feat(sagent): check pinentry and give notes

see:
- https://www.reddit.com/r/tmux/comments/v73005/how_to_prevent_tmux_from_exiting_copy_mode_after/
- https://www.reddit.com/r/tmux/comments/1ltms6a/how_to_select_text_in_tmux_without_having_it_jump/

.eid/authorized_certificates

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFIDCCAwigAwIBAgIUK1zXH5UosBim7i+kIZyPGpowU9cwDQYJKoZIhvcNAQEL
+BQAwgZUxCzAJBgNVBAYTAkNOMRAwDgYDVQQIDAdCRUlKSU5HMRAwDgYDVQQHDAdC
+RUlKSU5HMRIwEAYDVQQKDAlEaWN0IFRlY2gxEDAOBgNVBAsMB1Jvb3QgQ0ExHjAc
+BgNVBAMMFURpY3QgVGVjaCBSb290IENBIC0gMDEcMBoGCSqGSIb3DQEJARYNbWVA
+YmVhcmRpYy5jbjAeFw0yMjA3MjIxNzU5MjNaFw0yNTA3MjExNzU5MjNaMEkxEjAQ
+BgNVBAoMCURpY3QgVGVjaDEQMA4GA1UECAwHQkVJSklORzELMAkGA1UEBhMCQ04x
+FDASBgNVBAMMC3NrMC5pYmQuaW5rMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAlDeyFxeJ5RXFX4B3rIIpNyyAIl5VTGCT5t8g9dxFWq0MeY6nQYJPA8IJ
+IH+KzzujBabyKYpzshDvMzkuhx0Kwi2VL+ckxWg5FLge3kNBJqYnBm5pPWx6o9R5
+DmcWqG5KRH0FJhSmL5KeBHsVcOurDtKn174x2eB+sggCSyuWlJyn4KxPLTg8z/Nr
+FP5qSY1vj6t7mpzau+eIGh8IcQiFxteN/86fKswQHint/MVaqg6vX05BuIb8xb5E
+XUvPIupdc/vtD959BxnTo7UoOz+3zu/u2cj2K9IDubwe9tDpv88aj6xnfXInFouD
+/mlSmvtLo1h/6arn1hurgoylh5wbOwIDAQABo4GyMIGvMAkGA1UdEwQCMAAwCwYD
+VR0PBAQDAgTwMB0GA1UdDgQWBBR9DxLqtR0+zUWoPyFoDRrnyJyDBTAfBgNVHSME
+GDAWgBRsprmVI/Tjey+sw4qoZpLd7PT0gTBVBgNVHSUETjBMBggrBgEFBQcDAgYI
+KwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYKKwYBBAGCN0MBAQYKKwYBBAGC
+N0MBAgYKKwYBBAGCNxQCAjANBgkqhkiG9w0BAQsFAAOCAgEA7BJXiRg32shmZWyY
+gPjq52ffN9RDNe58KadajJ1PnVP1yNJySgsOG3eSxONQX3ITr36Ihsfb3fZneBfX
+/IcXgjyvy1CDcvBBAyee91hdR8orMCePqMpeOSNP9CUp9Ctd4V+an0DE8Z1yrezA
+ieaYgBZCDxuZdloYSmj9Z/Rqn2dy4dcUAxKrEwW/6VPqQNrJETTtadS1SF0EsDxV
+XZpDqNYaS/N7/ciSm7TaQJud62A4m+FWWHNnttTp9IjLESr3U80+qtRY8yDNpulb
+/eNL8KK9aORiFUz9789l6M62HPi6vCsMflI0iHUeoi69GKX8mKf0WFR1KxoDsJiN
+DG9/1gCfj6whFCrT6fJTKAGl8Hp5toWMOeDprbsE5gf4Ik3p+sKMV9t43zNm3gvA
+1zNPtgQUffPU0kONlavIxUNfCmD8qVwK5ECT7wh0hrB8fRYfxTZHgN6Yvu7M9HNz
+SNt5JZCLBT4nLt0uQp9O/xctdHElZw+/W8OfnP5vxnPdccIeVOxpGIyzErwjD0+E
+9mNiqOa5JV9OMAJ+0I9cbOnuMaXm4mvHZadnetUzq2ZUw1Jba7z62zIJTciNRq9i
+ZJc6v5e+iqbE1ECZLco5LjWqqfvFfYCrkqeOhCRsRkVPsXnGPo2QDDYdTm4EGCmg
+dVZ6R452SZsrE4V+3LR011BxzEg=
+-----END CERTIFICATE-----

.gitconfig2

@@ -9,6 +9,8 @@
     quotepath = false  # chinese chars
 [push]
     autoSetupRemote = true
+[pull]
+    ff = only
 [branch]
     # Show most recently changed branches first.
     sort = -committerdate

.github/workflows/gitee_sync.yml

@@ -1,24 +1,22 @@
 name: sync repos to gitee
 on:
   push: ~
-  schedule:
-    - cron: 10 4 * * *
   workflow_dispatch: ~
 jobs:
   dotfiles:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: DictXiong/dotfiles  # 名字随便起
+    - name: DictXiong/dotfiles
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/DictXiong  # 源端账户名(github)
+        src: github/DictXiong
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: user
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "dotfiles"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "dotfiles"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'

.github/workflows/gitee_sync_dependencies.yml

@@ -5,121 +5,138 @@ on:
   workflow_dispatch: ~
 jobs:
   ohmyzsh:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: ohmyzsh repo  # 名字随便起
+    - name: ohmyzsh repo
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/ohmyzsh  # 源端账户名(github)
+        src: github/ohmyzsh
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: org
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"  # https/ssh
-        debug: true  # 启用后会显示所有执行命令
+        debug: true  # print all commands
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "ohmyzsh"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "ohmyzsh"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
   zsh-users:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: zsh-users repos  # 名字随便起
+    - name: zsh-users repos
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/zsh-users  # 源端账户名(github)
+        src: github/zsh-users
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: org
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "antigen,zsh-syntax-highlighting,zsh-autosuggestions,zsh-completions"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "antigen,zsh-syntax-highlighting,zsh-autosuggestions,zsh-completions"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
+  zdharma-continuum:
+    runs-on: ubuntu-latest
+    steps:
+    - name: zdharma-continuum repos
+      uses: Yikun/hub-mirror-action@v1.5
+      with:
+        src: github/zdharma-continuum
+        dst: gitee/dictxiong
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
+        src_account_type: org
+        dst_account_type: user
+        clone_style: "https"
+        debug: true
+        force_update: true
+        static_list: "fast-syntax-highlighting"
+        timeout: '600s'
   tmux-mem-cpu-load:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: thewtex/tmux-mem-cpu-load  # 名字随便起
+    - name: thewtex/tmux-mem-cpu-load
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/thewtex  # 源端账户名(github)
+        src: github/thewtex
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: user
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "tmux-mem-cpu-load"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "tmux-mem-cpu-load"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
   tmux-plugins:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: tmux-plugins # 名字随便起
+    - name: tmux-plugins
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/tmux-plugins  # 源端账户名(github)
+        src: github/tmux-plugins
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: org
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "tpm,tmux-resurrect"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "tpm,tmux-resurrect,tmux-yank"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
   vundle-vim:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: VundleVim/Vundle-vim # 名字随便起
+    - name: VundleVim/Vundle-vim
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/VundleVim  # 源端账户名(github)
+        src: github/VundleVim
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: org
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "Vundle.vim"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "Vundle.vim"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
   onedark-vim:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: joshdick/onedark-vim # 名字随便起
+    - name: joshdick/onedark-vim
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/joshdick  # 源端账户名(github)
+        src: github/joshdick
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: user
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "onedark.vim"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "onedark.vim"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'
   fzf:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-    - name: junegunn/fzf # 名字随便起
+    - name: junegunn/fzf
-      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      uses: Yikun/hub-mirror-action@v1.5
       with:
-        src: github/junegunn  # 源端账户名(github)
+        src: github/junegunn
-        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst: gitee/dictxiong
-        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}
-        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        dst_token:  ${{ secrets.GITEE_TOKEN }}
         src_account_type: user
-        dst_account_type: user  # 账户类型
+        dst_account_type: user
-        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        clone_style: "https"
-        debug: true  # 启用后会显示所有执行命令
+        debug: true
-        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        force_update: true
-        static_list: "fzf"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        static_list: "fzf"
-        timeout: '600s'  # git超时设置，超时后会自动重试git操作
+        timeout: '600s'

.github/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       
@@ -46,10 +46,10 @@ jobs:
   
   test-macos:
     name: test on macos
-    runs-on: macos-12
+    runs-on: macos-latest
     steps:
       - name: checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -91,10 +91,10 @@ jobs:
     steps:
       - name: remove dependencies
         run: |
-          sudo apt-get -y remove curl vim python3
+          sudo apt-get -y remove curl vim
 
       - name: checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -116,7 +116,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

.ssh/authorized_keys2

@@ -2,27 +2,22 @@
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGakUcSuNhuH7tk+Nj9gDfRtxYfGPL9yb8toQ/EpSJAM openpgp:0xD9271B01
 
