From db1c1f9471a6798fccb6bd2d80adced85e7cb3cc Mon Sep 17 00:00:00 2001 From: George Vaintrub Date: Sun, 31 May 2026 13:29:11 +0100 Subject: [PATCH 1/2] feat: restore direnv (env+secrets) alongside mise (tools) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverses PR #32's direnv exclusion. Studying the real infra repo (vaintrub/infra) showed a deliberate committed .envrc using direnv-1password (from_op) to inject Cloudflare/Hetzner/DO/GitHub provider tokens + OP_SERVICE_ACCOUNT_TOKEN + AWS SSO profile — which mise cannot replace (no native op://; mise hooks don't unload on cd-out) and 1Password shell plugins don't cover (they auth CLI binaries, not terraform-provider env). Removing direnv broke that repo. mise's 'don't use both' applies only when both manage the same tool; an env/secrets-only direnv is officially safe. Division: mise = tool versions, direnv = per-project env + secrets; never direnv layout/PATH_add for tools. Adds aqua:direnv/direnv to mise + direnv hook at end of dot_zshrc (after prompt + ~/.zshrc_local, per direnv docs). --- dot_config/mise/config.toml.tmpl | 8 +++++--- dot_zshrc | 7 +++++++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/dot_config/mise/config.toml.tmpl b/dot_config/mise/config.toml.tmpl index febae85..ea3b57e 100644 --- a/dot_config/mise/config.toml.tmpl +++ b/dot_config/mise/config.toml.tmpl @@ -37,6 +37,7 @@ rust = "stable" "aqua:sharkdp/fd" = "latest" "aqua:gitleaks/gitleaks" = "latest" "aqua:mikefarah/yq" = "latest" # Go yq, NOT Python +"aqua:direnv/direnv" = "latest" # per-project env+secrets (see hook in dot_zshrc) # --- Cloud + Kubernetes ------------------------------------------------- "aqua:helm/helm" = "latest" @@ -84,7 +85,8 @@ op = "latest" # Not in mise (installed elsewhere): # htop/tree/nmap/wireguard-tools/telnet/postgresql-client — OS-native (C deps) # -# direnv intentionally NOT used — mise officially discourages running both -# (PATH conflicts, "not bugs"). mise's [env] + `_.file = '.env'` in a project -# mise.toml replaces .envrc, auto-applied on cd via `mise activate`. +# Division of labour with direnv (hooked in dot_zshrc): mise owns TOOL VERSIONS, +# direnv owns per-project ENV + 1Password secrets (.envrc + from_op). Safe to +# run both — mise only conflicts with direnv when BOTH manage a tool (e.g. +# `layout python` vs python here). Never use direnv `layout`/PATH_add for tools. {{- end }} diff --git a/dot_zshrc b/dot_zshrc index 7ba719b..54e4a66 100644 --- a/dot_zshrc +++ b/dot_zshrc @@ -182,3 +182,10 @@ fi # Override the p10k prompt itself via `p10k configure` editing # `~/.p10k.zsh` directly (Powerlevel10k convention). [[ ! -f ~/.zshrc_local ]] || source ~/.zshrc_local + +# --- direnv (per-project env + 1Password secrets via .envrc) --- +# Division of labour: mise owns tool versions, direnv owns per-project env + +# secrets (e.g. `from_op` op:// refs in an .envrc). Safe alongside mise as long +# as direnv never manages tools/PATH (no `layout`/`PATH_add` for toolchains). +# Hook goes LAST (after prompt + ~/.zshrc_local) per direnv's own guidance. +command -v direnv > /dev/null && eval "$(direnv hook zsh)" From c023e3d7e74b1295b99789ebdf58a192d167489f Mon Sep 17 00:00:00 2001 From: George Vaintrub Date: Sun, 31 May 2026 13:37:56 +0100 Subject: [PATCH 2/2] =?UTF-8?q?fix(p10k):=20instant=20prompt=20quiet=20?= =?UTF-8?q?=E2=80=94=20direnv=20load=20output=20is=20benign?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit direnv prints 'direnv: loading …/.envrc' on shell start in an .envrc dir (tmux panes, SSH into a project). With instant prompt 'verbose' that benign output triggers a console-output warning every time. 'quiet' keeps instant prompt on without the false warning. Completes the direnv coexistence. --- dot_p10k.zsh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dot_p10k.zsh b/dot_p10k.zsh index 1004f79..0e2991c 100644 --- a/dot_p10k.zsh +++ b/dot_p10k.zsh @@ -1700,7 +1700,10 @@ # - verbose: Enable instant prompt and print a warning when detecting console output during # zsh initialization. Choose this if you've never tried instant prompt, haven't # seen the warning, or if you are unsure what this all means. - typeset -g POWERLEVEL9K_INSTANT_PROMPT=verbose + # 'quiet' not 'verbose': direnv prints "direnv: loading …/.envrc" on shell + # start inside an .envrc dir (common with tmux panes / SSH into a project) — + # 'verbose' flags that benign output as an instant-prompt warning every time. + typeset -g POWERLEVEL9K_INSTANT_PROMPT=quiet # Terminal shell integration. Emits OSC 133 semantic marks (prompt-start, # input-start, command/output-start, output-end + exit code) so terminals