age: add nibble recipient, rekey secrets

.chezmoi.yaml.tmpl

@@ -80,6 +80,7 @@ age:
         - age1f3snmdh0ra83lq8tly2t823dp6u6sluepf3kcj9xcyg4wh722fuqptwnpq  # tadbit (Gentoo laptop)
         - age14744gqv5n455eem48g2ve2w7nf9u2gz4f3lc55fe8esldpdzd5cqkj8ee5  # bopad (CachyOS)
         - age1vnszz9g67u8qlv60z7tgjxmyvqcp4qknkhxv5gjfhzgrkukulazq8kkntk  # rain (new Arch box)
+        - age1s3v6a4v8skkmfpp2rmz59vs4zajl996lws9wyssdhmjm2u7az90sdeag6y  # nibble (CachyOS laptop)
 
 data:
     os_family: {{ $osFamily | quote }}

dot_zshrc.tmpl

@@ -4,6 +4,19 @@
 #  Sync source: https://git.melonbread.xyz/rain/gnu-plus-dotfiles
 # =============================================================================
 
+# ---------------------------------------------------------------------------
+# PATH (auto-deduplicated)
+# ---------------------------------------------------------------------------
+typeset -U path
+path=(
+    {{- if not (not (stat "/opt/rocm/bin")) }}
+    /opt/rocm/bin                      # ROCm tools first (rocminfo, rocm-smi, amd-smi, hipcc, etc.)
+    {{- end }}
+    $HOME/.local/bin
+    $HOME/.bin
+    $path
+)
+
 # ---------------------------------------------------------------------------
 # Oh My Zsh
 # ---------------------------------------------------------------------------
@@ -25,7 +38,7 @@ plugins=(
     fzf-tab                       # navigable Tab completion menu
     zsh-syntax-highlighting       # fish-style live colors — MUST be near last
     zsh-history-substring-search  # fish-style Up/Down history search
-    zsh-autosuggestions           # fish-style ghost completions — MUST be last
+    deja                          # predictive ghost completions — MUST be last (replaces zsh-autosuggestions)
 )
 
 
@@ -85,18 +98,6 @@ export TMUX_PLUGIN_MANAGER_PATH=~/.tmux/plugins/tpm
 # Debian: ROCm only relevant if you install it. Leave default until needed.
 {{ end -}}
 
-# ---------------------------------------------------------------------------
-# PATH (auto-deduplicated)
-# ---------------------------------------------------------------------------
-typeset -U path
-path=(
-    {{- if not (not (stat "/opt/rocm/bin")) }}
-    /opt/rocm/bin                      # ROCm tools first (rocminfo, rocm-smi, amd-smi, hipcc, etc.)
-    {{- end }}
-    $HOME/.local/bin
-    $HOME/.bin
-    $path
-)
 
 # ---------------------------------------------------------------------------
 # Aliases — common + OS-specific

run_once_20-install-user-packages-gentoo.sh.tmpl

@@ -239,12 +239,13 @@ else
     log "oh-my-zsh already installed"
 fi
 
-# Plugins: zsh-autosuggestions, zsh-syntax-highlighting, zsh-history-substring-search, fzf-tab
+# Plugins: zsh-autosuggestions, zsh-syntax-highlighting, zsh-history-substring-search, fzf-tab, deja
 declare -A PLUGINS=(
     [zsh-autosuggestions]="https://github.com/zsh-users/zsh-autosuggestions"
     [zsh-syntax-highlighting]="https://github.com/zsh-users/zsh-syntax-highlighting"
     [zsh-history-substring-search]="https://github.com/zsh-users/zsh-history-substring-search"
     [fzf-tab]="https://github.com/Aloxaf/fzf-tab"
+    [deja]="https://github.com/Giammarco-Ferranti/deja"
 )
 for plugin in "${!PLUGINS[@]}"; do
     if [[ -d "$ZSH_CUSTOM/plugins/$plugin" ]]; then
@@ -255,6 +256,21 @@ for plugin in "${!PLUGINS[@]}"; do
     fi
 done
 