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJ4FeeBwPcUe25JsZQ7xDmGtFVeO1TQ9332IPjFY0Xm openpgp:0x8774BF70
+
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0/piv/9a
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV/6cLUGA5YWVI6uPhIBOBZvlNBlZLkehHQN0Gxnc+B ltp0/ubuntu
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAkkF0Qc1YhhgmgZcujjfyn3liCxAAJSGlEme0eD6s908zm95mGd64fQJSoYVaFt5y9wrQLdWX16c+gvRyNaQdPfs5jxaP+G8Vr6PkkE79hwauEOQOTbr+q3bQJmfLe56cMV7oHrKVFffkJQTvp1mcK4+CYytsxJP5v0m5TDyv4op6VcZ2m0gdrFEBV3DMMgsqF6/tSPkqbTTj9fMMSOFzXPq7qEQWgYmxT+M0iQdgEiG7Z+INkofM56tBmQ7jSeO65/FTytB6ZMiI23NGmTmYvHPyxSDWXL0X7tX42S0/A7QhxZHN0GUD0NGaSExLfgTawRLhARVHbUXC9iu5aCAr sk1/piv/9a
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILqRfdez8IAOf6m9Ysi3uSNKEG0Xi6GPuhA6R2fci2yB ltp0/windows
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA71ukY9nzzeAGp9WYstPYiIwexzIANlPwMQ68QNQwqxAAAABHNzaDo= sk1/fido2
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFO4k0tJ+Bfu95Uavg/5P3EXMKNcq+bMqaTqzkvRZ7ji ltp1/ubuntu
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMyZILj+GxTUhdCgz2w1TxQ+aTcggnOJIb84qA4u271S ltp0
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8g34WHLEix6Qt0J/ClYbZeb9wh+p1IOcZkz/vNbZrv ltp1/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBN24pvN1RMN+iSZyHPdyExA1Rvt8pdr3e6ih6iX+KrQ ltp2
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLYgVj+NPino6sOmahULN7SbAMaVAgzqPfDjz2S8zDv pc1
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0/windows
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLYgVj+NPino6sOmahULN7SbAMaVAgzqPfDjz2S8zDv pc1/windows
-
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNvHya5i3GNniGww9Yx5ikos4Z5jevu8zz8hCQi05++SgejFPnbw9UjbHFjODK2M+ZHuhRF5mdf996r4/BxWyP8= pad0/sep
-
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC5gu+U4picxVvCNYjLlmxGLpJl7svj3LklO7jSpwqdrNxlE+/xkx07PJx76AbA77dDM1Dxmm/VOvVQCKTRLTgk= ip14/sep
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF52mPmbLEriZ+DfmrMHFtvg2kiO2JpRpitvs7PbJowh home0
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhS4voo3K/Dvzqckr0bouO1WkCI5XxswstHWnuuyKBz ltp1-bd
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNvHya5i3GNniGww9Yx5ikos4Z5jevu8zz8hCQi05++SgejFPnbw9UjbHFjODK2M+ZHuhRF5mdf996r4/BxWyP8= pad0/sep
 
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMXu7UND6N1EKcbeSeAj2CwzGA3sM5/bRtLwoY0euWdR4vzB0nwcwd6nct5JCEyozjujJfMt8d7oCzhSt1w/1cU= ip17/sep

.tmux.conf2

@@ -1,5 +1,7 @@
 set -g prefix ^a
-set -g mouse off
+bind ^a send-prefix
+set -g mouse on
+set -g set-clipboard on
 set -g default-terminal "xterm-256color"
 set -g history-limit 10000
 
@@ -23,8 +25,19 @@ bind - split-window -v -c "#{pane_current_path}"
 bind | split-window -h -c "#{pane_current_path}"
 
 # other key bindings
+## prefix r: reload conf
 bind r source-file ~/.tmux.conf \; display-message "tmux.conf reloaded"
+## prefix m: toggle mouse mode
 bind m run 'old=$(tmux show -gv mouse); new="off"; if [ "$old" = "off" ]; then new="on"; fi; tmux set -g mouse $new && tmux display-message toggle\ mouse\ mode\ $new'
+## prefix C-x: pane sync
+bind C-x set-window-option synchronize-panes\; display-message "synchronize-panes is now #{?pane_synchronized,on,off}"
+## prevent jumping to end after mouse selection
+bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-selection -x
+## F12: passthru
+bind -T root F12 set prefix None \; set key-table off \; set status-bg red \; refresh-client -S
+bind -T off F12 set -u prefix \; set -u key-table \; set -u status-bg \; refresh-client -S
+## ESC: exit copy mode
+bind -T copy-mode-vi Escape send-keys -X cancel
 
 # styles
 # status bar
@@ -50,4 +63,4 @@ set -g window-style fg=colour248
 set -g window-active-style fg=white
 
 # better mouse scrolling. see: https://superuser.com/questions/1622812/mouse-scrolling-in-mobaxterm-tmux
-set -g terminal-overrides 'xterm*:smcup@:rmcup@'
+set -g terminal-overrides 'xterm*:smcup@:rmcup@'

.update.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 THIS_FILE=$(basename "${BASH_SOURCE}")
@@ -39,8 +39,7 @@ case $DFS_UPDATE_CHANNEL in
 esac
 if [[ ${#DFS_COMMIT} != 40 ]]; then
     fmt_error "invalid commit id"
-    apost_beacon "dfs.invalid-commit"
+    apost_beacon "dfs.invalid-commit" "invalid commit id: ${DFS_COMMIT}"
-    apost_log "ERROR" "$THIS_FILE" "invalid commit id: ${DFS_COMMIT}"
     exit
 fi
 

.vimrc2

@@ -10,12 +10,13 @@ filetype plugin indent on
 " end vundle
 colorscheme onedark
 
+syntax on
 set cursorline
-set syntax=on
 set autoindent
 set smartindent
-set tabstop=4
 set expandtab "spaces instead of tabs
+set tabstop=4 softtabstop=4 shiftwidth=4
+autocmd FileType c,cpp,nix,yaml setlocal tabstop=2 softtabstop=2 shiftwidth=2
 set backspace=indent,eol,start
 set number "line numbers
 set history=1000
@@ -31,6 +32,7 @@ hi User3 ctermfg=15 ctermbg=2
 au InsertEnter * hi User3 ctermfg=15 ctermbg=5 
 au InsertLeave * hi User3 ctermfg=15 ctermbg=2
 set statusline=%3*\ %{mode()}\ %*[%n][%F](%{\"\".(&fenc==\"\"?&enc:&fenc).((exists(\"+bomb\")\ &&\ &bomb)?\"+\":\"\").\"\"},%{&ff},%Y)%2*%r%1*%m%*%<%=\'0x%B\'\ [Line:%l/%L,Col:%c][%p%%]
+nnoremap <silent> <C-n> :let [&nu, &rnu] = [!&rnu, &nu+&rnu==1]<cr>
 
 " When editing a file, always jump to the last known cursor position.
 " Don't do it when the position is invalid, when inside an event handler

.zshrc2

@@ -9,20 +9,23 @@ else
 fi
 export DOTFILES=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 export PATH="$PATH:$DOTFILES/scripts"
+fpath=($DOTFILES/functions $fpath)
 export EDITOR='vim'
 # env for apps
 export PYTHONIOENCODING='UTF-8'
 export GPG_TTY=$(tty)
 export LESS_TERMCAP_md=$'\E[01;33m'
+export VIRTUAL_ENV_DISABLE_PROMPT=1
 # env for dfs
 if [[ -f ~/.config/dotfiles/env ]]; then set -a; source ~/.config/dotfiles/env; set +a; fi
+export DFS_OS_TYPE="$("$DOTFILES/tools/common.sh" get_os_type)"
 
