[ ! -f ~/dotfiles/install.sh ]];then
+    git clone ${repo}
+fi
+if [[ "$DFS_SECURE" == "1" ]];then
+    echo "enter secure mode"
+    cd dotfiles
+    git fetch --all
+    git -c advice.detachedHead=false checkout $(curl -fsSL https://api.beardic.cn/get-var/dfs-commit-id)
+    cd
+fi
+./dotfiles/install.sh ${GOT_OPTS[@]}
+zsh -c "source ~/.zshrc"
+EOF
+done
--- a/tools/install.sh
+++ b/tools/install.sh
@@ -1,21 +0,0 @@
-#!/bin/bash
-
-declare -A install_commands
-install_commands=(\
-    [git]="apt update && apt install git" \
-    [fzf]="git clone --depth 1 https://github.com/junegunn/fzf.git ~/.fzf &&  ~/.fzf/install" \
-    [acme.sh]="curl https://get.acme.sh | sh -s email=${EMAIL:-me@beardic.cn}" \
-    [oh-my-zsh]='sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"' \
-    [oh-my-tuna]='wget https://tuna.moe/oh-my-tuna/oh-my-tuna.py && sudo python oh-my-tuna.py --global' \
-    [v2ray]="bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh) #--remove" \
-    [zerotier-one]='curl -s https://install.zerotier.com | sudo bash' \
-    [docker-ce]='curl -fsSL https://get.docker.com -o get-docker.sh && sudo sh get-docker.sh #--mirror Aliyun #--dry-run' \
-    [lemonbench]='curl -fsSL https://ilemonra.in/LemonBenchIntl | bash -s fast # or full' \
-)
-
-install()
-{
-    echo -e ${install_commands[$1]}
-}
-
-install $1
--- a/tools/macos.sh
+++ b/tools/macos.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"
+
+brew_install()
+{
+    # brew update
+    brew install git zsh curl tmux vim util-linux coreutils
+}
+
+router()
+{
+    case $1 in
+        brew-install ) brew_install ;;
+        *            ) echo unknown command \"$1\". available: brew-install;;
+    esac
+}
+
+router "${GOT_OPTS[@]}"
--- a/tools/msys2.sh
+++ b/tools/msys2.sh
@@ -1,9 +1,7 @@
-#!/bin/bash
-
-if [[ $USER != "root" ]]; then
-    echo "must run as root!"
-    exit 1
-fi
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"

 set_mirror()
 {
@@ -16,7 +14,12 @@ set_mirror()
 pacman_S()
 {
    pacman -Syu
-    pacman -S tmux git zsh curl vim wget base-devel mingw-w64-x86_64-toolchain make cmake gcc zip unzip
+    # lite
+    pacman -S tmux git zsh bash curl vim
+    # full
+    if [[ -z "$DFS_LITE" || "$DFS_LITE" == "0" ]]; then
+        pacman -S wget base-devel mingw-w64-x86_64-toolchain make cmake gcc zip unzip python3 python3-pip man-pages-posix
+    fi
 }

 router()
@@ -24,8 +27,8 @@ router()
    case $1 in
        pacman-S    ) pacman_S ;;
        set-mirror  ) set_mirror $2 ;;  
-        *           ) echo unknown command "$1". available: pacman-S, set-mirror ;;
+        *           ) echo unknown command \"$1\". available: pacman-S, set-mirror ;;
    esac
 }

-router $@
+router "${GOT_OPTS[@]}"
--- a/tools/sagent-op.sh
+++ b/tools/sagent-op.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -e
+
+op=$(command -v op || command -v op.exe || true)
+if [[ -z "$op" || ! -x "$op" ]]; then
+    echo "1Password CLI not found" >&2
+    exit 1
+fi
+exec "$op" read "op://Personal/id25519-passphrase/$(hostname)"
--- a/tools/sagent.sh
+++ b/tools/sagent.sh
@@ -0,0 +1,341 @@
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+export DFS_COLOR=1
+source "$THIS_DIR/common.sh"
+
+
+SO_PATHS=(
+    "/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"  # ubuntu 22.04
+    "/run/current-system/sw/lib/opensc-pkcs11.so"  # nixos 23.05
+    "/Library/OpenSC/lib/opensc-pkcs11.so"  # macos 13.4
+)
+
+find_so_file()
+{
+    local SO_FILE
+    for SO_FILE in ${SO_PATHS[*]}; do
+        if [[ -f "$SO_FILE" ]]; then
+            echo "$SO_FILE"
+            return
+        fi
+    done
+    return 1
+}
+
+create_agent()
+{
+    local IFS=","
+    ssh-agent -P "${SO_PATHS[*]},/nix/store/*"
+}
+
+kill_agent()
+{
+    local status
+    if pgrep -u "$EUID" -x ssh-agent > /dev/null; then
+        fmt_note "stopping existing ssh-agent"
+        if pkill -TERM -u "$EUID" -x ssh-agent; then
+            :
+        else
+            status=$?
+            [[ $status -eq 1 ]] || return "$status"
+        fi
+    fi
+    if command -v gpgconf > /dev/null 2>&1; then
+        fmt_note "stopping gpg-agent if running"
+        gpgconf --kill gpg-agent
+    fi
+    unset SSH_AUTH_SOCK SSH_AGENT_PID
+    echo unset SSH_AUTH_SOCK SSH_AGENT_PID
+}
+
+add_piv()
+{
+    local SO_FILE
+    if ! SO_FILE=$(find_so_file); then
+        fmt_error "opensc-pkcs11.so not found"
+        return 1
+    fi
+    printf 'ssh-add -s %q\n' "$SO_FILE"
+    list
+}
+
+add_id25519_with_op()
+{
+    local status
+    if SSH_ASKPASS_REQUIRE=force SSH_ASKPASS="$THIS_DIR/sagent-op.sh" timeout 60s ssh-add "$HOME/.ssh/id_ed25519"; then
+        list
+        return
+    else
+        status=$?
