Pin plugin archives and stop dfu auto-refresh

.chezmoiexternal.toml

@@ -1,59 +1,75 @@
-# Paths are home-relative (e.g. .vim/...) so clones follow ~/.vim → sourceDir/vim.
-# Vim: prefer vim-polyglot for syntax; keep vim-go (disable polyglot go); NERDTree = preservim fork.
+# Third-party plugins as commit-pinned archives (SHA-256 checked).
+# Kept under ~/.local/share so they do not conflict with symlink_dot_vim / symlink_dot_zsh.
+# To bump a plugin: update url commit + checksum here, commit, then run dfup.
 
-[".vim/pack/vendor/start/lightline.vim"]
-type = "git-repo"
-url = "https://github.com/itchyny/lightline.vim"
+[".local/share/vim/pack/vendor/start/lightline.vim"]
+type = "archive"
+url = "https://github.com/itchyny/lightline.vim/archive/d042c506cb2e7a59112a72447e0b5fe8739d9d1d.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/lightline.vim".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/lightline.vim".checksum]
+sha256 = "f1ba36ddda46cf146bf503a95c886f1946b4d6333c6100f18bb3b9e8c78bf309"
 
-[".vim/pack/vendor/start/nerdtree"]
-type = "git-repo"
-url = "https://github.com/preservim/nerdtree.git"
+[".local/share/vim/pack/vendor/start/nerdtree"]
+type = "archive"
+url = "https://github.com/preservim/nerdtree/archive/690d061b591525890f1471c6675bcb5bdc8cdff9.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/nerdtree".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/nerdtree".checksum]
+sha256 = "6d2abd17b2cfcda247db29650900d63a823c9eb3489ad24ac16269b2e993d642"
 
-[".vim/pack/vendor/start/vim-go"]
-type = "git-repo"
-url = "https://github.com/fatih/vim-go.git"
+[".local/share/vim/pack/vendor/start/vim-go"]
+type = "archive"
+url = "https://github.com/fatih/vim-go/archive/551d423ba27915d96721c8709702edd23bc2bb48.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/vim-go".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/vim-go".checksum]
+sha256 = "18f2739a14b3b65946315e18892c6e483b00cd40aca39d3bbb9c68e31bb4c431"
 
-[".vim/pack/vendor/start/vim-polyglot"]
-type = "git-repo"
-url = "https://github.com/sheerun/vim-polyglot.git"
+[".local/share/vim/pack/vendor/start/vim-polyglot"]
+type = "archive"
+url = "https://github.com/sheerun/vim-polyglot/archive/f061eddb7cdcc614c8406847b2bfb53099832a4e.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/vim-polyglot".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/vim-polyglot".checksum]
+sha256 = "0b3408c9b230676bf9b421cde8768284a93f7d54d414085f4a539b2548835ff2"
 
-[".vim/pack/vendor/start/material.vim"]
-type = "git-repo"
-url = "https://github.com/kaicataldo/material.vim.git"
+[".local/share/vim/pack/vendor/start/material.vim"]
+type = "archive"
+url = "https://github.com/kaicataldo/material.vim/archive/32f423c825ee89a37d66e3d8f00e777c7d8a41ab.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/material.vim".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/material.vim".checksum]
+sha256 = "36b9b941837a7cd8bc02141fdc224eab310be9ebb0604f84f07280b37f234eef"
 
-[".vim/pack/vendor/start/incsearch.vim"]
-type = "git-repo"
-url = "https://github.com/haya14busa/incsearch.vim"
+[".local/share/vim/pack/vendor/start/incsearch.vim"]
+type = "archive"
+url = "https://github.com/haya14busa/incsearch.vim/archive/c83de6d1ac31d173d7c3ffee0ad61dc643ee4f08.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".vim/pack/vendor/start/incsearch.vim".pull]
-args = ["--ff-only"]
+[".local/share/vim/pack/vendor/start/incsearch.vim".checksum]
+sha256 = "3fed0c9c129754ef019e10207dc0117a78836442268c5b6e4f6b1f77244afbe8"
 
-# Zsh
-[".zsh/plugins/zsh-syntax-highlighting"]
-type = "git-repo"
-url = "https://github.com/zsh-users/zsh-syntax-highlighting.git"
+[".local/share/zsh/plugins/zsh-syntax-highlighting"]
+type = "archive"
+url = "https://github.com/zsh-users/zsh-syntax-highlighting/archive/1d85c692615a25fe2293bdd44b34c217d5d2bf04.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".zsh/plugins/zsh-syntax-highlighting".pull]
-args = ["--ff-only"]
+[".local/share/zsh/plugins/zsh-syntax-highlighting".checksum]
+sha256 = "e4a95feb737d78efa4052e23c4880e6936a3133ea58f390458fc80ea4033483e"
 