 # antigen
 if [[ "$DFS_NO_WALL" == "1" ]]; then
     ANTIGEN_URL="https://raw.githubusercontent.com/zsh-users/antigen/develop/bin/antigen.zsh"
     ANTIGEN_OMZ_REPO_URL="https://github.com/ohmyzsh/ohmyzsh.git"
     ANTIGEN_PLUGINS=(
-        "https://github.com/zsh-users/zsh-syntax-highlighting"
+        "https://github.com/zdharma-continuum/fast-syntax-highlighting"
         "https://github.com/zsh-users/zsh-completions"
         "https://github.com/zsh-users/zsh-autosuggestions"
     )
@@ -30,7 +33,7 @@ else
     ANTIGEN_URL="https://gitee.com/dictxiong/antigen/raw/develop/bin/antigen.zsh"
     ANTIGEN_OMZ_REPO_URL="https://gitee.com/dictxiong/ohmyzsh.git"
     ANTIGEN_PLUGINS=(
-        "https://gitee.com/dictxiong/zsh-syntax-highlighting"
+        "https://gitee.com/dictxiong/fast-syntax-highlighting"
         "https://gitee.com/dictxiong/zsh-completions"
         "https://gitee.com/dictxiong/zsh-autosuggestions"
     )
@@ -66,9 +69,18 @@ ANTIGEN_PLUGINS+=(
     "extract"
     "fzf"
     "git"
+    "magic-enter"
+    "man"
+    "per-directory-history"
+    "pip"
+    "podman"
+    "python"
     "ripgrep"
+    "rsync"
+    "systemd"
+    "timer"
     "tmux"
-    "ufw"
+    "web-search"
     "z"
 )
 for i in ${ANTIGEN_PLUGINS[*]}; do
@@ -101,21 +113,51 @@ fi
 # alias
 alias "pls"='sudo $(fc -ln -1)'
 alias "se"='sudo -sE'
+alias "sl"='sudo zsh -l'
+if [[ "$DFS_OS_TYPE" == "linux" ]]; then alias "ping"='ping -n'; alias "ping6"='ping6 -n'; fi
+if [[ "$DFS_OS_TYPE" == "msys" ]]; then alias "tmux"='script -qO /dev/null -c "tmux -u"'; fi
 alias "pbd"='ping baidu.com'
 alias "p114"='ping 114.114.114.114'
-alias "p666"='ping6 2001:da8::666'
+alias "p666"='ping6 240c::6666'
 alias "cbd"='curl http://www.baidu.com'
 alias "cbds"='curl https://www.baidu.com'
 alias "gdebug"='git add -A; git commit --allow-empty -m "bug fix ($(date))"'
-case $(bash "$DOTFILES/tools/common.sh" get_os_type) in
+alias "ls"='ls --color=tty --time-style="+%y-%m-%d %H:%M"'
-    macos  ) alias l='ls -lAGh -D "%y-%m-%d %H:%M"' ;;
+alias "l"='ls -lAGh'
-    *      ) alias l='ls -lAGh --time-style="+%y-%m-%d %H:%M"' ;;
+alias "jc"='journalctl'
-esac
+alias "jce"='jc -e'
-if [[ -x $(command -v trash) ]]; then
+alias "jceu"='jc -eu'
-    alias "rm"="echo use the full path i.e. '/bin/rm'\; consider using trash"
+alias "jcf"='jc -f'
-fi
+alias "jcfu"='jc -fu'
-gbes() { git for-each-ref --sort=-committerdate refs/heads refs/remotes --format="%(authordate:format:%y-%m-%d.%a %H:%M %z)|%(color:red)%(objectname:short)|%(color:yellow)%(refname:short)%(color:reset)|%(color:reset)%(authorname): %(color:green)%(subject)" --color=always | column -ts"|" | less -FX }
+alias "sc"='systemctl'
-sagt() { eval "$($DOTFILES/tools/sagent.sh $@)" }
+alias "t"='tmux'
+gbes() { git for-each-ref --sort=-committerdate refs/heads refs/remotes --format="%(authordate:format:%y-%m-%d.%a %H:%M %z)|%(color:red)%(objectname:short)|%(color:yellow)%(refname:short)%(color:reset)|%(color:reset)%(authorname): %(color:green)%(subject)" --color=always | column -ts"|" | less -FX ; }
+sagt() {
+    local output
+    output="$("$DOTFILES/tools/sagent.sh" "$@")" || return $?
+    eval "$output"
+}
+## nixos
+use() { nix --experimental-features nix-command --extra-experimental-features flakes shell "${(*)@/#%(#b)([^#]#)/nixpkgs#$match}" ; }
+bnd() {
+    if [[ -n "$1" && -d "./hosts/$1" ]]; then
+        nixos-rebuild --flake .#$1 build || return $?
+        nix-diff /opt/NixOS-Config/results/hosts/$1 ./result --color=always | less
+    else
+        echo host $1 does not exist
+    fi
+}
+nor() {
+    test -n "$1" || { echo fatal: no verb given; return 1; }
+    nixos-rebuild "$1" --flake .${2:+#}$2
+}
+alias 'nors'='nor switch'
+alias 'norbt'='nor boot'
+alias 'nort'='nor test'
+alias 'norb'='nor build'
+alias 'nordb'='nor dry-build'
+alias 'norda'='nor dry-activate'
+
 
 # key bindings
 bindkey "^b" beginning-of-line  # ctrl+b
@@ -140,6 +182,9 @@ bindkey "\e[1;5D" backward-word  # alt+left_arrow; termius
 
 bindkey "\ed" delete-char  # alt+d
 
+# mods
+autoload zcalc
+
 # dfs
 dfs()
 {
@@ -168,12 +213,16 @@ dfs()
             "$DOTFILES/install.sh" -i
             echo 'Done. Please open a new shell to see the changes.'
             ;;
-        log    ) "$DOTFILES/tools/common.sh" "post_log" "INFO" "dfs" "$2" ;;
         beacon ) "$DOTFILES/tools/common.sh" "post_beacon" "$2" "$3" ;;
         *      ) echo "unknown command \"$1\". available: update, force-update, version, reset, cd, log" ;;
     esac
 }
 
+# motd
+if [[ "$DFS_INITED" != "1" && -n "$DFS_UPDATE_CHANNEL" && "$DFS_UPDATE_CHANNEL" != "main" ]]; then
+    echo dotfiles not in the main channel. use with caution.
+fi
+
 # clean
 unset i
 export DFS_INITED=1

functions/_beam

@@ -0,0 +1,99 @@
+#compdef beam
+
+# =============================================================================
+# Beam-Go Zsh Completion Script
+# =============================================================================
+
+_beam() {
+    local context state state_descr line
+    typeset -A opt_args
+
+    _arguments -C \
+        '1: :_beam_commands' \
+        '*:: :->args'
+
+    case $state in
+        (args)
+            case $line[1] in
+                (serve) _beam_serve ;;
+                (add)   _beam_add ;;
+                (list)  _beam_list ;;
+                (del)   _beam_del ;;
+            esac
+            ;;
+    esac
+}
+
+# --- Subcommand Definitions ---
+
+(( $+functions[_beam_commands] )) ||
+_beam_commands() {
+    local -a commands
+    commands=(
+        'serve:Start the beam server daemon'
+        'add:Share a file or directory'
+        'list:List active shares'
+        'del:Delete a share by path or code'
+    )
+    _describe -t commands 'beam command' commands
+}
+
+_beam_serve() {
+    _arguments \
+        '(-d --database)'{-d,--database}'=[Database directory (Required)]:directory:_path_files -/' \
+        '(-p --port)'{-p,--port}'=[Port to listen on (default :8280)]:port:' \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '--subpath=[Enable subpath sharing]'
+}
+
+_beam_add() {
+    _arguments \
+        '(-d --days)'{-d,--days}'=[Expiration days (default 7)]:days:' \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '1:file to share:_files'
+}
+
+_beam_list() {
+    _arguments \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files'
+}
+
+_beam_del() {
+    _arguments \
+        '(-s --socket)'{-s,--socket}'=[Socket path]:socket path:_files' \
+        '(-c --code)'{-c,--code}'=[Share code]:share code:_beam_active_codes' \
+        '1:shared path:_files'
+}
+
+# --- Helpers ---
+
+# 动态获取当前的 Share Code
+# 它会尝试读取用户当前输入的 -s 参数，去连接正确的 socket
+_beam_active_codes() {
+    local socket_path=""
+
+    # 从 Zsh 解析的参数中提取 socket 路径
+    if [[ -n ${opt_args[-s]} ]]; then
+        socket_path=${opt_args[-s]}
+    elif [[ -n ${opt_args[--socket]} ]]; then
+        socket_path=${opt_args[--socket]}
+    fi
+
+    # 构造查询命令
+    local cmd_args=()
+    cmd_args+=("list")
+    [[ -n $socket_path ]] && cmd_args+=("-s" "$socket_path")
+
+    # 调用 beam list，跳过前两行表头，提取 Code($1) 和 Path($3)
+    # 2>/dev/null 防止服务未启动时报错打印到终端
+    local -a shares
+    shares=("${(@f)$(beam "${cmd_args[@]}" 2>/dev/null | awk 'NR>2 {print $1":"$2" "$3" "$4}')}")
+
+    if [[ ${#shares} -gt 0 ]]; then
+        _describe -t shares 'active share' shares
+    else
+        _message 'no active shares or server not running'
+    fi
+}
+
+_beam "$@"

functions/_beaml

@@ -0,0 +1,35 @@
+#compdef beaml
+
+_beaml() {
+    local context state line
+    typeset -A opt_args
+
+    _arguments -C \
+        '1: :->cmds' \
+        '2: :->args'
+
+    case $state in
+        cmds)
+            local commands; commands=(
+                'add:Add a new item'
+                'del:Delete an item'
+                'list:List all items'
+            )
+            _describe -t commands 'beaml commands' commands
+            ;;
+        args)
+            case $line[1] in
+                add)
+                    _files
+                    ;;
+                del)
+                    local -a items
+                    items=( /pss/lite/*(N:t) )
+                    _describe -t items 'item to delete' items
+                    ;;
+            esac
+            ;;
+    esac
+}
+
+_beaml "$@"

functions/_nixos_config_hosts

@@ -0,0 +1,3 @@
+#compdef bnd nor
+
+compadd -- /root/NixOS-Config/hosts/*(/:t)

functions/_sagt

@@ -0,0 +1,3 @@
+#compdef sagt
+
+compadd -- kill ls op piv reset

functions/_use

@@ -0,0 +1,3 @@
+#compdef use
+
+compadd -- $(nix eval --impure --expr 'builtins.attrNames ( (import <nixpkgs>) {} )' 2>/dev/null | tr '[]"' ' ')

install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/tools/common.sh"
@@ -26,6 +26,8 @@ declare -a HOME_SYMLINKS_SRC
 declare -a HOME_SYMLINKS_DST
 HOME_SYMLINKS_SRC[0]=".ssh/authorized_keys2"
 HOME_SYMLINKS_DST[0]=".ssh/authorized_keys2"
+HOME_SYMLINKS_SRC[1]=".eid/authorized_certificates"
+HOME_SYMLINKS_DST[1]=".eid/authorized_certificates"
 
