Add bos-update + replicate the dev zsh shell

bos-update: one command that updates both BOS channels — pacman -Syu (snap-pac
snapshotted) and bakery update --all — best-effort so one failing doesn't abort
the other. Baked into the live env and skel.

Shell: match the dev laptop's zsh. Ship Powerlevel10k + zsh-autosuggestions,
zsh-history-substring-search and zsh-syntax-highlighting, sourced from the distro
packages (no oh-my-zsh framework) in the correct order, plus the dev .p10k.zsh.
Powerlevel10k is AUR-only, so it's republished to [breadway] via
packaging/powerlevel10k + a CI workflow (builds libgit2 + gitstatus from source),
same pattern as bibata / zen-browser-bin. skel/.zshrc keeps the BOS QoL aliases
and pywal palette import, with `update` aliased to bos-update.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/powerlevel10k.yml

@@ -0,0 +1,35 @@
+name: Build and publish powerlevel10k
+
+# Powerlevel10k (the BOS default zsh prompt) is AUR-only, so BOS maintains an
+# in-house PKGBUILD and publishes the built package to the [breadway] repo.
+# Builds gitstatus + libgit2 from source, so it needs cmake + zsh beyond base-devel.
+on:
+  push:
+    paths:
+      - 'packaging/powerlevel10k/**'
+  workflow_dispatch:
+
+jobs:
+  powerlevel10k:
+    runs-on: [self-hosted, hestia]
+    container:
+      image: archlinux:latest
+    steps:
+      - name: Build and publish
+        env:
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm base-devel git cmake zsh
+          useradd -m builder
+          git config --global --add safe.directory '*'
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
+          chown -R builder:builder /home/builder/src
+          su builder -c "cd /home/builder/src/packaging/powerlevel10k && makepkg -f --noconfirm --nocheck"
+          PKG=$(find /home/builder/src/packaging/powerlevel10k -name '*.pkg.tar.zst' | head -1)
+          curl -fsS -X PUT \
+            -H "Authorization: token ${PUBLISH_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@${PKG}" \
+            "https://git.breadway.dev/api/packages/Breadway/arch/os"

iso/airootfs/etc/skel/.zshrc

@@ -1,4 +1,15 @@
-# BOS default zsh config — quality-of-life defaults, easy to extend.
+# BOS default zsh config — Powerlevel10k prompt + plugins + pywal palette.
+#
+# Mirrors the BOS dev shell, but sources plugins from the distro packages
+# (/usr/share/zsh/...) instead of oh-my-zsh, so there's no framework to manage.
+# Customise the prompt with `p10k configure` (rewrites ~/.p10k.zsh).
+
+# Enable Powerlevel10k instant prompt. Should stay close to the top of ~/.zshrc.
+# Initialization code that may require console input (password prompts, [y/n]
+# confirmations, etc.) must go above this block; everything else may go below.
+if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+  source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+fi
 
 # History
 HISTFILE=~/.zsh_history
@@ -11,10 +22,21 @@ autoload -Uz compinit && compinit
 zstyle ':completion:*' menu select
 zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
 
-# Key bindings (emacs style + common extras)
+# Emacs-style key bindings
 bindkey -e
-bindkey '^[[A' history-search-backward
-bindkey '^[[B' history-search-forward
+
+# Prompt — Powerlevel10k (republished to [breadway] as zsh-theme-powerlevel10k).
+source /usr/share/zsh-theme-powerlevel10k/powerlevel10k.zsh-theme
+
+# Plugins (order matters: syntax-highlighting must be sourced LAST).
+ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=60'
+source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh 2>/dev/null
+source /usr/share/zsh/plugins/zsh-history-substring-search/zsh-history-substring-search.zsh 2>/dev/null
+source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh 2>/dev/null
+
+# history-substring-search: ↑/↓ search history by the typed prefix.
+bindkey '^[[A' history-substring-search-up
+bindkey '^[[B' history-substring-search-down
 
 # fzf — fuzzy history search on Ctrl+R, fuzzy file find on Ctrl+T
 if command -v fzf &>/dev/null; then
@@ -54,12 +76,18 @@ alias free='free -h'
 alias grep='grep --color=auto'
 alias ip='ip --color=auto'
 
-# bakery / bread
-alias update='bakery update'
+# Updates — bos-update runs both channels (pacman + bakery). pacman aliased to
+# sudo so `pacman -Syu` etc. just work.
+alias update='bos-update'
+alias pacman='sudo pacman'
 