+    fi
+
+    if [[ $status -eq 124 ]]; then
+        fmt_fatal "timed out when adding the key"
+    else
+        fmt_fatal "failed to add the key (ssh-add exit $status); check the key, agent, and 1Password CLI"
+    fi
+}
+
+list()
+{
+    echo echo "available keys:"
+    echo ssh-add -l
+}
+
+configured_pinentry()
+{
+    local agent_conf
+    local agent_confs=()
+    for agent_conf in "$@"; do
+        [[ -f "$agent_conf" ]] && agent_confs+=("$agent_conf")
+    done
+    [[ ${#agent_confs[@]} -gt 0 ]] || return 1
+
+    awk '
+        /^[[:space:]]*#/ { next }
+        {
+            line = $0
+            sub(/^[[:space:]]*/, "", line)
+            if (line ~ /^pinentry-program([[:space:]]|=)/) {
+                sub(/^pinentry-program[[:space:]=]*/, "", line)
+                sub(/[[:space:]]*$/, "", line)
+                pinentry = line
+            }
+        }
+        END {
+            if (pinentry == "") exit 1
+            print pinentry
+        }
+    ' "${agent_confs[@]}"
+}
+
+check_pinentry()
+{
+    local gnupg_home
+    local gpg_sysconfdir
+    local agent_conf
+    local system_agent_conf
+    local pinentry
+    local gpg_bindir
+    local candidate
+
+    gnupg_home=$(gpgconf --list-dirs homedir)
+    gpg_sysconfdir=$(gpgconf --list-dirs sysconfdir)
+    agent_conf="$gnupg_home/gpg-agent.conf"
+    system_agent_conf="$gpg_sysconfdir/gpg-agent.conf"
+    if pinentry=$(configured_pinentry "$system_agent_conf" "$agent_conf"); then
+        if [[ "$pinentry" == "~/"* ]]; then
+            pinentry="$HOME/${pinentry#\~/}"
+        fi
+        if [[ -x "$pinentry" ]]; then
+            return
+        fi
+        fmt_warning "configured pinentry is not executable: $pinentry"
+    else
+        gpg_bindir=$(gpgconf --list-dirs bindir)
+        if [[ -x "$gpg_bindir/pinentry" || -x "$gpg_bindir/pinentry-basic" ]]; then
+            return
+        fi
+    fi
+
+    for candidate in \
+        "$(command -v pinentry-curses 2>/dev/null || true)" \
+        "$(command -v pinentry 2>/dev/null || true)" \
+        "$(command -v pinentry-tty 2>/dev/null || true)"; do
+        [[ -n "$candidate" && -x "$candidate" ]] && break
+        candidate=""
+    done
+
+    if [[ -n "$candidate" ]]; then
+        fmt_warning "gpg-agent has no usable pinentry; add 'pinentry-program $candidate' to $agent_conf"
+    else
+        fmt_warning "gpg-agent has no usable pinentry; install one and configure pinentry-program in $agent_conf"
+    fi
+}
+
+prepare_gpg_agent()
+{
+    command -v gpgconf > /dev/null 2>&1 || fmt_fatal "gpgconf not found"
+    command -v gpg-connect-agent > /dev/null 2>&1 || fmt_fatal "gpg-connect-agent not found"
+
+    check_pinentry
+
+    local current_tty
+    current_tty=$(tty) || fmt_fatal "unable to determine the current TTY"
+    export GPG_TTY="$current_tty"
+
+    gpgconf --launch gpg-agent
+    gpg-connect-agent updatestartuptty /bye > /dev/null
+}
+
+use_gpg_agent()
+{
+    prepare_gpg_agent
+
+    local agent_socket
+    agent_socket=$(gpgconf --list-dirs agent-ssh-socket)
+    if [[ -z "$agent_socket" || ! -S "$agent_socket" ]]; then
+        fmt_fatal "gpg-agent SSH socket not found; add 'enable-ssh-support' to ~/.gnupg/gpg-agent.conf and restart gpg-agent"
+    fi
+
+    fmt_note "using gpg-agent: $agent_socket"
+    echo unset SSH_AGENT_PID
+    printf 'export GPG_TTY=%q\n' "$GPG_TTY"
+    printf 'export SSH_AUTH_SOCK=%q\n' "$agent_socket"
+}
+
+cache_gpg_pin()
+{
+    [[ $# -le 1 ]] || fmt_fatal "usage: sagt gpg-pin [KEY]"
+    command -v gpg > /dev/null 2>&1 || fmt_fatal "gpg not found"
+    prepare_gpg_agent
+
+    local signing_key="${1:-}"
+    local temp_dir
+    local signature_file
+    local status=0
+    local gpg_args=(--detach-sign)
+
+    temp_dir=$(mktemp -d "${TMPDIR:-/tmp}/sagent-gpg-pin.XXXXXXXXXX") || \
+        fmt_fatal "failed to create a temporary directory"
+    signature_file="$temp_dir/signature.gpg"
+    gpg_args+=(--output "$signature_file")
+    [[ -z "$signing_key" ]] || gpg_args+=(--local-user "$signing_key")
+
+    fmt_note "performing a test signature; enter the GPG PIN and touch the token if prompted"
+    printf 'sagt gpg-pin\n' | gpg "${gpg_args[@]}" || status=$?
+
+    rm -f -- "$signature_file"
+    rmdir -- "$temp_dir"
+    [[ $status -eq 0 ]] || fmt_fatal "test signature failed (gpg exit $status)"
+    fmt_note "test signature completed; the GPG PIN should remain cached until the card or agent session is reset"
+}
+
+read_agent_file()
+{
+    local agent_file="$1"
+    local line
+    local agent_socket=""
+    local agent_pid=""
+
+    while IFS= read -r line; do
+        case "$line" in
+            SSH_AUTH_SOCK=*)
+                agent_socket=${line#SSH_AUTH_SOCK=}
+                agent_socket=${agent_socket%%;*}
+                ;;
+            SSH_AGENT_PID=*)
+                agent_pid=${line#SSH_AGENT_PID=}
+                agent_pid=${agent_pid%%;*}
+                ;;
+        esac
+    done < "$agent_file"
+
+    [[ -n "$agent_socket" && "$agent_pid" =~ ^[1-9][0-9]*$ ]] || return 1
+    export SSH_AUTH_SOCK="$agent_socket"
+    export SSH_AGENT_PID="$agent_pid"
+}
+
+agent_is_usable()
+{
+    [[ -S "$SSH_AUTH_SOCK" ]] || return 1
+    ps -p "$SSH_AGENT_PID" -o uid= -o comm= 2>/dev/null |
+        awk -v uid="$EUID" '$1 == uid && $2 ~ /(^|\/)ssh-agent$/ { found=1 } END { exit !found }' || return 1
+
+    local status
+    if ssh-add -l > /dev/null 2>&1; then
+        status=0
+    else
+        status=$?
+    fi
+    [[ $status -eq 0 || $status -eq 1 ]]
+}
+
+print_agent_env()
+{
+    printf 'export SSH_AUTH_SOCK=%q\n' "$SSH_AUTH_SOCK"
+    printf 'export SSH_AGENT_PID=%q\n' "$SSH_AGENT_PID"
+}
+
+reset()
+{
+    kill_agent
+    all already-killed
+}
+
+all()
+{
+    local mode="${1:-}"
+    mkdir -p "$HOME/.ssh"
+    local agent_file="$HOME/.ssh/agent-$(whoami)"
+    [[ ! -L "$agent_file" ]] || fmt_fatal "refusing to use symlink as agent file: $agent_file"
+    unset SSH_AUTH_SOCK SSH_AGENT_PID
+
+    if [[ "$mode" != "already-killed" && -f "$agent_file" ]]; then
+        chmod 600 "$agent_file"
+        read_agent_file "$agent_file" || true
+    else
+        touch "$agent_file"
+        chmod 600 "$agent_file"
+    fi
+
+    if ! agent_is_usable; then
+        if [[ "$mode" != "already-killed" ]]; then
+            kill_agent
+        fi
+        fmt_note "launching a new agent"
+        local agent_output
+        if ! agent_output=$(create_agent); then
+            fmt_fatal "failed to launch ssh-agent"
+        fi
+        printf '%s\n' "$agent_output" > "$agent_file"
+        chmod 600 "$agent_file"
+        read_agent_file "$agent_file" || fmt_fatal "ssh-agent returned invalid environment data"
+        agent_is_usable || fmt_fatal "new ssh-agent is not usable"
+    else
+        fmt_note "using existing agent: $SSH_AGENT_PID"
+    fi
+    print_agent_env
+}
+
+route()
+{
+    os_type="$(get_os_type)"
+    if [[ "$os_type" == "msys" || "$os_type" == "cygwin" ]]; then
+        fmt_fatal "unsupported platform: $os_type. you may use WinCryptSSHAgent."