 install_dependencies()
 {
@@ -147,6 +149,9 @@ install_symlink()
 {
     fmt_note "installing symlinks ..."
     for ((i=0; i<${#HOME_SYMLINKS_SRC[@]}; i++)); do
+        if [[ -z "${HOME_SYMLINKS_SRC[$i]}" ]]; then
+            continue
+        fi
         local src="$DOTFILES/${HOME_SYMLINKS_SRC[$i]}"
         local dst="$HOME/${HOME_SYMLINKS_DST[$i]}"
         fmt_info "creating symlink \"$dst\" --> \"$src\" ..."
@@ -197,7 +202,11 @@ install_crontab()
 {
     if [[ -x $(command -v crontab) ]]; then
         fmt_note "installing \"$CRON_JOB\" to crontab ..."
-        ( crontab -l | grep -vxF "${CRON_JOB}" | grep -v "no crontab for"; echo "$CRON_JOB" ) | crontab -
+        if [[ -z "$(crontab -l 2>/dev/null || true)" ]]; then
+            echo "$CRON_JOB" | crontab -
+        elif !( crontab -l | grep -qxF "${CRON_JOB}"); then
+            ( crontab -l; echo "$CRON_JOB" ) | crontab -
+        fi
     else
         fmt_warning "crontab does not exist. skipping ..."
     fi
@@ -322,6 +331,7 @@ for i in ${GOT_OPTS[@]}; do
         -a|--auto ) INSTALL_DEP=1 ;;
         -H|--hist|--history ) store_hist=1 ;;
         -x ) store_config=1 ;;
+        --no-auth-info ) HOME_SYMLINKS_SRC=(); HOME_SYMLINKS_DST=() ;;
         * ) fmt_fatal "unknown option \"$i\"" ;;
     esac
 done

riot-config.sh

@@ -0,0 +1,69 @@
+#!/bin/false
+
+# batches
+nasps.batch() {
+    remotes+=(
+        g1.nasp
+        g2.nasp
+        g3.nasp
+        g4.nasp
+        g5.nasp
+        g6.nasp
+        g7.nasp
+        g8.nasp
+        g9.nasp
+        g10.nasp
+        g11.nasp
+        g12.nasp
+        g13.nasp
+        g14.nasp
+        dictxiong@g15.nasp
+        dictxiong@g16.nasp
+        g17.nasp
+    )
+}
+
+# remotes
+nasp.remote() {
+    remote=jump.nasp.fit
+    RET_PORT=${RET_PORT:-36022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+# domains
+.domain() {
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_PORT=${RET_PORT:-12022}
+    RET_HOSTNAME=${remote%.}
+}
+
+dxng.domain() {
+    if [[ "$host" =~ ^sed([0-9]{1,2})$ ]]; then
+        RET_HOSTNAME=192.168.98.$((100+BASH_REMATCH[1]))
+    else
+        RET_HOSTNAME=$host.dxng.net
+    fi
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+42.domain() {
+    RET_HOSTNAME=$host.i.bd.dn42
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_TRUST_SERVER=1
+}
+
+nasp.domain() {
+    RET_HOSTNAME=$host
+    RET_PORT=${RET_PORT:-12022}
+    RET_USERNAME=${RET_USERNAME:-root}
+    RET_JUMP_SERVER="ssh@jump.nasp.fit:36022"
+    RET_TRUST_SERVER=1
+}
+
+default.domain() {
+    dxng.domain
+}

scripts/dogo

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"

scripts/doll

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"
@@ -21,5 +21,5 @@ if [[ -z "$IMAGE" ]]; then
     fmt_fatal "image not found"
 else
     fmt_note "--> ${IMAGE_META[@]}"
-    $SUDO docker run ${2:+"--name"} $2 -itd $IMAGE sh
+    $SUDO docker run ${2:+"--name"} $2 -itd --restart=unless-stopped $IMAGE sh
 fi

scripts/pbin

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"

scripts/riot

@@ -1,9 +1,35 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # connect to iot services
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"
 RIOT_TRUST_CLIENT=${RIOT_TRUST_CLIENT:-${DFS_TRUST:-0}}
 RIOT_TRUST_SERVER=${RIOT_TRUST_SERVER:-0}
+EXTRA_SSH_OPTIONS=()
+
+# config
+RIOT_CONFIG_FILES=(
+    "$DOTFILES/riot-config.sh"
+    "$HOME/.config/riot-config.sh"
+    "riot-config.sh"
+)
+for file in "${RIOT_CONFIG_FILES[@]}"; do
+    if [[ -f "$file" ]]; then
+        source "$file"
+    fi
+done
+
+# check if port number valid
+check_port() {
+    [[ "$1" =~ ^[1-9][0-9]{0,4}$ ]] || return 1
+    [[ $1 < 65536 && $1 > 0 ]] || return 1
+    return 0
+}
+
+# check if username valid
+check_username() {
+    [[ "$1" =~ ^[a-z][-a-z0-9_]*$ ]] || return 1
+    return 0
+}
 
 # get single server setting
 # may be called more than once
@@ -16,69 +42,75 @@ get_server_meta() {
     RET_JUMP_SERVER=""  # optional
     # body
     local remote="$1"
-    # if in the form user@...
+    # extract username from user@...
     if [[ "$remote" == *@* ]]; then
         RET_USERNAME=${remote%%@*}
         remote=${remote#*@}
+        check_username $RET_USERNAME || fmt_warning \"$RET_USERNAME\" is not a valid unix username
     fi
-    # if in the form ...:22
+    # extract port from ...:port
-    if [[ "$remote" == *:* ]]; then
+    if [[
+        "$remote" =~ ^[^:]+:[1-9][0-9]*$  # contains only one colon
+        || "$remote" =~ ^\[.+\]:[1-9][0-9]*$  # in the form of [host]:port
+        || "$remote" =~ :::[1-9][0-9]*$  # in the form of :::port
+        || "$remote" =~ ^([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}:[1-9][0-9]*$  # full ipv6 address with port
+        || "$remote" =~ ^[0-9a-f:]+%.+:[1-9][0-9]*$  # ipv6 address with scope and port
+    ]]; then
         RET_PORT=${remote##*:}
         remote=${remote%:*}
+        check_port $RET_PORT || fmt_fatal invalid port number \"$RET_PORT\"
+    fi
+    # remove square brackets
+    if [[ "$remote" =~ ^\[.*\]$ ]]; then
+        remote=${remote:1:-1}
+    fi
+    # presets -- match remote
+    local remote_func="$remote.remote"
+    if is_function "$remote_func"; then
+        "$remote_func"
     fi
     # presets -- match domain
+    RET_HOSTNAME=${remote}
     local domain=${remote##*.}
     local host=${remote%.*}
-    # if there's no dot
+    # if it contains no dot and is not ipv6
-    if [[ "$host" == "$domain" ]]; then
+    if [[ "$remote" != *.* && "$remote" != *:* ]]; then
-        domain="ibd"
+        domain="default"
+    fi
+    local domain_func="$domain.domain"
+    if is_function "$domain_func"; then
+        "$domain_func"
+    elif is_function ".domain"; then
+        ".domain"
     fi
-    case $domain in
-        ibd|ebd )
-            RET_HOSTNAME=$host.$domain.ink
-            RET_PORT=${RET_PORT:-12022}
-            RET_USERNAME=${RET_USERNAME:-root}
-            RET_TRUST_SERVER=1
-            ;;
-        nasp )
-            RET_HOSTNAME=$host
-            RET_PORT=${RET_PORT:-12022}
-            RET_USERNAME=${RET_USERNAME:-dictxiong}
-            RET_JUMP_SERVER="ssh@nasp.ob.ac.cn:36022"
-            RET_TRUST_SERVER=1
-            ;;
-        x|proxied )
-            RET_HOSTNAME=proxy.beardic.cn
-            local tmp=$(sha256sum <<< "$host" | tr -cd "[:digit:]")
-            tmp=${tmp:0:4}
-            RET_PORT=$((10#$tmp+36000))
-            RET_USERNAME=root
-            RET_TRUST_SERVER=1
-            ;;
-        * )
-            test -z "$domain" || fmt_warning "unknown domain: \"$domain\". will try as host name"
-            RET_HOSTNAME="$remote"
-    esac
 }
 
-# remote setting, including jump servers
-# will be called only once
-# provides:
-SERVER=""
-TRUST_SERVER=1
-PORT=""  # optional
-USERNAME=""  # optional
-SSH_OPTIONS=""  # optional
-if [[ "$RIOT_TRUST_CLIENT" == "1" ]]; then
-    SSH_OPTIONS='-o ControlMaster=auto -o ControlPath=/tmp/sshcm-%C -o PermitLocalCommand=yes'
-fi
 parse_remote() {
+    # remote setting, including jump servers
+    # called for every remote
+    # provides:
+    SERVER=""
+    TRUST_SERVER=1
+    PORT=""  # optional
+    USERNAME=""  # optional
+    SSH_OPTIONS=("-o" "ServerAliveInterval=60")
+    if [[ -t 1 ]]; then
+        SSH_OPTIONS+=("-o" "RequestTTY=yes")
+    fi
+    if [[ "$RIOT_TRUST_CLIENT" == "1" ]]; then
+        SSH_OPTIONS+=("-o" "PermitLocalCommand=yes")
+        if [[ "$(get_os_type)" != "msys" ]]; then
+            test "$DFS_DRY_RUN" = "1" || mkdir -p ~/.ssh/master-socket
+            SSH_OPTIONS+=("-o" "ControlMaster=auto" "-o" "ControlPersist=5s" "-o" "ControlPath=~/.ssh/master-socket/%C")
+        fi
+    fi
+    # handle input
     local remote="$1"
     local jump_servers=""
     # loop for jump servers
-    while [[ -n $remote ]]; do 
+    while [[ -n $remote ]]; do
-        local server=${remote%%,*}
+        local server=${remote%%/*}
-        remote=${remote#*,}
+        remote=${remote#*/}
         get_server_meta "$server"
         if [[ -n "$RET_JUMP_SERVER" ]]; then
             jump_servers="$jump_servers${jump_servers:+,}$RET_JUMP_SERVER"
@@ -96,18 +128,41 @@ parse_remote() {
     done
     # construct cmd
     if [[ "$RIOT_TRUST_SERVER" == "1" || "$TRUST_SERVER" == "1" ]]; then
-        SSH_OPTIONS="$SSH_OPTIONS -o ForwardX11=yes -o ForwardAgent=yes"
+        SSH_OPTIONS+=("-o" "ForwardX11=yes" "-o" "ForwardAgent=yes")
     fi
     if [[ -n "$jump_servers" ]]; then
-        SSH_OPTIONS="$SSH_OPTIONS -o ProxyJump=$jump_servers"
+        SSH_OPTIONS+=("-o" "ProxyJump=$jump_servers")
     fi
 }
 