-[".zsh/plugins/zsh-completions"]
-type = "git-repo"
-url = "https://github.com/zsh-users/zsh-completions.git"
+[".local/share/zsh/plugins/zsh-completions"]
+type = "archive"
+url = "https://github.com/zsh-users/zsh-completions/archive/9903bae60284072de3fa0e3e20965f22368c5694.tar.gz"
+exact = true
+stripComponents = 1
 refreshPeriod = "0"
-[".zsh/plugins/zsh-completions".pull]
-args = ["--ff-only"]
+[".local/share/zsh/plugins/zsh-completions".checksum]
+sha256 = "c41008bb40c9ed4d3ae4df6bf25f37486e9ca870df94aff53833195bfa7dfd0e"

.gitignore

@@ -1,5 +1,6 @@
-# Populated by chezmoi git-repo externals (.chezmoiexternal.toml); do not commit clones
-/vim/
-/zsh/plugins
+# Leftover git-repo clones from before plugins moved to ~/.local/share (see .chezmoiexternal.toml)
+/vim/pack
+/zsh/plugins/zsh-completions
+/zsh/plugins/zsh-syntax-highlighting
 
 .DS_Store

README.md

@@ -4,7 +4,7 @@
 
 **Shell:** **Fish** is the intended daily driver (`~/.config/fish/` from **`dot_config/fish/`**). **Zsh** remains available (`dot_zshrc.tmpl`, `~/.zsh` symlink) for compatibility or scripts.
 
-Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are populated by **`git-repo` externals** in [`.chezmoiexternal.toml`](.chezmoiexternal.toml). External paths are **home-relative** (`.vim/…`, `.zsh/…`, `.shell/…`) so clones land behind the `~/.vim`, `~/.zsh`, and `~/.shell` symlinks into this repo.
+Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are symlinked into `$HOME`; third-party plugins are **commit-pinned `archive` externals** (SHA-256 checked) in [`.chezmoiexternal.toml`](.chezmoiexternal.toml) under **`~/.local/share/vim`** and **`~/.local/share/zsh/plugins`** (outside those symlinks so chezmoi can verify archives).
 
 ## First-time setup
 
@@ -15,7 +15,7 @@ Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are populated by **`
    chezmoi init --apply YOUR_GITHUB_USERNAME/dotfiles
    ```
 
-3. On **`chezmoi apply`**, chezmoi clones or updates externals under **`$(chezmoi source-path)`** (see `refreshPeriod` in `.chezmoiexternal.toml`; **`0`** means no periodic `git pull`—use **`chezmoi apply --refresh-externals`** when you want to update plugins).
+3. On **`chezmoi apply`**, chezmoi downloads pinned plugin archives into **`~/.local/share/…`** (`refreshPeriod = "0"` skips re-download unless forced). To bump a plugin, change its commit URL + `checksum.sha256` in `.chezmoiexternal.toml`, then run **`dfup`** (or `chezmoi apply --refresh-externals=always`). Removable leftovers from the old layout: `~/.vim/pack` and `~/.zsh/plugins/zsh-{completions,syntax-highlighting}`.
 
 4. Set Fish as the login shell (after `brew install fish` or your distro package), then:
 
@@ -30,15 +30,15 @@ Large trees (`vim/`, `zsh/`, `shell/` under the source dir) are populated by **`
 
 ```bash
 chezmoi git pull -- --ff-only
-chezmoi apply --refresh-externals
+chezmoi apply --refresh-externals=never
 ```
 
-Or your usual **`dfu`** alias if it wraps the same steps.
+Or **`dfu`** (same steps). Use **`dfup`** only when re-applying/re-downloading the pinned plugin archives.
 