+    fi
+    if [[ $# -eq 0 ]]; then
+        all
+        return
+    fi
+    case $1 in
+        kill)
+            kill_agent
+            ;;
+        piv)
+            add_piv
+            ;;
+        op)
+            add_id25519_with_op
+            ;;
+        gpg)
+            use_gpg_agent
+            ;;
+        gpg-pin)
+            cache_gpg_pin "${@:2}"
+            ;;
+        reset)
+            reset
+            ;;
+        list|ls)
+            list
+            ;;
+        *)
+            fmt_error "unknown command: $1"
+            return 1
+            ;;
+    esac
+}
+
+route "$@"
--- a/tools/test-getopts.sh
+++ b/tools/test-getopts.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -ex
+OPTS='-a -bcl --color --quiet --arg1=1 --arg2 2 " 1 2" yes'
+TARGET_OPTS='-a -b -c --arg1 1 --arg2 2  1 2 yes'
+eval set -- $OPTS
+
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"
+
+test "${GOT_OPTS[*]}" = "$TARGET_OPTS"
+test $# -eq 9
+test "$*" = "${OPTS//\"/}"
+test "$DFS_LITE" = "1"
+is_tty
+test "$DFS_QUIET" = "1"
+
+set +x
+echo "test passed, args:"
+for i in "${GOT_OPTS[@]}"; do
+    echo "$i"
+done
--- a/tools/test-riot-gpg.sh
+++ b/tools/test-riot-gpg.sh
@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+THIS_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+RIOT="$THIS_DIR/../scripts/riot"
+TEST_DIR=$(mktemp -d /tmp/riot-gpg.XXXXXX)
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+MOCK_BIN="$TEST_DIR/bin"
+MOCK_HOME="$TEST_DIR/home"
+MOCK_LOCAL_SOCKET="$TEST_DIR/local/S.gpg-agent.extra"
+MOCK_REMOTE_SOCKET="$TEST_DIR/remote/S.gpg-agent"
+MOCK_GPG_LOG="$TEST_DIR/gpg.log"
+MOCK_SSH_LOG="$TEST_DIR/ssh.log"
+mkdir -p "$MOCK_BIN" "$MOCK_HOME" "${MOCK_LOCAL_SOCKET%/*}" "${MOCK_REMOTE_SOCKET%/*}"
+export MOCK_LOCAL_SOCKET MOCK_REMOTE_SOCKET MOCK_GPG_LOG MOCK_SSH_LOG
+
+make_stale_socket() {
+    rm -f "$1"
+    python3 - "$1" <<'PY'
+import socket
+import sys
+
+sock = socket.socket(socket.AF_UNIX)
+sock.bind(sys.argv[1])
+sock.close()
+PY
+}
+
+cat > "$MOCK_BIN/gpgconf" <<'EOF'
+#!/usr/bin/env bash
+printf 'gpgconf %s\n' "$*" >> "$MOCK_GPG_LOG"
+case "$*" in
+    '--list-dirs agent-extra-socket') printf '%s\n' "$MOCK_LOCAL_SOCKET" ;;
+    '--list-dirs agent-socket') printf '%s\n' "$MOCK_REMOTE_SOCKET" ;;
+    '--kill gpg-agent') exit "${MOCK_KILL_STATUS:-0}" ;;
+    *) exit 1 ;;
+esac
+EOF
+
+cat > "$MOCK_BIN/gpg-connect-agent" <<'EOF'
+#!/usr/bin/env bash
+printf 'gpg-connect-agent %s\n' "$*" >> "$MOCK_GPG_LOG"
+case "$*" in
+    *'GETINFO pid'*) printf 'D 123\nOK\n' ;;
+    *'GETINFO version'*)
+        [[ "${MOCK_LOCAL_LIVE:-1}" == 1 ]] || exit 1
+        printf 'D 2.4.0\nOK\n'
+        ;;
+    *'GETINFO restricted'*) printf 'D %s\nOK\n' "${MOCK_REMOTE_RESTRICTED:-0}" ;;
+    *) exit 1 ;;
+esac
+EOF
+
+cat > "$MOCK_BIN/systemctl" <<'EOF'
+#!/usr/bin/env bash
+[[ "${MOCK_SYSTEMD_ACTIVE:-0}" == 1 ]]
+EOF
+
+cat > "$MOCK_BIN/ssh" <<'EOF'
+#!/usr/bin/env bash
+{
+    printf 'CALL\n'
+    printf 'ARG=%s\n' "$@"
+} >> "$MOCK_SSH_LOG"
+
+is_probe=0
+last_arg=''
+for arg in "$@"; do
+    [[ "$arg" == '-T' ]] && is_probe=1
+    last_arg=$arg
+done
+if [[ "$is_probe" == 1 ]]; then
+    sh -c "$last_arg"
+fi
+EOF
+
+chmod +x "$MOCK_BIN/gpgconf" "$MOCK_BIN/gpg-connect-agent" "$MOCK_BIN/systemctl" "$MOCK_BIN/ssh"
+
+run_riot() {
+    HOME="$MOCK_HOME" RIOT_TRUST_CLIENT=0 PATH="$MOCK_BIN:$PATH" "$RIOT" "$@"
+}
+
+expect_failure() {
+    local expected=$1
+    shift
+    if run_riot "$@" > "$TEST_DIR/out" 2> "$TEST_DIR/err"; then
+        echo "expected riot to fail: $*" >&2
+        exit 1
+    fi
+    grep -Fq "$expected" "$TEST_DIR/err"
+}
+
+# Dry-run must not inspect or mutate either host.
+: > "$MOCK_GPG_LOG"
+: > "$MOCK_SSH_LOG"
+DFS_DRY_RUN=1 run_riot -g example.test > "$TEST_DIR/out" 2> "$TEST_DIR/err"
+grep -Fq '<remote-gpg-agent-socket>:<local-gpg-agent-extra-socket>' "$TEST_DIR/out"
+[[ ! -s "$MOCK_GPG_LOG" && ! -s "$MOCK_SSH_LOG" ]]
+
+# A socket inode without a listener must be rejected locally.
+make_stale_socket "$MOCK_LOCAL_SOCKET"
+MOCK_LOCAL_LIVE=0 expect_failure 'extra socket exists but is not accepting connections' -g example.test
+
+# -g is valid only for an interactive SSH login.
+expect_failure 'only supported for interactive SSH login' -g example.test scp ./a ./b
+expect_failure 'only supported for interactive SSH login' -g example.test ssh -- true
+
+# Never remove a regular file merely because it has the expected basename.
+MOCK_LOCAL_LIVE=1
+printf 'keep me\n' > "$MOCK_REMOTE_SOCKET"
+expect_failure 'refusing to remove the non-socket remote gpg-agent path' -g example.test
+grep -Fqx 'keep me' "$MOCK_REMOTE_SOCKET"
+
+# A restricted agent at the remote socket represents another forwarding session.
+make_stale_socket "$MOCK_REMOTE_SOCKET"
+MOCK_REMOTE_RESTRICTED=1 expect_failure 'another forwarded gpg-agent is already using the remote socket' -g example.test
+
+# A normal remote agent can be cleaned up; systemd activation is reported.