+print_cmd() {
+    local output=""
+    for s in "${CMD[@]}"; do
+        if [[ "$s" =~ [\ \\\'\"] ]]; then  # needs to be escaped
+            s="${s@Q}"
+        fi
+        output+="$s "
+    done
+    fmt_note "--> ${output% }"
+}
+
 eval_or_echo() {
+    local DO=""
+    tmux_win=${tmux_win:-0}
     if [[ "$DFS_DRY_RUN" == "1" ]]; then
-        echo $@
+        DO=echo
+    fi
+    if [[ "$USE_TMUX" == "1" ]]; then
+        if [[ -z "$TMUX_SESS" ]]; then
+            TMUX_SESS=riot-$(date +%s)
+            $DO tmux new-session -d -s $TMUX_SESS bash -l
+        else
+            tmux_win=$((tmux_win+1))
+            $DO tmux new-window -t $TMUX_SESS:$tmux_win -d bash -l
+        fi
+        $DO tmux send-keys -t $TMUX_SESS:$tmux_win $(printf '%s Space ' "${CMD[@]}") Enter
     else
-        eval $@
+        $DO "${CMD[@]}"
     fi
 }
 
@@ -119,37 +174,83 @@ prepare_ssh_cmd() {
     else
         local port_param='-p'
     fi
-    echo "$ssh_bin ${PORT:+$port_param} $PORT $SSH_OPTIONS $SCP_SRC $USERNAME${USERNAME:+@}$SERVER $SCP_DST"
+    CMD=(
+        "$ssh_bin"
+        "${PORT:+$port_param}" "$PORT"
+        "${SSH_OPTIONS[@]}"
+        "${EXTRA_SSH_OPTIONS[@]}"
+        "$SCP_SRC"
+        "$USERNAME${USERNAME:+@}$SERVER"
+        "$SCP_DST"
+        "${@:2}"
+    )
+    for i in ${!CMD[@]}; do if [[ -z "${CMD[i]}" ]]; then unset CMD[i]; fi; done
 }
 
 # ssh
 run_ssh()
 {
-    local cmd="$(prepare_ssh_cmd $1)"
+    prepare_ssh_cmd "$@"
-    fmt_note "-->" $cmd
+    print_cmd
-    eval_or_echo $cmd
+    eval_or_echo
 }
 
 # sshl
 run_sshl()
 {
-    local arg="$1"
+    local arg left right localsock access
-    if [[ "$arg" != *":"* ]]; then
+    local res="${1//[^:]}"
-        # treat as a port number
+    local lorr="-L"
-        arg=localhost:$arg
+    if [[ "${FUNCNAME[1]}" == "run_sshr" ]]; then
+        lorr="-R"
     fi
-    while
+    if [[ ${#res} -eq 2 ]]; then
-        local port=$(shuf -n 1 -i 49152-65535)
+        arg="$1"
-        netstat -atun | grep -q "$port"
+    elif [[ ${#res} -eq 0 ]]; then
-    do
+        if [[ "$lorr" == "-R" ]]; then
-        continue
+            arg="$1"
-    done
+        else
+            arg="$(get_free_port):localhost:$1"
+        fi
+    else
+        left=${1%%:*}
+        right=${1##*:}
+        if check_port "$left"; then
+            arg="$1"
+        elif check_port "$right"; then
+            arg="$(get_free_port):$1"
+        else
+            arg="$1"
+            localsock=1
+        fi
+    fi
+    if [[ "$localsock" == "1" ]]; then
+        access="unix://${arg%%:*}"
+    else
+        access="localhost:${arg%%:*}"
+    fi
+    SSH_OPTIONS+=("-NC" "$lorr" "$arg")
+    prepare_ssh_cmd ssh
+    print_cmd
+    fmt_note "  > please access $access"
+    eval_or_echo
+}
 
-    SSH_OPTIONS="$SSH_OPTIONS -NC -L $port:$arg"
+# sshr
-    local cmd="$(prepare_ssh_cmd ssh)"
+run_sshr()
-    fmt_note "-->" $cmd
+{
+    run_sshl "$1"
+}
+
+# sshd
+run_sshd()
+{
+    local port=${1:-$(get_free_port)}
+    SSH_OPTIONS+=("-NC" "-D" "$port")
+    prepare_ssh_cmd ssh
+    print_cmd
     fmt_note "  > please access localhost:$port"
-    eval_or_echo $cmd
+    eval_or_echo
 }
 
 # scp
@@ -163,59 +264,180 @@ run_scp() {
         dst_is_remote=0
     fi
     if [[ "$dst_is_remote" == "1" ]]; then
-        SCP_SRC=\""$src"\"
+        SCP_SRC="$src"
-        SERVER="$SERVER":\""$dst"\"
+        SERVER="$SERVER":"$dst"
     else
-        SERVER="$SERVER":\""$src"\"
+        SERVER="$SERVER":"$src"
-        SCP_DST=\""$dst"\"
+        SCP_DST="$dst"
     fi
-    SSH_OPTIONS="$SSH_OPTIONS -r"
+    SSH_OPTIONS+=("-r")
-    local cmd="$(prepare_ssh_cmd scp)"
+    prepare_ssh_cmd scp
-    fmt_note "-->" $cmd
+    print_cmd
-    eval_or_echo $cmd
+    eval_or_echo
+}
+
+# ping
+run_ping() {
+    CMD=(ping)
+    if [[ "$1" == "ping4" ]]; then
+        CMD+=(-4)
+    elif [[ "$1" == "ping6" ]]; then
+        CMD+=(-6)
+    fi
+    CMD+=(-c 4 "$SERVER")
+    print_cmd
+    eval_or_echo
+}
+
+# remove host keys
+remove_hostkey() {
+    local key
+    if [[ -z "$PORT" || "$PORT" == "22" ]]; then
+        key=$SERVER
+    else
+        key="[$SERVER]:$PORT"
+    fi
+    ssh-keygen -R "$key"
 }
 
 # main
 print_help()
 {
-    fmt_info "usage: $0 <service> [command] [options]"
+    fmt_info "usage: $0 [-Ddhlqt] [--dry-run] [--dev] [--help] [--lite] [--quite] [--trust] [--tmux] [--password] [[-o ssh-option]...] remote [command] [--] [command-args]"
-    echo "available commands: ssh (default), sshl (ssh -L), zssh, sftp"
+    cat <<EOF
+  available commands:
+  - ssh [ssh-command-args] (default)
+  - tmux [ssh-command-args] (run ssh in multiple tmux windows)
+  - git [git-command-args] (run git on remote machine)
+  - sshl [local-port:remote-host:]remote-port (ssh -L)
+  - sshd [local-port] (ssh -D)
+  - zssh [ssh-command-args]
+  - sftp
+  - scp source destination
+  - rm (remove host keys)
+  - ping/ping4/ping6 (ping the remote servers)
+EOF
 }
 