-# Prompt — simple and fast (no starship dep)
-autoload -Uz vcs_info
-precmd() { vcs_info }
-zstyle ':vcs_info:git:*' formats ' (%b)'
-setopt PROMPT_SUBST
-PROMPT='%F{cyan}%~%f%F{yellow}${vcs_info_msg_0_}%f %(?.%F{green}.%F{red})❯%f '
+# ~/.local/bin holds the bread* binaries baked in at build time.
+export PATH="$HOME/.local/bin:$PATH"
+
+# Powerlevel10k prompt configuration.
+[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh
+
+# Import pywal colour palette (drives the terminal colours from the wallpaper).
+if [ -f "$HOME/.cache/wal/sequences" ]; then
+    cat "$HOME/.cache/wal/sequences"
+fi

iso/airootfs/usr/local/bin/bos-update

@@ -0,0 +1,32 @@
+#!/bin/bash
+# bos-update — update all of BOS in one go.
+#
+# BOS packages come from two channels, so a full update touches both:
+#   1. pacman   — Arch base/desktop + the [breadway] repo (bos-settings, etc.).
+#                 Every transaction is snapshotted by snap-pac, so you can roll
+#                 back from the GRUB "snapshots" submenu or BOS Settings.
+#   2. bakery   — the bread ecosystem apps in ~/.local/bin (bread, breadbar,
+#                 breadbox, breadcrumbs, breadpad, breadman, bread-theme).
+#
+# Best-effort: a failure in one channel doesn't abort the other.
+set -uo pipefail
+
+bold() { printf '\033[1m%s\033[0m\n' "$1"; }
+
+bold "==> System packages (pacman -Syu)"
+if command -v pacman >/dev/null; then
+    sudo pacman -Syu || echo "WARN: pacman update failed"
+else
+    echo "pacman not found; skipping"
+fi
+
+echo
+bold "==> Bread ecosystem (bakery update --all)"
+if command -v bakery >/dev/null; then
+    bakery update --all || echo "WARN: bakery update failed"
+else
+    echo "bakery not found; skipping"
+fi
+
+echo
+bold "==> BOS is up to date."

iso/packages.x86_64

@@ -207,8 +207,15 @@ man-pages
 less
 
 # Base CLI tools every install should have.
-# Shell
+# Shell — zsh with the same prompt + plugins as the dev laptop. Powerlevel10k is
+# AUR-only, so it's republished to [breadway] (see packaging/powerlevel10k). The
+# three plugins come from the official repos; skel/.zshrc sources them in order
+# (autosuggestions → history-substring-search → syntax-highlighting LAST).
 zsh
+zsh-theme-powerlevel10k
+zsh-autosuggestions
+zsh-history-substring-search
+zsh-syntax-highlighting
 # Editors
 nano
 micro

iso/profiledef.sh

@@ -23,4 +23,5 @@ file_permissions=(
     ["/usr/local/bin/bos-session"]="0:0:755"
     ["/usr/local/bin/bos-keybinds"]="0:0:755"
     ["/usr/local/bin/bos-welcome"]="0:0:755"
+    ["/usr/local/bin/bos-update"]="0:0:755"
 )