+make_stale_socket "$MOCK_REMOTE_SOCKET"
+: > "$MOCK_SSH_LOG"
+MOCK_REMOTE_RESTRICTED=0 MOCK_SYSTEMD_ACTIVE=1 run_riot -g example.test > "$TEST_DIR/out" 2> "$TEST_DIR/err"
+grep -Fq 'remote gpg-agent.socket is active' "$TEST_DIR/err"
+grep -Fq 'ARG=none' "$MOCK_SSH_LOG"
+grep -Fq 'ARG=ClearAllForwardings=yes' "$MOCK_SSH_LOG"
+grep -Fq 'ARG=-T' "$MOCK_SSH_LOG"
+! grep -Fq 'ARG=RequestTTY=' "$MOCK_SSH_LOG"
+grep -Fq 'ARG=StreamLocalBindUnlink=no' "$MOCK_SSH_LOG"
+grep -Fq "ARG=$MOCK_REMOTE_SOCKET:$MOCK_LOCAL_SOCKET" "$MOCK_SSH_LOG"
+[[ ! -e "$MOCK_REMOTE_SOCKET" ]]
+
+echo 'riot gpg forwarding tests passed'
--- a/tools/test-sagent-gpg-pin.sh
+++ b/tools/test-sagent-gpg-pin.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+THIS_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SAGENT="$THIS_DIR/sagent.sh"
+TEST_DIR=$(mktemp -d /tmp/sagent-gpg-pin.XXXXXX)
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+MOCK_BIN="$TEST_DIR/bin"
+MOCK_HOME="$TEST_DIR/home"
+MOCK_TMP="$TEST_DIR/tmp"
+MOCK_GPG_ARGS="$TEST_DIR/gpg-args"
+MOCK_GPG_INPUT="$TEST_DIR/gpg-input"
+MOCK_AGENT_LOG="$TEST_DIR/agent-log"
+mkdir -p "$MOCK_BIN" "$MOCK_HOME/gnupg" "$MOCK_HOME/sysconf" "$MOCK_TMP"
+export MOCK_BIN MOCK_HOME MOCK_GPG_ARGS MOCK_GPG_INPUT MOCK_AGENT_LOG
+
+cat > "$MOCK_BIN/gpgconf" <<'EOF'
+#!/usr/bin/env bash
+printf 'gpgconf %s\n' "$*" >> "$MOCK_AGENT_LOG"
+case "$*" in
+    '--list-dirs homedir') printf '%s\n' "$MOCK_HOME/gnupg" ;;
+    '--list-dirs sysconfdir') printf '%s\n' "$MOCK_HOME/sysconf" ;;
+    '--list-dirs bindir') printf '%s\n' "$MOCK_BIN" ;;
+    '--launch gpg-agent') ;;
+    *) exit 1 ;;
+esac
+EOF
+
+cat > "$MOCK_BIN/gpg-connect-agent" <<'EOF'
+#!/usr/bin/env bash
+printf 'gpg-connect-agent %s\n' "$*" >> "$MOCK_AGENT_LOG"
+EOF
+
+cat > "$MOCK_BIN/tty" <<'EOF'
+#!/usr/bin/env bash
+printf '/dev/pts/mock\n'
+EOF
+
+cat > "$MOCK_BIN/gpg" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$@" > "$MOCK_GPG_ARGS"
+output=''
+while [[ $# -gt 0 ]]; do
+    if [[ "$1" == '--output' ]]; then
+        output=$2
+        shift 2
+    else
+        shift
+    fi
+done
+cat > "$MOCK_GPG_INPUT"
+printf 'mock signature\n' > "$output"
+EOF
+
+printf '#!/usr/bin/env bash\n' > "$MOCK_BIN/pinentry"
+chmod +x "$MOCK_BIN/gpgconf" "$MOCK_BIN/gpg-connect-agent" "$MOCK_BIN/tty" \
+    "$MOCK_BIN/gpg" "$MOCK_BIN/pinentry"
+
+output=$(HOME="$MOCK_HOME" TMPDIR="$MOCK_TMP" PATH="$MOCK_BIN:$PATH" "$SAGENT" gpg-pin TEST-KEY 2> "$TEST_DIR/stderr")
+[[ -z "$output" ]]
+grep -Fxq -- '--detach-sign' "$MOCK_GPG_ARGS"
+grep -Fxq -- '--local-user' "$MOCK_GPG_ARGS"
+grep -Fxq -- 'TEST-KEY' "$MOCK_GPG_ARGS"
+grep -Fxq -- 'sagt gpg-pin' "$MOCK_GPG_INPUT"
+grep -Fq -- 'gpgconf --launch gpg-agent' "$MOCK_AGENT_LOG"
+grep -Fq -- 'gpg-connect-agent updatestartuptty /bye' "$MOCK_AGENT_LOG"
+grep -Fq -- 'test signature completed' "$TEST_DIR/stderr"
+
+output=$(HOME="$MOCK_HOME" TMPDIR="$MOCK_TMP" PATH="$MOCK_BIN:$PATH" "$SAGENT" gpg-pin 2> "$TEST_DIR/stderr")
+[[ -z "$output" ]]
+! grep -Fxq -- '--local-user' "$MOCK_GPG_ARGS"
+[[ -z $(find "$MOCK_TMP" -mindepth 1 -print -quit) ]]
+
+echo "sagent gpg-pin tests passed"
--- a/tools/test-scf.sh
+++ b/tools/test-scf.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+THIS_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SCF="$THIS_DIR/../scripts/scf"
+TEST_DIR=$(mktemp -d /tmp/scf.XXXXXX)
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+MOCK_BIN="$TEST_DIR/bin"
+DATA_DIR="$TEST_DIR/data"
+MOCK_SYSTEMCTL_LOG="$TEST_DIR/systemctl.log"
+MOCK_MAIN="$DATA_DIR/main.yaml"
+MOCK_CHILD="$DATA_DIR/child.conf"
+MOCK_NOTE="$DATA_DIR/notes.txt"
+mkdir -p "$MOCK_BIN" "$DATA_DIR"
+export MOCK_SYSTEMCTL_LOG MOCK_MAIN MOCK_CHILD MOCK_NOTE
+
+printf 'include %s\n' "$MOCK_CHILD" > "$MOCK_MAIN"
+printf 'child configuration\n' > "$MOCK_CHILD"
+printf 'not a configuration candidate\n' > "$MOCK_NOTE"
+
+cat > "$MOCK_BIN/systemctl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\n' "$*" >> "$MOCK_SYSTEMCTL_LOG"
+service=${@: -1}
+case "$service" in
+    demo.service)
+        printf 'path=/usr/bin/demo ; argv[0]=demo ; argv[1]=%s ; argv[2]=%s ;\n' \
+            "$MOCK_MAIN" "$MOCK_NOTE"
+        ;;
+    empty.service)
+        printf 'path=/usr/bin/empty ; argv[0]=empty ;\n'
+        ;;
+    *)
+        exit 1
+        ;;
+esac
+EOF
+chmod +x "$MOCK_BIN/systemctl"
+
+run_scf() {
+    PATH="$MOCK_BIN:$PATH" "$SCF" "$@"
+}
+
+# A service name without .service is accepted, and non-interactive mode prints
+# the only configuration candidate instead of opening an editor.
+output=$(run_scf demo 2> "$TEST_DIR/stderr")
+grep -Fxq 'include '"$MOCK_CHILD" <<< "$output"
+grep -Fq -- '--property=ExecStart --value demo.service' "$MOCK_SYSTEMCTL_LOG"
+
+# Recursive mode discovers configuration files referenced by the first one.
+output=$(run_scf -r -n 2 demo)
+grep -Fxq 'child configuration' <<< "$output"
+
+# Decimal values with a leading zero must not be treated as invalid octal.
+output=$(SCF_MAX_DEPTH=08 SCF_MAX_CANDIDATES=08 run_scf demo)
+grep -Fxq 'include '"$MOCK_CHILD" <<< "$output"
+if run_scf -n 08 demo > "$TEST_DIR/out" 2> "$TEST_DIR/stderr"; then
+    echo 'expected scf -n 08 to fail because only one candidate exists' >&2
+    exit 1
+fi
+grep -Fq 'candidate number 8 is out of range' "$TEST_DIR/stderr"
+
+# Invalid service names are rejected before systemctl is invoked.