 router() {
-    if [[ -z "$1" || "$1" == "-h" || "$1" == "--help" ]]; then
+    local positional=()
+    while [[ $# > 0 ]]; do
+        case "$1" in
+            -h|--help )
+                print_help
+                exit 0
+                ;;
+            -t|--trust )
+                RIOT_TRUST_SERVER=1
+                ;;
+            --tmux )
+                USE_TMUX=1
+                ;;
+            --password )
+                EXTRA_SSH_OPTIONS+=("-o" "PasswordAuthentication=yes" "-o" "PubkeyAuthentication=no")
+                ;;
+            -o )
+                EXTRA_SSH_OPTIONS+=("-o" "$2")
+                shift
+                ;;
+            -4 )
+                EXTRA_SSH_OPTIONS+=("-4")
+                ;;
+            -6 )
+                EXTRA_SSH_OPTIONS+=("-6")
+                ;;
+            -v )
+                EXTRA_SSH_OPTIONS+=("-v")
+                ;;
+            -- )
+                shift
+                positional+=("$@")
+                break
+                ;;
+            -* )
+                fmt_fatal "unknown option: '$1'. if this option is for the remote command, add '--' before."
+                ;;
+            * )
+                positional+=("$1")
+                ;;
+        esac
+        shift
+    done
+    IFS=',' read -ra remotes <<< "${positional[0]}"
+    for i in ${!remotes[@]}; do if [[ -z "${remotes[i]}" ]]; then unset remotes[i]; fi; done
+    if [[ "${#positional[@]}" == "0" || "${#remotes[@]}" == "0" ]]; then
         print_help
-        exit
+        exit 1
+    fi
+    for i in ${!remotes[@]}; do
+        remote="${remotes[i]}"
+        local batch_func="${remote}.batch"
+        if is_function "$batch_func"; then
+            "$batch_func"
+            continue
+        fi
+        parse_remote "$remote"
+        case "${positional[1]}" in
+            ssh|tmux|"" )
+                [[ "${positional[1]}" == tmux ]] && USE_TMUX=1
+                run_ssh ssh "${positional[@]:2}"
+                ;;
+            git )
+                if printf '%s\0' "${positional[@]:2}" | grep -Fxqz -- '-C'; then
+                    run_ssh ssh git "${positional[@]:2}"
+                else
+                    run_ssh ssh git -C "$(pwd)" "${positional[@]:2}"
+                fi
+                ;;
+            ping|ping4|ping6 )
+                test "${#positional[@]}" -eq 2 || fmt_fatal "ping requires no arguments"
+                run_ping "${positional[1]}"
+                ;;
+            zssh )
+                run_ssh zssh "${positional[@]:2}"
+                ;;
+            sftp )
+                run_ssh sftp "${positional[@]:2}"
+                ;;
+            sshl )
+                test -n "${positional[2]}" || fmt_fatal "no target address provided"
+                test "${#positional[@]}" -eq 3 || fmt_fatal "sshl requires exactly one argument"
+                run_sshl "${positional[2]}"
+                ;;
+            sshr )
+                test -n "${positional[2]}" || fmt_fatal "no target address provided"
+                test "${#positional[@]}" -eq 3 || fmt_fatal "sshr requires exactly one argument"
+                run_sshr "${positional[2]}"
+                ;;
+            sshd )
+                test "${#positional[@]}" -le 3 || fmt_fatal "sshd requires one or no arguments"
+                if [[ "${#positional[@]}" -eq 3 ]]; then
+                    check_port "${positional[2]}" || fmt_fatal "invalid port number: ${positional[2]}"
+                    run_sshd "${positional[2]}"
+                else
+                    run_sshd
+                fi
+                ;;
+            scp )
+                test "${#positional[@]}" -eq 4 || fmt_fatal "scp requires exactly two arguments: source and destination"
+                test -n "${positional[2]}" || fmt_fatal "no source path specified"
+                test -n "${positional[3]}" || fmt_fatal "no destination path specified"
+                run_scp "${positional[2]}" "${positional[3]}"
+                ;;
+            rm )
+                test "${#positional[@]}" -eq 2 || fmt_fatal "rm requires no arguments"
+                remove_hostkey
+                ;;
+            * )
+                print_help
+                fmt_fatal "unknown command: ${positional[1]}"
+                ;;
+        esac
+    done
+
+    if [[ -n "$TMUX_SESS" && "$DFS_DRY_RUN" != "1" ]]; then
+        tmux attach-session -t $TMUX_SESS
     fi
-    parse_remote "$1"
-    case $2 in
-        -h|--help)
-            print_help
-            exit
-            ;;
-        ssh|"" )
-            run_ssh
-            ;;
-        zssh )
-            run_ssh zssh
-            ;;
-        sftp )
-            run_ssh sftp
-            ;;
-        sshl )
-            test -n "$3" || fmt_fatal "no target address provided"
-            run_sshl "$3"
-            ;;
-        scp )
-            test -n "$3" || fmt_fatal "no source path specified"
-            test -n "$4" || fmt_fatal "no destination path specified"
-            run_scp "$3" "$4"
-            ;;
-        * )
-            print_help
-            fmt_fatal "unknown command: $2"
-            ;;
-    esac
 }
 
 router "${GOT_OPTS[@]}"

scripts/sne

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+if [ "$#" -eq 0 ]; then
+    echo "usage: sne <filename or regex pattern>"
+    echo "example: sne config.yaml"
+    exit 1
+fi
+
+SEARCH_PATTERN="$1"
+files=()
+while IFS= read -r -d $'\0' file; do
+    files+=("$file")
+done < <(fd "$SEARCH_PATTERN" --type f --print0)
+file_count=${#files[@]}
+if [ "$file_count" -eq 0 ]; then
+    echo "no file match '$SEARCH_PATTERN'"
+    exit 0
+fi
+echo "🔎 found $file_count files:"
+for file in "${files[@]}"; do
+    echo "  📄 $file"
+done
+echo "----------------------------------------"
+
+read -r -p "edit? [Y/n] " response
+response=${response:-Y}
+if [[ "$response" =~ ^[Yy]$ ]]; then
+    vim "${files[@]}"
+else
+    echo "❌ aborted"
+fi

tools/alpine.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/common.sh"

tools/append_zsh_hist.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/common.sh"

tools/common.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR_COMMON_SH=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 export DOTFILES=$( cd "$THIS_DIR_COMMON_SH/.." && pwd )
@@ -13,7 +13,10 @@ if [[ "${BASH_SOURCE[0]}" != "${0}" ]]; then
     ARG=""
     GOT_OPTS=()
     while [[ $# > 0 || -n "$ARG" ]]; do
-        if [[ -z "$ARG" ]]; then ARG=$1; shift; fi
+        if [[ -z "$ARG" ]]; then
+            if [[ "$1" == "--" ]]; then GOT_OPTS+=("$@"); break; fi
+            ARG="$1"; shift;
+        fi
         case $ARG in
             -q*|--quite ) export DFS_QUIET=1 ;;
             -l*|--lite ) export DFS_LITE=1 ;;
@@ -162,19 +165,6 @@ ask_for_Yn()
     fi
 }
 
-post_log()
-{
-    if [[ $# != 3 || -z "$1" || -z "$2" || -z "$3" ]]; then
-        fmt_fatal "usage: post_log <level> <section> <content>"
-    fi
-    "${DOTFILES}/tools/frigg-client.sh" "log" "[$1][$2] $3"
-}
-
-apost_log()
-{
-    post_log "$@" 1>/dev/null &
-}
-
 post_beacon()
 {
     if [[ $# < 1 || -z "$1" ]]; then
@@ -190,6 +180,7 @@ apost_beacon()
 
 get_os_type()
 {
+    test -z "$DFS_OS_TYPE" || { echo "$DFS_OS_TYPE"; return; }
     local ans="unknown"
     case "$(uname -s)" in
         Darwin*)    ans="MacOS";;
@@ -198,11 +189,13 @@ get_os_type()
         Linux* )    ans="Linux";;
         *)          ans="unknown";;
     esac
+    export DFS_OS_TYPE="$ans"
     echo $ans | tr '[:upper:]' '[:lower:]'
 }
 
 get_linux_dist()
 {
+    test -z "$DFS_LINUX_DIST" || { echo "$DFS_LINUX_DIST"; return; }
     local ans="unknown"
     if [ -f /etc/os-release ]; then
         . /etc/os-release
@@ -221,6 +214,7 @@ get_linux_dist()
     else
         ans="unknown"
     fi
+    export DFS_LINUX_DIST="$ans"
     echo $ans | tr '[:upper:]' '[:lower:]'
 }
 
@@ -233,6 +227,35 @@ get_os_name()
     echo $ans
 }
 
+is_port_free() {
+    ( echo $1 | grep -qxE "[1-9][0-9]{0,4}" ) || false
+    local cmd
+    case $(get_os_type) in
+        macos ) cmd="netstat -van | grep -q \".$1\"" ;;
+        cygwin|msys ) cmd="netstat -ano | grep -q \":$1\"" ;;
+        *) cmd="netstat -tuanp | grep -q \":$1\"" ;;
+    esac
+    if eval $cmd; then
+        return 2
+    else
+        return 0
+    fi
+}
+
+get_free_port() {
+    while
+        local port=$(shuf -n 1 -i 49152-65535)
+        ! is_port_free $port
+    do
+        continue
+    done
+    echo $port
+}
+
+is_function() {
+    test "$(type -t "$1")" = "function"
+}
+
 # if bash-ed, else source-d
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     $1 "${@:2}"

tools/frigg-client.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
@@ -25,6 +25,7 @@ elif [[ -f /etc/hostname ]]; then
 else
     fmt_fatal "unable to get hostname"
 fi
+hostname=$(echo $hostname | tr '[:upper:]' '[:lower:]')
 
 init_uuid()
 {
@@ -63,8 +64,8 @@ handle_resp()
 
 post_beacon()
 {
-    local beacon_type=$1
+    local beacon_type="$1"
-    local meta=$2
+    local meta="$2"
     if [[ -n "$CI" && "$beacon_type" != "gh.ci" && "$beacon_type" != "dfs.invalid-commit" && "$beacon_type" != "dfs.dirty" ]]; then
         return
     fi
@@ -75,17 +76,6 @@ post_beacon()
     handle_resp "$resp"
 }
 
-post_log()
-{
-    local log_content=$1
-    if [[ -z "$log_content" ]]; then
-        fmt_fatal "log content is required"
-    fi
-    init_uuid
-    resp=$(curl $DFS_CURL_OPTIONS -sSL -X POST -H "Content-Type: text/plain" -d "$log_content" "https://api.beardic.cn/post-log?hostname=$hostname&uuid=$uuid")
-    handle_resp "$resp"
-}
-
 update_dns()
 {
     if [[ -z "$DFS_DDNS_IP4$DFS_DDNS_IP6" ]]; then
@@ -103,12 +93,13 @@ update_dns()
         ip4=""
     elif [[ "$DFS_DDNS_IP4" == "auto" ]]; then
         ip4="auto"
+        api_url="https://api4.beardic.cn"
     elif [[ "$DFS_DDNS_IP4" == "api" ]]; then
         ip4=$(curl $DFS_CURL_OPTIONS -sSL "https://api.ipify.org")
     elif [[ "$DFS_DDNS_IP4" == "http"* ]]; then
         ip4=$(curl $DFS_CURL_OPTIONS -sSL "$DFS_DDNS_IP4")
     else
-        ip4=$(ip a show $DFS_DDNS_IP4 | grep inet | grep global | awk '/inet / {print $2}' |  awk -F'[/]' '{print $1}')
+        ip4=$(ip -4 --brief addr show $DFS_DDNS_IP4 scope global primary | awk '{split($3,a,"/");print a[1]}' | head -n 1)
     fi
     if [[ -n "$DFS_DDNS_IP4" && -z "$ip4" ]]; then
         fmt_fatal "failed getting ip4 address"
@@ -124,7 +115,7 @@ update_dns()
     elif [[ "$DFS_DDNS_IP6" == "http"* ]]; then
         ip6=$(curl $DFS_CURL_OPTIONS -sSL "$DFS_DDNS_IP6")
     else
-        ip6=$(ip a show $DFS_DDNS_IP6 | grep inet6 | grep global | awk '/inet6 / {print $2}' |  awk -F'[/]' '{print $1}')
+        ip6=$(ip -6 --brief addr show $DFS_DDNS_IP6 scope global primary | awk '{split($3,a,"/");print a[1]}' | head -n 1)
     fi
     if [[ -n "$DFS_DDNS_IP6" && -z "$ip6" ]]; then
         fmt_fatal "failed getting ip6 address"
@@ -137,7 +128,7 @@ update_dns()
 
 print_help()
 {
-    fmt_info "usage: $0 <beacon|log|ddns> [beacon_type|log_content]"
+    fmt_info "usage: $0 <beacon|ddns> [beacon_type] [beacon_meta]"
 }
 
 router()
@@ -149,9 +140,6 @@ router()
         beacon)
             post_beacon "$2" "$3"
             ;;
-        log)
-            post_log "$2"
-            ;;
         ddns)
             update_dns
             ;;
@@ -162,4 +150,4 @@ router()
     esac
 }
 