+# deja predictive autosuggestions: binary via official installer (into
+# ~/.local/bin), then seed DB from history. SHELL neutralized so the
+# installer never touches .zshrc — the plugin above handles activation.
+if ! command -v deja >/dev/null 2>&1; then
+    log "installing deja binary via official installer"
+    curl -fsSL https://raw.githubusercontent.com/Giammarco-Ferranti/deja/main/install.sh \
+        | INSTALL_DIR="$USER_HOME/.local/bin" SHELL=/bin/sh sh \
+        || log "WARNING: deja install failed; retry manually."
+fi
+if command -v deja >/dev/null 2>&1 && [[ ! -s "$USER_HOME/.local/share/deja/deja.db" ]]; then
+    log "seeding deja DB from shell history"
+    HISTFILE="${HISTFILE:-$USER_HOME/.zsh_history}" deja import \
+        || log "WARNING: deja import failed; run 'deja import' later."
+fi
+
 # Step 8: tpm (tmux plugin manager)
 if [[ ! -d "$USER_HOME/.tmux/plugins/tpm" ]]; then
     log "installing tpm"

run_once_20-install-user-packages.sh.tmpl

@@ -6,7 +6,8 @@
 #  starship, lazygit, yt-dlp, etc.)
 #
 #  Also: install oh-my-zsh, zsh-autosuggestions, zsh-syntax-highlighting,
-#  zsh-history-substring-search, fzf-tab.
+#  zsh-history-substring-search, fzf-tab, and the deja autosuggestion engine
+#  (binary via official installer + plugin clone).
 #
 #  Runs as the unprivileged user, but uses sudo for system packages.
 #
@@ -277,6 +278,30 @@ install_zsh_plugin zsh-users/zsh-syntax-highlighting    "$ZSH_CUSTOM/plugins/zsh
 install_zsh_plugin zsh-users/zsh-history-substring-search "$ZSH_CUSTOM/plugins/zsh-history-substring-search"
 install_zsh_plugin Aloxaf/fzf-tab                       "$ZSH_CUSTOM/plugins/fzf-tab"
 
+install_zsh_plugin Giammarco-Ferranti/deja              "$ZSH_CUSTOM/plugins/deja"
+# --------------------------- deja (predictive autosuggestions) -------------
+# Binary via the official installer (checksum-verified release tarball into
+# ~/.local/bin). SHELL is neutralized so the installer never appends its
+# activation block to .zshrc — the OMZ plugin cloned above handles that.
+# `deja import` seeds the suggestion DB from $HISTFILE (falls back to
+# ~/.zsh_history); safe to re-run, it dedupes.
+if command -v deja >/dev/null 2>&1; then
+    log "deja already installed: $(deja --version 2>/dev/null | head -1)"
+else
+    log "installing deja binary via official installer"
+    if curl -fsSL https://raw.githubusercontent.com/Giammarco-Ferranti/deja/main/install.sh \
+        | INSTALL_DIR="$USER_HOME/.local/bin" SHELL=/bin/sh sh; then
+        log "deja installed"
+    else
+        log "WARNING: deja install failed; zsh-autosuggestions behavior will be absent. Retry manually."
+    fi
+fi
+if command -v deja >/dev/null 2>&1 && [[ ! -s "$USER_HOME/.local/share/deja/deja.db" ]]; then
+    log "seeding deja DB from shell history"
+    HISTFILE="${HISTFILE:-$USER_HOME/.zsh_history}" deja import \
+        || log "WARNING: deja import failed; run 'deja import' in an interactive shell later."
+fi
+
 # --------------------------- TPM (tmux plugin manager) ---------------------
 if [[ ! -d "$USER_HOME/.tmux/plugins/tpm" ]]; then
     log "cloning tmux plugin manager"