+before=$(wc -l < "$MOCK_SYSTEMCTL_LOG")
+if run_scf 'demo; touch /tmp/unexpected' > "$TEST_DIR/out" 2> "$TEST_DIR/stderr"; then
+    echo 'expected an invalid service name to fail' >&2
+    exit 1
+fi
+grep -Fq 'invalid service name' "$TEST_DIR/stderr"
+after=$(wc -l < "$MOCK_SYSTEMCTL_LOG")
+test "$before" -eq "$after"
+
+# A service without a referenced file reports a useful failure.
+if run_scf empty > "$TEST_DIR/out" 2> "$TEST_DIR/stderr"; then
+    echo 'expected a service without a config path to fail' >&2
+    exit 1
+fi
+grep -Fq 'no existing configuration path found' "$TEST_DIR/stderr"
+
+echo 'scf tests passed'
--- a/tools/test.zsh
+++ b/tools/test.zsh
@@ -0,0 +1,79 @@
+#!/bin/false "This script should be sourced in zsh, not executed directly"
+
+set -ex
+trap "dfs beacon gh.ci.fail" ERR
+
+# fix for macos
+dfs cd
+if [[ $(./tools/common.sh get_os_type) == "macos" ]]; then
+    export PATH="/usr/local/opt/coreutils/libexec/gnubin:/opt/homebrew/opt/coreutils/libexec/gnubin:${PATH}"
+fi
+
+# check files
+cd /
+l
+cd ~
+l
+dfs cd
+l
+pwd
+test -f .zshrc2
+diff -q ./.ssh/authorized_keys2 ~/.ssh/authorized_keys2
+diff -q ./.eid/authorized_certificates ~/.eid/authorized_certificates
+grep -q ".zshrc2" ~/.zshrc
+if [[ -x $(command -v crontab) ]]; then
+    crontab -l | grep -qxF "0 * * * * ${DOTFILES}/update.sh"
+fi
+
+# check scripts and functions
+dfs version
+dfs beacon gh.ci $GITHUB_SHA
+z ~
+test ~ -ef "$(pwd)"
+dogo
+doll
+dfs cd
+tools/test-getopts.sh
+tools/test-scf.sh
+tools/test-riot-gpg.sh
+tools/test-sagent-gpg-pin.sh
+tools/common.sh get_os_name
+test $(echo y | tools/common.sh ask_for_yN "test") = "1"
+test $(echo n | tools/common.sh ask_for_yN "test") = "0"
+test $(echo | tools/common.sh ask_for_yN "test") = "0"
+test $(echo | tools/common.sh ask_for_Yn "test") = "1"
+test $(DFS_QUIET=1 tools/common.sh ask_for_Yn "test") = "1"
+test "$(DFS_TRUST=1 riot time@is.impt:2222/yes@you-r.right/you@are.really.recht./ibd./try@it,another@host -D scp /tmp/ ./tmp 2>/dev/null)" = 'scp -P 12022 -o ServerAliveInterval=60 -o PermitLocalCommand=yes -o ControlMaster=auto -o ControlPersist=5s -o ControlPath=~/.ssh/master-socket/%C -o ProxyJump=time@is.impt:2222,yes@you-r.right:12022,you@are.really.recht:12022,root@ibd:12022 -r try@it.dxng.net:/tmp/ ./tmp
+scp -P 12022 -o ServerAliveInterval=60 -o PermitLocalCommand=yes -o ControlMaster=auto -o ControlPersist=5s -o ControlPath=~/.ssh/master-socket/%C -o ForwardX11=yes -o ForwardAgent=yes -r another@host.dxng.net:/tmp/ ./tmp'
+test "$(riot you@example.com:55 -tD --password ssh ping -c 1 2>/dev/null)" = 'ssh -p 55 -o ServerAliveInterval=60 -o ForwardX11=yes -o ForwardAgent=yes -o PasswordAuthentication=yes -o PubkeyAuthentication=no you@example.com ping -c 1'
+
+# check alias
+alias p114
+alias cbds
+which riot
+sagt
+test -f ~/.ssh/agent-$(whoami)
+gbes || which gbes
+
+# check update
+DFS_VERSION=`dfs version`
+dfs update
+dfs version
+test `git rev-parse HEAD` = `curl -fsSL https://api.beardic.cn/get-var/dfs-commit-id`
+
+# clean
+git reset --hard $DFS_VERSION
+
+# then check install.sh
+./install.sh -dx DFS_CI=1 -H e153a2eL,f8At3iFw
+grep -qE "testhist 1$" ~/.zsh_history
+grep -qE "testhist 4$" ~/.zsh_history
+grep -qx "DFS_CI=1" ~/.config/dotfiles/env
+./install.sh -l
+dfs version
+test `git rev-parse HEAD` = `curl -fsSL https://api.beardic.cn/get-var/dfs-commit-id`
+
+# clean
+git reset --hard $DFS_VERSION
+
+set +x
--- a/tools/to-install.sh
+++ b/tools/to-install.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+declare -A INSTALL_COMMANDS
+INSTALL_COMMANDS=(\
+    [git]="apt update && apt install git" \
+    [fzf]="git clone --depth 1 https://gitee.com/dictxiong/fzf.git ~/.fzf &&  ~/.fzf/install" \
+    [acme.sh]="curl https://get.acme.sh | sh -s email=${EMAIL:-acme@dxng.net}" \
+    [oh-my-zsh]='sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"' \
+    [oh-my-tuna]='wget https://tuna.moe/oh-my-tuna/oh-my-tuna.py && sudo python oh-my-tuna.py --global' \
+    [v2fly]="bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh) #--remove" \
+    [zerotier-one]='curl -s https://install.zerotier.com | sudo bash' \
+    [docker-ce]='curl -fsSL https://get.docker.com | sudo bash -s - --mirror Aliyun #--dry-run' \
+    [lemonbench]='curl -fsSL https://raw.githubusercontent.com/LemonBench/LemonBench/main/LemonBench.sh | bash -s fast # or full' \
+    [nix]='sh <(curl -L https://nixos.org/nix/install) #--daemon' \
+    [alist]='curl -fsSL "https://alist.nn.ci/v3.sh" | bash -s install' \
+)
+
+install()
+{
+    echo -e ${INSTALL_COMMANDS[$1]}
+}
+
+install $1
--- a/tools/ubuntu.sh
+++ b/tools/ubuntu.sh
@@ -1,26 +1,25 @@
-#!/bin/bash
-
-if [[ $USER != "root" ]]; then
-    echo "must run as root!"