-router "${GOT_OPTS[@]}"
+router "${GOT_OPTS[@]}"

tools/get.dotfiles.cn

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 ARG=""
 GOT_OPTS=()

tools/macos.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/common.sh"
@@ -6,7 +6,7 @@ source "$THIS_DIR/common.sh"
 brew_install()
 {
     # brew update
-    brew install git zsh curl tmux vim util-linux
+    brew install git zsh curl tmux vim util-linux coreutils
 }
 
 router()

tools/msys2.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/common.sh"

tools/sagent-op.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -e
+
+op=$(command -v op || command -v op.exe || true)
+if [[ -z "$op" || ! -x "$op" ]]; then
+    echo "1Password CLI not found" >&2
+    exit 1
+fi
+exec "$op" read "op://Personal/id25519-passphrase/$(hostname)"

tools/sagent.sh

@@ -1,13 +1,18 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 export DFS_COLOR=1
 source "$THIS_DIR/common.sh"
 
 
+SO_PATHS=(
+    "/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so"  # ubuntu 22.04
+    "/run/current-system/sw/lib/opensc-pkcs11.so"  # nixos 23.05
+    "/Library/OpenSC/lib/opensc-pkcs11.so"  # macos 13.4
+)
+
 find_so_file()
 {
-    local SO_PATHS=( "/usr/lib64/opensc-pkcs11.so" "/usr/local/lib/opensc-pkcs11.so" )
     local SO_FILE
     for SO_FILE in ${SO_PATHS[*]}; do
         if [[ -f "$SO_FILE" ]]; then
@@ -15,66 +20,251 @@ find_so_file()
             return
         fi
     done
+    return 1
 }
 
 create_agent()
 {
-    local SO_FILE=$(find_so_file)
+    local IFS=","
-    if [[ -n "$SO_FILE" ]]; then
+    ssh-agent -P "${SO_PATHS[*]},/nix/store/*"
-        fmt_note "opensc-pkcs11.so found"
-        SO_FILE="-P $SO_FILE"
-    fi
-    ssh-agent $SO_FILE
 }
 
 kill_agent()
 {
-    if pgrep -x ssh-agent > /dev/null; then
+    local status
-        fmt_note "killing existing agent"
+    if pgrep -u "$EUID" -x ssh-agent > /dev/null; then
-        pkill -9 -x ssh-agent
+        fmt_note "stopping existing ssh-agent"
+        if pkill -TERM -u "$EUID" -x ssh-agent; then
+            :
+        else
+            status=$?
+            [[ $status -eq 1 ]] || return "$status"
+        fi
     fi
+    if command -v gpgconf > /dev/null 2>&1; then
+        fmt_note "stopping gpg-agent if running"
+        gpgconf --kill gpg-agent
+    fi
+    unset SSH_AUTH_SOCK SSH_AGENT_PID
+    echo unset SSH_AUTH_SOCK SSH_AGENT_PID
 }
 
 add_piv()
 {
-    local SO_FILE=$(find_so_file)
+    local SO_FILE
-    if [[ -n "$SO_FILE" ]]; then
+    if ! SO_FILE=$(find_so_file); then
-        echo ssh-add -s \"$SO_FILE\"
-    else
         fmt_error "opensc-pkcs11.so not found"
+        return 1
     fi
+    printf 'ssh-add -s %q\n' "$SO_FILE"
     list
 }
 
+add_id25519_with_op()
+{
+    local status
+    if SSH_ASKPASS_REQUIRE=force SSH_ASKPASS="$THIS_DIR/sagent-op.sh" timeout 60s ssh-add "$HOME/.ssh/id_ed25519"; then
+        list
+        return
+    else
+        status=$?
+    fi
+
+    if [[ $status -eq 124 ]]; then
+        fmt_fatal "timed out when adding the key"
+    else
+        fmt_fatal "failed to add the key (ssh-add exit $status); check the key, agent, and 1Password CLI"
+    fi
+}
+
 list()
 {
     echo echo "available keys:"
     echo ssh-add -l
 }
 
+configured_pinentry()
+{
+    local agent_conf
+    local agent_confs=()
+    for agent_conf in "$@"; do
+        [[ -f "$agent_conf" ]] && agent_confs+=("$agent_conf")
+    done
+    [[ ${#agent_confs[@]} -gt 0 ]] || return 1
+
+    awk '
+        /^[[:space:]]*#/ { next }
+        {
+            line = $0
+            sub(/^[[:space:]]*/, "", line)
+            if (line ~ /^pinentry-program([[:space:]]|=)/) {
+                sub(/^pinentry-program[[:space:]=]*/, "", line)
+                sub(/[[:space:]]*$/, "", line)
+                pinentry = line
+            }
+        }
+        END {
+            if (pinentry == "") exit 1
+            print pinentry
+        }
+    ' "${agent_confs[@]}"
+}
+
+check_pinentry()
+{
+    local gnupg_home
+    local gpg_sysconfdir
+    local agent_conf
+    local system_agent_conf
+    local pinentry
+    local gpg_bindir
+    local candidate
+
+    gnupg_home=$(gpgconf --list-dirs homedir)
+    gpg_sysconfdir=$(gpgconf --list-dirs sysconfdir)
+    agent_conf="$gnupg_home/gpg-agent.conf"
+    system_agent_conf="$gpg_sysconfdir/gpg-agent.conf"
+    if pinentry=$(configured_pinentry "$system_agent_conf" "$agent_conf"); then
+        if [[ "$pinentry" == "~/"* ]]; then
+            pinentry="$HOME/${pinentry#\~/}"
+        fi
+        if [[ -x "$pinentry" ]]; then
+            return
+        fi
+        fmt_warning "configured pinentry is not executable: $pinentry"
+    else
+        gpg_bindir=$(gpgconf --list-dirs bindir)
+        if [[ -x "$gpg_bindir/pinentry" || -x "$gpg_bindir/pinentry-basic" ]]; then
+            return
+        fi
+    fi
+
+    for candidate in \
+        "$(command -v pinentry-curses 2>/dev/null || true)" \
+        "$(command -v pinentry 2>/dev/null || true)" \
+        "$(command -v pinentry-tty 2>/dev/null || true)"; do
+        [[ -n "$candidate" && -x "$candidate" ]] && break
+        candidate=""
+    done
+
+    if [[ -n "$candidate" ]]; then
+        fmt_warning "gpg-agent has no usable pinentry; add 'pinentry-program $candidate' to $agent_conf"
+    else
+        fmt_warning "gpg-agent has no usable pinentry; install one and configure pinentry-program in $agent_conf"
+    fi
+}
+
+use_gpg_agent()
+{
+    command -v gpgconf > /dev/null 2>&1 || fmt_fatal "gpgconf not found"
+    command -v gpg-connect-agent > /dev/null 2>&1 || fmt_fatal "gpg-connect-agent not found"
+
+    check_pinentry
+
+    local current_tty
+    current_tty=$(tty) || fmt_fatal "unable to determine the current TTY"
+    export GPG_TTY="$current_tty"
+
+    gpgconf --launch gpg-agent
+    gpg-connect-agent updatestartuptty /bye > /dev/null
+
+    local agent_socket
+    agent_socket=$(gpgconf --list-dirs agent-ssh-socket)
+    if [[ -z "$agent_socket" || ! -S "$agent_socket" ]]; then
+        fmt_fatal "gpg-agent SSH socket not found; add 'enable-ssh-support' to ~/.gnupg/gpg-agent.conf and restart gpg-agent"
+    fi
+
+    fmt_note "using gpg-agent: $agent_socket"
+    echo unset SSH_AGENT_PID
+    printf 'export GPG_TTY=%q\n' "$current_tty"
+    printf 'export SSH_AUTH_SOCK=%q\n' "$agent_socket"
+}
+
+read_agent_file()
+{
+    local agent_file="$1"
+    local line
+    local agent_socket=""
+    local agent_pid=""
+
+    while IFS= read -r line; do
+        case "$line" in
+            SSH_AUTH_SOCK=*)
+                agent_socket=${line#SSH_AUTH_SOCK=}
+                agent_socket=${agent_socket%%;*}
+                ;;
+            SSH_AGENT_PID=*)
+                agent_pid=${line#SSH_AGENT_PID=}
+                agent_pid=${agent_pid%%;*}
+                ;;
+        esac
+    done < "$agent_file"
+
+    [[ -n "$agent_socket" && "$agent_pid" =~ ^[1-9][0-9]*$ ]] || return 1
+    export SSH_AUTH_SOCK="$agent_socket"
+    export SSH_AGENT_PID="$agent_pid"
+}
+
+agent_is_usable()
+{
+    [[ -S "$SSH_AUTH_SOCK" ]] || return 1
+    ps -p "$SSH_AGENT_PID" -o uid= -o comm= 2>/dev/null |
+        awk -v uid="$EUID" '$1 == uid && $2 ~ /(^|\/)ssh-agent$/ { found=1 } END { exit !found }' || return 1
+
+    local status
+    if ssh-add -l > /dev/null 2>&1; then
+        status=0
+    else
+        status=$?
+    fi
+    [[ $status -eq 0 || $status -eq 1 ]]
+}
+
+print_agent_env()
+{
+    printf 'export SSH_AUTH_SOCK=%q\n' "$SSH_AUTH_SOCK"
+    printf 'export SSH_AGENT_PID=%q\n' "$SSH_AGENT_PID"
+}
+
 reset()
 {
     kill_agent
-    all
+    all already-killed
 }
 