packaging/powerlevel10k/PKGBUILD

@@ -0,0 +1,105 @@
+# BOS in-house rebuild of zsh-theme-powerlevel10k (AUR-only upstream).
+# Republished to [breadway] so the ISO can pull the BOS default prompt via pacman
+# (same pattern as bibata / zen-browser-bin). Upstream maintainer header kept below.
+# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
+# Contributor: Christian Rebischke <chris.rebischke@archlinux.org>
+# Contributor: Jeff Henson <jeff@henson.io>
+# Contributor: Ron Asimi <ron dot asimi at gmail dot com>
+# Contributor: Roman Perepelitsa <roman.perepelitsa@gmail.com>
+pkgname=zsh-theme-powerlevel10k
+# Whenever pkgver is updated, _libgit2ver below must also be updated.
+pkgver=1.20.17  ## see P9K_VERSION in internal/p10k.zsh
+_libgit2ver="tag-2ecf33948a4df9ef45a66c68b8ef24a5e60eaac6"
+pkgrel=1
+epoch=1
+pkgdesc="Powerlevel10k is a theme for Zsh. It emphasizes speed, flexibility and out-of-the-box experience."
+arch=('x86_64' 'aarch64')
+url='https://github.com/romkatv/powerlevel10k'
+license=('MIT')
+depends=(
+  'glibc'
+  'zsh'
+)
+makedepends=(
+  'git'
+  'cmake'
+)
+optdepends=(
+  # It works well with Nerd Fonts, Source Code Pro, Font Awesome, Powerline,
+  # and even the default system fonts. The full choice of style options is
+  # available only when using Nerd Fonts.
+  'ttf-meslo-nerd-font-powerlevel10k: recommended font'
+  'powerline-fonts: patched fonts for powerline'
+  'ttf-font-nerd: full choice of style options'
+)
+replaces=('zsh-theme-powerlevel9k')
+_commit=9253fb1c5034410c43a0c681ff8294181c54016c
+
+# _libgit2ver depends on pkgver. They must be updated together. See libgit2_version in:
+# https://raw.githubusercontent.com/romkatv/powerlevel10k/v${pkgver}/gitstatus/build.info
+source=(
+  "git+https://github.com/romkatv/powerlevel10k.git#commit=${_commit}"
+#  "powerlevel10k-${pkgver}.tar.gz::https://github.com/romkatv/powerlevel10k/archive/v${pkgver}.tar.gz"
+#  "https://github.com/romkatv/powerlevel10k/releases/download/v$pkgver/powerlevel10k-$pkgver.tar.gz.asc"
+  "libgit2-${_libgit2ver}.tar.gz::https://github.com/romkatv/libgit2/archive/${_libgit2ver}.tar.gz")
+sha256sums=('f0edc2cc5bfcdfcf3b94f10597c252873567a990e651d04059c887046fba6701'
+            '4ce11d71ee576dbbc410b9fa33a9642809cc1fa687b315f7c23eeb825b251e93')
+#validpgpkeys=('8B060F8B9EB395614A669F2A90ACE942EB90C3DD') # Roman Perepelitsa <roman.perepelitsa@gmail.com>
+
+build() {
+  cd "libgit2-${_libgit2ver}"
+  local cmake_options=(
+    -W no-dev
+    -D CMAKE_BUILD_TYPE='None'
+    -D ZERO_NSEC='ON'
+    -D THREADSAFE='ON'
+    -D USE_BUNDLED_ZLIB='ON'
+    -D REGEX_BACKEND='builtin'
+    -D USE_HTTP_PARSER='builtin'
+    -D USE_SSH='OFF'
+    -D USE_HTTPS='OFF'
+    -D BUILD_CLAR='OFF'
+    -D USE_GSSAPI='OFF'
+    -D USE_NTLMCLIENT='OFF'
+    -D BUILD_SHARED_LIBS='OFF'
+    -D ENABLE_REPRODUCIBLE_BUILDS='ON'
+  )
+  cmake "${cmake_options[@]}" .
+  make
+
+  # build gitstatus
+  cd "$srcdir/powerlevel10k/gitstatus"
+  export CXXFLAGS+=" -I${srcdir}/libgit2-${_libgit2ver}/include -DGITSTATUS_ZERO_NSEC -D_GNU_SOURCE"
+  export LDFLAGS+=" -L${srcdir}/libgit2-${_libgit2ver}"
+  make
+}
+
+package() {
+  cd powerlevel10k
+  find . -type f -exec install -D '{}' "$pkgdir/usr/share/${pkgname}/{}" ';'
+
+  install -d "${pkgdir}/usr/share/licenses/${pkgname}"
+  ln -s "/usr/share/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
+
+  # delete unnecessary files. See also: https://bugs.archlinux.org/task/66737
+  rm -r "${pkgdir}/usr/share/${pkgname}/.git"
+  rm -r "${pkgdir}/usr/share/${pkgname}/gitstatus/deps/"
+  rm -r "${pkgdir}/usr/share/${pkgname}/gitstatus/obj"
+  rm -r "${pkgdir}/usr/share/${pkgname}/gitstatus/src/"
+  rm -r "${pkgdir}/usr/share/${pkgname}/gitstatus/.vscode/"
+  rm "${pkgdir}/usr/share/${pkgname}/.gitattributes"
+  rm "${pkgdir}/usr/share/${pkgname}/.gitignore"
+  rm "${pkgdir}/usr/share/${pkgname}/Makefile"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/build"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/Makefile"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/mbuild"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/.clang-format"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/.gitignore"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/.gitattributes"
+  rm "${pkgdir}/usr/share/${pkgname}/gitstatus/usrbin/.gitkeep"
+
+  cd "${pkgdir}/usr/share/${pkgname}"
+  for file in *.zsh-theme internal/*.zsh gitstatus/*.zsh gitstatus/install; do
+    zsh -fc "emulate zsh -o no_aliases && zcompile -R -- $file.zwc $file"
+  done
+}