-    exit 1
-fi
+#!/usr/bin/env bash
+set -e
+THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
+source "$THIS_DIR/common.sh"

 set_mirror()
 {
    MIRROR=${1:-"mirrors.tuna.tsinghua.edu.cn"}
-    MIRROR=${MIRROR//\//\\\/}
-    sed -i 's/(archive|security).ubuntu.com/${MIRROR}/g' /etc/apt/sources.list
+    sed -i "s@http://.*archive.ubuntu.com@https://${MIRROR}@g" /etc/apt/sources.list
+    sed -i "s@http://.*security.ubuntu.com@https://${MIRROR}@g" /etc/apt/sources.list
 }

 apt_install()
 {
-    # basic packages
-    apt update
-    for i in {man-db,vim,ca-certificates}; do apt install $i -y; done
-
-    # mass installation
-    apt install git tmux zsh curl wget dialog net-tools dnsutils netcat traceroute sudo python3 python3-pip cron inetutils-ping openssh-client openssh-server htop gcc g++ cmake make zip
-    for i in {fzf,ripgrep}; do apt install $i -y; done
+    apt-get update -y
+    # lite
+    DEBIAN_FRONTEND=noninteractive apt-get install -y git zsh bash tmux vim curl iputils-ping less bsdmainutils
+    # full
+    if [[ -z "$DFS_LITE" || "$DFS_LITE" == "0" ]]; then
+        DEBIAN_FRONTEND=noninteractive apt-get install -y wget dialog net-tools dnsutils netcat traceroute sudo python3 python3-pip cron openssh-client openssh-server htop gcc g++ cmake make zip
+        for i in {fzf,ripgrep,man-db}; do DEBIAN_FRONTEND=noninteractive apt-get install -y $i; done
+    fi
 }

 set_timezone()
@@ -36,8 +35,8 @@ router()
        set-mirror  ) set_mirror $2 ;;  
        set-timezone\
        | set-tz    ) set_timezone $2 ;;
-        *           ) echo unknown command "$1". available: apt-install, set-mirror, set-timezone;;
+        *           ) echo unknown command \"$1\". available: apt-install, set-mirror, set-timezone;;
    esac
 }

-router $@
+router "${GOT_OPTS[@]}"
Author	SHA1	Message	Date
Dict Xiong	86f74b0a84	feat(scf): Open the configuration file referenced by a systemd service's ExecStart Signed-off-by: Dict Xiong <me@dxng.cn>	2026-08-26 18:01:07 +08:00
Dict Xiong	e88d6a4621	feat(zshrc): nor use nh if available Signed-off-by: Dict Xiong <me@dxng.cn>	2026-08-22 01:56:06 +08:00
Dict Xiong	913032b59d	[debug] fix: tmux 3.6 selection (#48 ) * fix(tmux): tmux 3.6 selection Signed-off-by: Dict Xiong <me@dxng.cn> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Dict Xiong <me@dxng.cn> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-20 16:37:43 +08:00
Dict Xiong	aa1df92783	[dev] feat: README.md (#47 ) feat: README.md	2026-08-17 18:33:33 +08:00
Dict Xiong	3bd0121786	[dev] GPG agent forwarding; improve riot, sagt, tmux and zsh (#46 ) * feat(riot): support literal ipv6 addresses (with or without ports given) feat(riot): -v, -4, and -6 fix(riot): do not call external binaries if possible * feat(riot): command git * build(riot-config): nasp.fit -> jump.nasp.fit * feat: add bnd and nor and completions * fix(zshrc): bnd exit when build error * fix(tmux): press ^a twice to send ^a * feat(riot): sshl supports specifying local port and unix sock * feat(riot): sshr for ssh -R * feat(riot): -o ServerAliveInterval=60 * feat(riot): conditionally RequestTTY * feat: zsh completion for beam and beaml * fix(frigg): ddns get ip * fix(riot): tmux error with window number and spaces The fix to spaces is just a workaround. Issue may still exist when command contains spaces. * feat(riot): ControlPersist=60s * fix(ci): riot * feat(tmux): prevent tmux from exiting copy mode after selection with mouse see: - https://www.reddit.com/r/tmux/comments/v73005/how_to_prevent_tmux_from_exiting_copy_mode_after/ - https://www.reddit.com/r/tmux/comments/1ltms6a/how_to_select_text_in_tmux_without_having_it_jump/ * feat(tmux): F12 to passthru * fix(riot): ControlPersist 60s -> 5s * feat: sne: search and edit * feat(ssh): add key ip17/sep * feat(tmux): press ESC to exit copy mode * feat(ssh): add key sk1/piv/9a * feat(ssh): add key sk1/fido2 * feat(ssh): add key openpgp:0x8774BF70 and remove key ip14/sep and ltp2 (asu127) * feat(sagent): sagt gpg; improve code * feat(sagent): check pinentry and give notes * feat(riot): add GPG agent forwarding Signed-off-by: Dict Xiong <me@beardic.cn> * feat: gitconf add gpg signature; remove macos from ci * feat(eid): add sk1 9a cert * feat(riot): better help and fix option quite->quiet * feat(riot): separate command options from riot options * feat(sagt): gpg-pin and associated tests * feat(riot): zsh completions * fix: Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix(riot): simplify and secure * fix: syntax --------- Signed-off-by: Dict Xiong <me@beardic.cn> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-13 20:10:55 +08:00
Dict Xiong	891bbcacff	[dev] refactor riot; `use` command; remove `log`; `sagt op` (#45 ) * feat(riot-config): default port 12022 * fix(ci) * feat(riot-config): remove tailing dot from .domain; remove j.remote and x.domain * feat(riot): .batch feat(riot): run command in tmux window(s) note that spaces in ssh commands are still not supported * feat(riot): -o RequestTTY=yes * fix(riot): SSH_OPTIONS * fix(riot): tmux use bash * feat(zshrc): use() * fix(riot): scp, and ci note that riot still has problems with spaces. we should use array to handle parameters. * fix(ci): update macos image * feat: update email * feat: revert git email * feat(ssh): update keys * feat(sagent): sagt op * fix(sagent): error note * fix(ci): test of auto-dep * feat(ssh): remove keys ltp1-bd and ltp1 * feat(riot): rm - remove host keys * build(ci): update to ubuntu-latest and Yikun/hub-mirror-action@v1.5 * feat: remove frigg-client.log * feat(riot): -t or --trust to set RIOT_TRUST_SERVER * feat(zshrc/alias): add sc and t, remove cps and mvs feat(zshrc/plugins): add man and web-search, remove ufw * feat(riot): refactor argparse feat(riot): add `--password` and `--` feat(common.sh): argparse supports `--` feat(riot): refactor ping to ping remote * feat(riot): sshd can specify the local port * feat(riot): print help when no argument or no remote * fix(riot): ci * feat(riot): better print_cmd with escape * feat(riot-config): support sed* * fix(frigg): hostname converted into lower case	2025-06-24 19:56:04 +08:00
Dict Xiong	055d44886b	[debug] vim syntax highlighting; sagt file location; dxng.net (#44 ) * feat(tmux): prefix + C-x to toggle synchronize-panes * feat(riot-cfg): nasp domain username to root * feat(vimrc): ^N to switch between nu/rnu/null * feat(zshrc): VIRTUAL_ENV_DISABLE_PROMPT set * fix(sagent): secure file location * ci: remove schedule run for gitee_sync * fix(vimrc): syntax highlighting * feat(zshrc): move time style from l to ls * fix(riot-config): ibd.ink -> dxng.net * fix: ci --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2024-09-11 01:14:13 +08:00