 all()
 {
-    local agent_file="/tmp/piv-agent-$(whoami)"
+    local mode="${1:-}"
-    if [[ -f $agent_file ]]; then
+    mkdir -p "$HOME/.ssh"
-        source $agent_file > /dev/null
+    local agent_file="$HOME/.ssh/agent-$(whoami)"
+    [[ ! -L "$agent_file" ]] || fmt_fatal "refusing to use symlink as agent file: $agent_file"
+    unset SSH_AUTH_SOCK SSH_AGENT_PID
+
+    if [[ "$mode" != "already-killed" && -f "$agent_file" ]]; then
+        chmod 600 "$agent_file"
+        read_agent_file "$agent_file" || true
     else
-        touch $agent_file
+        touch "$agent_file"
-        chmod 600 $agent_file
+        chmod 600 "$agent_file"
     fi
-    if ! ps -p "$SSH_AGENT_PID" 1>/dev/null 2>&1; then
+
-        kill_agent
+    if ! agent_is_usable; then
+        if [[ "$mode" != "already-killed" ]]; then
+            kill_agent
+        fi
         fmt_note "launching a new agent"
-        create_agent | tee $agent_file
+        local agent_output
+        if ! agent_output=$(create_agent); then
+            fmt_fatal "failed to launch ssh-agent"
+        fi
+        printf '%s\n' "$agent_output" > "$agent_file"
+        chmod 600 "$agent_file"
+        read_agent_file "$agent_file" || fmt_fatal "ssh-agent returned invalid environment data"
+        agent_is_usable || fmt_fatal "new ssh-agent is not usable"
     else
         fmt_note "using existing agent: $SSH_AGENT_PID"
-        cat $agent_file
     fi
+    print_agent_env
 }
 
 route()
@@ -94,6 +284,12 @@ route()
         piv)
             add_piv
             ;;
+        op)
+            add_id25519_with_op
+            ;;
+        gpg)
+            use_gpg_agent
+            ;;
         reset)
             reset
             ;;
@@ -102,8 +298,9 @@ route()
             ;;
         *)
             fmt_error "unknown command: $1"
+            return 1
             ;;
     esac
 }
 
-route "$@"
+route "$@"

tools/test-getopts.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -ex
 OPTS='-a -bcl --color --arg1=1 --arg2 2 " 1 2" yes'
 TARGET_OPTS='-a -b -c --arg1 1 --arg2 2  1 2 yes'

tools/test.zsh

@@ -3,6 +3,12 @@
 set -ex
 trap "dfs beacon gh.ci.fail" ERR
 
+# fix for macos
+dfs cd
+if [[ $(./tools/common.sh get_os_type) == "macos" ]]; then
+    export PATH="/usr/local/opt/coreutils/libexec/gnubin:/opt/homebrew/opt/coreutils/libexec/gnubin:${PATH}"
+fi
+
 # check files
 cd /
 l
@@ -13,11 +19,14 @@ l
 pwd
 test -f .zshrc2
 diff -q ./.ssh/authorized_keys2 ~/.ssh/authorized_keys2
+diff -q ./.eid/authorized_certificates ~/.eid/authorized_certificates
 grep -q ".zshrc2" ~/.zshrc
+if [[ -x $(command -v crontab) ]]; then
+    crontab -l | grep -qxF "0 * * * * ${DOTFILES}/update.sh"
+fi
 
 # check scripts and functions
 dfs version
-dfs log 1
 dfs beacon gh.ci $GITHUB_SHA
 z ~
 test ~ -ef "$(pwd)"
@@ -31,14 +40,16 @@ test $(echo n | tools/common.sh ask_for_yN "test") = "0"
 test $(echo | tools/common.sh ask_for_yN "test") = "0"
 test $(echo | tools/common.sh ask_for_Yn "test") = "1"
 test $(DFS_QUIET=1 tools/common.sh ask_for_Yn "test") = "1"
-test "$(DFS_TRUST=1 riot time@is.impt:2222,yes@you-r.right,you@are.really.recht.,ibd.,try@it scp /tmp/ ./tmp -D 2>/dev/null)" = 'scp -P 12022 -o ControlMaster=auto -o ControlPath=/tmp/sshcm-%C -o PermitLocalCommand=yes -o ProxyJump=time@is.impt:2222,yes@you-r.right,you@are.really.recht.,ibd. -r try@it.ibd.ink:"/tmp/" "./tmp"'
+test "$(DFS_TRUST=1 riot time@is.impt:2222/yes@you-r.right/you@are.really.recht./ibd./try@it,another@host scp /tmp/ ./tmp -D 2>/dev/null)" = 'scp -P 12022 -o ServerAliveInterval=60 -o PermitLocalCommand=yes -o ControlMaster=auto -o ControlPersist=5s -o ControlPath=~/.ssh/master-socket/%C -o ProxyJump=time@is.impt:2222,yes@you-r.right:12022,you@are.really.recht:12022,root@ibd:12022 -r try@it.dxng.net:/tmp/ ./tmp
+scp -P 12022 -o ServerAliveInterval=60 -o PermitLocalCommand=yes -o ControlMaster=auto -o ControlPersist=5s -o ControlPath=~/.ssh/master-socket/%C -o ForwardX11=yes -o ForwardAgent=yes -r another@host.dxng.net:/tmp/ ./tmp'
+test "$(riot you@example.com:55 -tD ssh --password -- ping -c 1 2>/dev/null)" = 'ssh -p 55 -o ServerAliveInterval=60 -o ForwardX11=yes -o ForwardAgent=yes -o PasswordAuthentication=yes -o PubkeyAuthentication=no you@example.com ping -c 1'
 
 # check alias
 alias p114
 alias cbds
 which riot
 sagt
-test -f "/tmp/piv-agent-$(whoami)"
+test -f ~/.ssh/agent-$(whoami)
 gbes || which gbes
 
 # check update

tools/to-install.sh

@@ -1,16 +1,18 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 declare -A INSTALL_COMMANDS
 INSTALL_COMMANDS=(\
     [git]="apt update && apt install git" \
     [fzf]="git clone --depth 1 https://gitee.com/dictxiong/fzf.git ~/.fzf &&  ~/.fzf/install" \
-    [acme.sh]="curl https://get.acme.sh | sh -s email=${EMAIL:-me@beardic.cn}" \
+    [acme.sh]="curl https://get.acme.sh | sh -s email=${EMAIL:-acme@dxng.net}" \
     [oh-my-zsh]='sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"' \
     [oh-my-tuna]='wget https://tuna.moe/oh-my-tuna/oh-my-tuna.py && sudo python oh-my-tuna.py --global' \
     [v2fly]="bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh) #--remove" \
     [zerotier-one]='curl -s https://install.zerotier.com | sudo bash' \
     [docker-ce]='curl -fsSL https://get.docker.com | sudo bash -s - --mirror Aliyun #--dry-run' \
-    [lemonbench]='curl -fsSL https://ilemonra.in/LemonBenchIntl | bash -s fast # or full' \
+    [lemonbench]='curl -fsSL https://raw.githubusercontent.com/LemonBench/LemonBench/main/LemonBench.sh | bash -s fast # or full' \
+    [nix]='sh <(curl -L https://nixos.org/nix/install) #--daemon' \
+    [alist]='curl -fsSL "https://alist.nn.ci/v3.sh" | bash -s install' \
 )
 
 install()

tools/ubuntu.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/common.sh"
@@ -14,11 +14,11 @@ apt_install()
 {
     apt-get update -y
     # lite
-    apt-get install -y git zsh bash tmux vim curl inetutils-ping less bsdmainutils
+    DEBIAN_FRONTEND=noninteractive apt-get install -y git zsh bash tmux vim curl iputils-ping less bsdmainutils
     # full
     if [[ -z "$DFS_LITE" || "$DFS_LITE" == "0" ]]; then
-        apt-get install -y wget dialog net-tools dnsutils netcat traceroute sudo python3 python3-pip cron openssh-client openssh-server htop gcc g++ cmake make zip
+        DEBIAN_FRONTEND=noninteractive apt-get install -y wget dialog net-tools dnsutils netcat traceroute sudo python3 python3-pip cron openssh-client openssh-server htop gcc g++ cmake make zip
-        for i in {fzf,ripgrep,man-db}; do apt-get install -y $i; done
+        for i in {fzf,ripgrep,man-db}; do DEBIAN_FRONTEND=noninteractive apt-get install -y $i; done
     fi
 }