[maximn]

The rest of the "better defaults" from the modernization plan. The gitconfig part went in with #7.

zshrc

• fzf lists files with fd, so it skips what .gitignore lists (Ctrl-T, Option-C), and Ctrl-T previews the file with bat
• EDITOR defaults to vim
• Man pages are shown through bat, so they're in color

Each is only a default: a value set in ~/.zshrc before the repo's zshrc loads still wins.

Touch ID for sudo

macos-defaults.sh adds pam_tid.so to /etc/pam.d/sudo_local, which survives macOS updates. The new pam-reattach formula, added above it, makes Touch ID work inside herdr and tmux too.

• Safe to re-run. If pam-reattach is installed later, a re-run adds it above pam_tid.so
• Ignores the template's commented-out #auth ... pam_tid.so line
• Skips with a message on macOS older than 14, which has no sudo_local

Testing

• zshrc: checked the exported values with stub fd and bat commands, with and without values set beforehand
• Touch ID: ran the block against fake pam files with a pass-through sudo in five situations: before and after installing pam-reattach, a re-run (no change), the template's commented-out line, and macOS older than 14
• Not run on a real Mac yet. CI covers shellcheck, the interactive zsh check, and whether pam-reattach exists in Homebrew. Touch ID itself still needs testing by hand

Not included

Caching compinit: startup time needs measuring on a Mac first.

🤖 Generated with Claude Code