Dict Xiong	92aa5fa920	[dev] refactor riot; improve tmux and vim; more plugins; more aliases (#43 ) * riot: remove unknown domain warn * install.sh: --no-ssh -> --no-auth-info * doll: --restart=unless-stopped * zshrc: alias cps and mvs * riot: proxy -> ssh * zshrc: not alias rm to trash * (trial) riot devel: separate preset to config dir riot.d * riot: support extra options and extra -o options * (experimental) riot config in a single file * riot config: add nasp remote and null domain * gitconf: pull.ff = only * fix ci * riot: dynamic port forwarding * riot: only one domain func will be exec * to-install: update lemonbench * to-install: alist * [exp] riot inferred ssh: ping ping6 * sagt: fix nixos * riot config: domain 42 * ubuntu.sh: DEBIAN_FRONTEND=noninteractive * zshrc: ping -n * zshrc: alias ping -n * riot-config: jumpserver from sir0 to ssh.beardic.cn * zshrc: alias ping before checking os type * frigg: support api4.beardic.cn * fix(install.sh): crontab fails on a new server * fix(riot-conf): nasp.ob.ac.cn -> nasp.fit * fix(install.sh): install crontab (exp) * feat(test.zsh): test crontab * fix(riot): secure control master * fix(ci): riot control master * fix(riot): not mkdir if dry-run * feat(vimrc): set shiftwidth=4 * feat(ci): sync tmux-yank * feat(tmux): set-clipboard on and mouse on (experimental) * feat(zshrc): alias ping6 * build(ci): hub mirror 1.3->1.4 * fix(zshrc): tmux on msys; feat(common): better perf getting os type and linux dist * fix(common.sh): get_os_type and get_linux_dist * feat(zshrc): add plugin {magic-enter,per-directory-history,pip,podman,python,rsync,systemd,timer} * feat(zshrc): journalctl alias * feat(vimrc): tab=2 for c,cpp,nix,yaml * build(ci): checkout v3 -> v4 --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2024-05-05 12:02:55 +08:00
Dict Xiong	483f7fd7f3	[dev] nixos; riot multiple targets; install without ssh keys (#42 ) * auth: add .eid/authorized_certificates for pam pkcs11 auth * .zshrc: alias sl for sudo zsh -l * to-install: nix * zshrc: use gnu ls on mac * zshrc: try to use gnu-ls * try to fix ci for macos * riot: add domain box[0-9] * riot: shortcuts i,x,j * .zshrc: warn if not in main channel * sagt: reset agent so paths * sagt: import ssh-agent -P paths * common.sh: is_port_free and get_free_port * riot use get_free_port to fix issue on windows * riot: ssh support instant command * riot: proxy delimiter from comma (,) to slash (/) * riot: support multiple remotes, delimiter=comma (,) * riot: fix ci; install.sh: --no-ssh * riot: improve ci --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-11-06 19:13:22 +08:00
Dict Xiong	5fb7ff0833	[debug] support nixos; fix ci (#41 ) * support for nixos * fix ci	2023-07-26 21:18:24 +08:00
Dict Xiong	39b8dfce82	[debug/dev] loosen riot username check; autoload zcalc (#40 ) * riot: loosen username check as sometimes it's not a unix username * Revert "riot: loosen username check as sometimes it's not a unix username" This reverts commit `bdb64ce1f2`. * riot: loosen username check as sometimes it's not a unix username * zshrc: autoload zcalc --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-07-03 16:52:06 +08:00
Dict Xiong	1a62ffe74b	[debug+dev] riot checks and fix ipv6 support, fix crontab installation; antigen use F-Sy-H (#39 ) * format: remove space * sry but..., riot: 'i' for 'ibd', and remove support for ebd * fix ipv6 support * validate port and username * install.sh: failed to add to crontab when there's no crontab * sync zdharma-continuum/fast-syntax-highlighting * use fast-syntax-highlighting instead --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-06-20 15:10:59 +08:00
Dict Xiong	2cc2ab48b8	[dev] enhance riot; ddns avoid burst (#38 ) * riot: add . for .ibd and non for proxied * riot: 'user@..' to overwrite username, '...:22' to overwrite port, treat the arg as server name if it doesn't match any preset, sshl can accept only a port number and default to use localhost * update.sh: ddns sleep for random seconds to avoid burst * riot: support zssh and sftp, and set ssh options according to trust settings * riot: add scp * riot: support jump servers, sep by commas * common.sh: argparser supports -d/--dev and -D/--dry-run * install.sh: remove -s/--secure because of no use * riot: if remote ends with dot, treat it as a full-hostname; add tests * sagent.sh: refuse to work on windows --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-05-30 13:43:25 +08:00
Dict Xiong	37bf1fa1f0	[keys] remove pc{0,1}/old,sk0/fido,ph0/sep, update pc1/windows (#37 ) keys: remove pc{0,1}/old,sk0/fido,ph0/sep, update pc1/windows	2023-04-29 17:46:01 +08:00
Dict Xiong	8fdd3c477f	[dev] ddns; better ssh agent; riot sshl; sys.online; zsh hist import; DFS_DEBUG; cbd/cbds (#36 ) * riot: bj1 -> proxy * ci: test ask_for_yn * --wip-- [skip ci] * install.sh: will prompt version * zshrc: piv-agent now can re-use agents * zshrc: in docker use theme robbyrussell * update.sh: will send online beacon * beacon: support meta with limited len 64 * bug fix (Sat Jan 21 16:45:35 CST 2023) * well, finally add ssh key for ltp1-bd * set DFS_INITED and do not send login beacon if it was set * rewrite piv-agent to sagent; fmt_note and fmt_into will write to stderr * bug fix (Mon Jan 30 19:41:00 CST 2023) * bug fix (Mon Jan 30 19:46:27 CST 2023) * login beacon add details * $DFS_ORPHAN turns logger off * disable more beacons in CI * install.sh: prepare config earlier * init pbin * install.sh: -H\|--hist\|--history * install.sh: -H hint * install.sh: -H support multiple keys * fix zsh hist with no new line at the end * remove ^M in hist * bug fix (Wed Feb 1 21:11:41 CST 2023) * bug fix (Wed Feb 1 21:16:29 CST 2023) * bug fix (Wed Feb 1 21:20:21 CST 2023) * ci will send gh.ci.fail * show install opts * DFS_DEBUG to set -x * bug fix: install.sh re-start itself with no args incorrectly * bug fix (Thu Feb 2 18:43:16 CST 2023) * riot: ob->ebd, swap option $1 and $2 and $2 is default to ssh * riot: introduce sshl * logger.sh: support ddns * bug fix (Wed Mar 1 16:37:42 CST 2023) * dfs.ddns.failed -> dfs.ddns.fail * login beacon 2>/dev/null * logger.sh -> frigg-client.sh; curl add time limit 10s * to-install.sh: improve docker-ce * use $DFS_CURL_OPTIONS * ci: add ddns * bug fix (Wed Mar 15 19:37:21 CST 2023) * Revert "bug fix (Wed Mar 15 19:37:21 CST 2023)" This reverts commit `2df87ce1a8`. * Revert "ci: add ddns" This reverts commit `4fe8321504`. * alias cbd and cbds, riot nasp port to 12022 * .zshrc: sagent -> sagt * fix ci * riot: bug fix when 'tmp' has leading zeros * add ci for cbds --------- Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-04-21 12:37:05 +08:00