 ## Layout notes
 
-- **Fish** (`dot_config/fish/`): `conf.d/` snippets (PATH from **`00-chezmoi-path.fish.tmpl`**, env, abbreviations, Catppuccin theme, vi bindings, secrets) and **`functions/`** for `dfu`, `load_secret`, `cdgr`, `up`, helpers, plus **`fish_prompt`** / **`fish_right_prompt`** (cwd + `USER at <~/.name>` + `fish_git_prompt`). Not ported from zsh: async right-prompt, `tog` / `vshow` / `vmultiline`.
-- **Vim externals** ([`.chezmoiexternal.toml`](.chezmoiexternal.toml)): [vim-polyglot](https://github.com/sheerun/vim-polyglot) for bundled syntax; [vim-go](https://github.com/fatih/vim-go) with **`g:polyglot_disabled = ['go']`** in `dot_vimrc` so Go stays on vim-go. Separate trees for [preservim/nerdtree](https://github.com/preservim/nerdtree), [lightline.vim](https://github.com/itchyny/lightline.vim), [material.vim](https://github.com/kaicataldo/material.vim), [incsearch.vim](https://github.com/haya14busa/incsearch.vim).
+- **Fish** (`dot_config/fish/`): `conf.d/` snippets (PATH from **`00-chezmoi-path.fish.tmpl`**, env, abbreviations, Catppuccin theme, vi bindings, secrets) and **`functions/`** for `dfu`, `dfup`, `load_secret`, `cdgr`, `up`, helpers, plus **`fish_prompt`** / **`fish_right_prompt`** (cwd + `USER at <~/.name>` + `fish_git_prompt`). Not ported from zsh: async right-prompt, `tog` / `vshow` / `vmultiline`.
+- **Vim externals** ([`.chezmoiexternal.toml`](.chezmoiexternal.toml), commit-pinned archives): [vim-polyglot](https://github.com/sheerun/vim-polyglot) for bundled syntax; [vim-go](https://github.com/fatih/vim-go) with **`g:polyglot_disabled = ['go']`** in `dot_vimrc` so Go stays on vim-go. Separate trees for [preservim/nerdtree](https://github.com/preservim/nerdtree), [lightline.vim](https://github.com/itchyny/lightline.vim), [material.vim](https://github.com/kaicataldo/material.vim), [incsearch.vim](https://github.com/haya14busa/incsearch.vim).
 - **`dot_zshrc.tmpl`**: main zsh init (PATH, Homebrew on macOS, shared `~/.shell` and `~/.zsh` bits). Optional **`~/.zshrc.local`** is sourced last for machine-only overrides (not in this repo).
 - **`dot_hammerspoon/`** is skipped on non-macOS via **`.chezmoiignore.tmpl`**.
 - **`dotfiles-local/`** is ignored until removed locally.

dot_config/fish/functions/dfu.fish

@@ -1,4 +1,7 @@
+# Pull and apply managed dotfiles. Does not refresh plugin archives — those are
+# commit-pinned in .chezmoiexternal.toml; use dfup after bumping pins (or to
+# force re-download of the pinned archives).
 function dfu
     chezmoi git pull -- --ff-only; or return 1
-    chezmoi apply --mode symlink --refresh-externals=always
+    chezmoi apply --mode symlink --refresh-externals=never; or return 1
 end

dot_config/fish/functions/dfup.fish

@@ -0,0 +1,5 @@
+# Re-download / re-apply plugin archives pinned in .chezmoiexternal.toml.
+# Does not float to upstream HEAD — bump commit + sha256 in that file first.
+function dfup
+    chezmoi apply --mode symlink --refresh-externals=always; or return 1
+end

dot_vimrc

@@ -1,5 +1,8 @@
 set nocompatible " not vi compatible
 
+" Chezmoi-pinned plugin packs (see .chezmoiexternal.toml) live outside the ~/.vim symlink
+set packpath^=~/.local/share/vim
+
 " Before polyglot loads: use fatih/vim-go instead of polyglot's syntax-only go pack
 let g:polyglot_disabled = ['go']
 

shell/aliases.sh

@@ -19,10 +19,16 @@ alias mv='mv -i'
 # git related aliases
 alias gag='git exec ag'
 
-# Update dotfiles (requires chezmoi init so source-path and config exist)
+# Update dotfiles (requires chezmoi init so source-path and config exist).
+# Plugin archives stay commit-pinned in .chezmoiexternal.toml; use dfup to
+# re-download those pins (bump commit + sha256 there to change versions).
 dfu() {
     chezmoi git pull -- --ff-only || return 1
-    chezmoi apply --mode symlink --refresh-externals=always
+    chezmoi apply --mode symlink --refresh-externals=never || return 1
+}
+
+dfup() {
+    chezmoi apply --mode symlink --refresh-externals=always || return 1
 }
 
 # Use pip without requiring virtualenv

zsh/plugins_after.zsh

@@ -1,8 +1,8 @@
 # External plugins (initialized after)
 
-# Syntax highlighting
+# Syntax highlighting (chezmoi-pinned archive under ~/.local/share)
 
-source ~/.zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+source ~/.local/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
 
 ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)
 

zsh/plugins_before.zsh

@@ -1,4 +1,4 @@
 # External plugins (initialized before)
 
-# zsh-completions
-fpath=(~/.zsh/plugins/zsh-completions/src $fpath)
+# zsh-completions (chezmoi-pinned archive under ~/.local/share)
+fpath=(~/.local/share/zsh/plugins/zsh-completions/src $fpath)