Dict Xiong	9a4c9556f6	[dev] common.sh parses args; riot; getdfs; install.sh -x KEY=VAL (#35 ) * common.sh: export vars in env; zshrc: gdebug * fix error when locale not exists * DFS_COLOR * common.sh: parse args automatically * ci: test common.sh getopts * common.sh: argparser supports spaces * ciot: init * ciot -> diot; remove sibd, sob and snasp * rename diot -> riot * update home0 ssh pubkey; fix ci temperarily * gdebug will record time * gdebug supports empty; --dry-run wip * get.dotfiles.cn * bug fix (Thu Jan 5 20:53:58 CST 2023) * fix ci * fix ci * install.sh: -d will set -x * ci: -asl * getdfs: install for another user using -u <uname> * try fix when su doesnot exist * bug fix (Thu Jan 5 22:58:40 CST 2023) * bug fix (Thu Jan 5 22:59:33 CST 2023) * introduce SUDOE and so debug * ask_for_yn now use stdout to return * getdfs: support multiple users * install.sh: -x to set dfs config; ci * fix ci * bug fix (Fri Jan 6 15:11:24 CST 2023) * auto-detect DFS_NO_WALL * bug fix (Fri Jan 6 15:43:25 CST 2023) * getdfs: ${repo} * bug fix (Fri Jan 6 16:08:41 CST 2023) * getdfs: prompt user Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2023-01-06 16:14:41 +08:00
Dict Xiong	952bfabea4	zshrc: fix locale (#34 ) * common.sh: export vars in env; zshrc: gdebug * fix error when locale not exists * fix ci Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-12-10 19:11:05 +08:00
Dict Xiong	c3e0c28b64	[install.sh] hotfix (#33 ) hotfix Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-12-03 21:27:22 +08:00
Dict Xiong	ff8ac21424	[dev] refactor log.py -> logger.sh (#32 ) * update.sh: fetch will prune * log: use hostname directly * refactor log.py to logger.sh (#31) * logger.sh: refactor log.py to bash script * update.sh use beacon; ci test beacon * install.sh: install dep first * install.sh: DFS_UPDATED_RET=85 * more beacon; use stderr * remove py3 dep * install.sh: remove py3 * install.sh: -s\|--secure * async log; beacon add sys.login * update use sync beacon * fix ci minor bug; macos: uuidgen/e2fsprogs * logger.sh: not need to use uuid5 * bug fix * dfs err_return * common.sh: post_log and post_beacon will check #args * bug fix * zshrc: fix locale when C.UTF-8 not exists * WIP: combine install -a and tools/ scripts * finish combination; get_os_name; macos.sh * test.ci: now all use -a to install deps * bug fix * bug fix; ci: install.sh run with -x * install.sh: bug fix that re-run install.sh after updated needs orgin args * format Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-12-03 20:37:20 +08:00
Dict Xiong	56e2b217eb	[dev] dfs config; trash (#30 ) * install.sh: fix install dep * update.sh: alternative channel 'dev' * zshrc: dfs config * lint: remove endline \ * if trash, disable rm * update.sh: fallback to main if dev not exists * bug fix * to-install.sh; v2ray -> v2fly * gitconfig: quotepath=false * git log using iso date; dfs vversion	2022-11-24 20:51:35 +08:00
Dict Xiong	f39193f28f	[core] parse func; gbes; .config/dotfiles/env (#29 ) * common.sh: arg parse init * bug fix * bug fix * bug fix. now common.sh won't parse arg autoly * improve git-branches * improve git-branches; util-linux * accelerate ci * improve gbes; PARSE_ARG_RET * ci: fix gbes * ssh: add key ltp1.bd * Revert "ssh: add key ltp1.bd" This reverts commit `c2433a0549`. * install column; apt -> apt-get Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-11-17 20:02:35 +08:00
Dict Xiong	c354f980bb	WIP: piv fix (#28 ) * piv logi fix * dogo: $DFS * snasp; doll: $2 for the name * DFS_UPDATE_CHANNEL? * git-branches * ci: git-branches Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-11-15 22:18:16 +08:00
Dict Xiong	3ce5a7ade8	zshrc: key bindings and piv-agent (#27 ) * piv-agent; macos key bindings; doll fix * ci: piv-agent	2022-11-15 01:28:38 +08:00
Dict Xiong	6e33fc0875	scripts: docker scripts (#26 ) * dogo/doll dogo supports zsh/bash/sh; doll is introduced to launch a new docker container; update $SUDO in command.sh * update ci * fix regex * dogo: enhance, support -[0-9]* * dogo&doll: enhanced * zshrc: sibd and sob	2022-11-14 01:37:48 +08:00
Dict Xiong	995899f3a3	install.sh: rerun when updated (#25 ) * install.sh: rerun when updated * update ci	2022-11-12 20:05:29 +08:00
Dict Xiong	9a7f0b1b06	install.sh: support combined options (#24 ) * install.sh: support combined short options * ci: use combined opt * debug Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-11-11 10:36:50 +08:00
Dict Xiong	300b3a29b7	install.sh: cmake, less, and -l=DFS_LITE (#23 ) * install.sh: cmake and less * install.sh: -l=DFS_LITE * ci: support -l=DFS_LITE Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-11-09 23:19:55 +08:00
Dict Xiong	6dce3cfa18	install.sh: autodep, improve note (#22 ) * install.sh: --auto * ci: test --auto * ci: remove dep when test --auto * debug * ok. improve the install notes	2022-11-08 22:58:17 +08:00
Dict Xiong	5b00add073	[core] update (#21 ) * vim quiet install * do not set LESS * gitconfig and envs	2022-11-06 14:00:25 +08:00
Dict Xiong	b191403798	ssh: add ip14 (#20 )	2022-11-06 02:29:52 +08:00
Dict Xiong	b6ff4116c8	[refactor] clean, readable (#19 ) * rebase zshrc, introduce DFS_NO_WALL * improve ci * improve ci * improve ci * update antigen url for DFS_NO_WALL * OK * improve ci for macos * improve test.zsh * staged * fix ci * fix ci * use local vars * introduce DFS_QUIET * mass mod install.sh * minor change * set DFS_DEV=1 to prevent update * debug: done -> fi * fix DFS_DEV * ubuntu.sh: set-mirror (ref: tuna) * preinstall_check * install.sh: -q to be quiet * install.sh: -d to DFS_DEV Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>	2022-11-05 19:45:21 +08:00
Dict Xiong	0739410aef	git: push.autoSetupRemote=true (#18 )	2022-10-28 12:59:12 +08:00
Dict Xiong	9778c69d78	degrade log 403 to warning (#17 )	2022-10-27 22:57:53 +08:00
Dict Xiong	83695d48fb	fix update & docker notify (#16 ) * update.sh improve * docker notify	2022-10-27 01:16:45 +08:00
Dict Xiong	5bd6d9f822	vim: backspace fix (#15 ) vim backspace fix	2022-09-01 23:22:18 +08:00
Dict Xiong	3421d27be9	ci: hotfix (#14 ) hotfix	2022-08-28 21:07:10 +08:00
Dict Xiong	18dfca5f39	ci: better structure (#13 ) * struct ci; staged * seems good * ci try macos * debug * debug * debug * debug * debug * debug * debug * debug * debug * debug	2022-08-28 20:51:44 +08:00
Dict Xiong	fa737d482f	ci: init ci (#12 ) * test.yml init * debug * debug * debug * debug * debug * debug * debug * debug	2022-08-27 01:42:15 +08:00
Dict Xiong	8782121dcc	struct: standard file structure (#11 ) * mass change. staged, not tested * still mass changed without test * bug fix * bug fix	2022-08-26 20:43:00 +08:00
Dict Xiong	f313a6887e	zshrc: ls multisystem fix (#10 ) 1. alias l according to the local os type 2. ci sync triggered by all branches	2022-08-25 00:23:29 +08:00
Dict Xiong	7804f196b4	ci: sync fzf (#9 ) * ci: sync fzf * tools/install.sh update fzf	2022-08-20 14:24:52 +08:00
Dict Xiong	c834980b29	Dev (#8 ) * use update.sh to update safely * add unknown command "version". available: update, force-update, reset, cd and replace tabs with spaces * bug fix * bug fix * uninstall will rm update.sh * new force-update * bug fix * remove thefuck just use `pls` * init post-log.py * update uuid filepath * update.sh will post log * dfs log * bug fix * bug fix * use logging * logging format * bug fix * standarlize the config path * bug fix * add ssh key: ltp2	2022-08-14 20:34:18 +08:00