feat: 2.0.0

.gitignore

@@ -9,6 +9,9 @@ bin/t0filer
 bin/ollama
 bin/forex
 bin/presentvalue
+bin/jail-mcp
+bin/jailmcphttp
 dotfiles/**/.uuid
 **/.DS_Store
-dotfiles/.config/jj/repos/*
+dotfiles/.config/jj/repos/*
+.cspell.config.yml

.tool-versions

@@ -0,0 +1,2 @@
+golang 1.26.1
+nodejs 25.8.1

bin/download-youtube-id

@@ -91,7 +91,7 @@ download() {
 
   # downloading big videos can max out /tmp
   # ejs:github related to automated captcha challenges using deno
-  if ! yt-dlp -f "$format_id" "$vid_id" --output "${prefix}%(title)s-%(release_date)s.%(ext)s" --remote-components ejs:github --paths "temp:/plex/tmp"; then
+  if ! yt-dlp -f "$format_id" --output "${prefix}%(title)s-%(release_date)s.%(ext)s" --remote-components ejs:github --paths "temp:/plex/tmp" -- "$vid_id"; then
     fatal "$LINENO" "yt-dlp error"
   fi
 }
@@ -187,7 +187,7 @@ validate_input
 validate_plex_perms
 prepare_temp
 
-yt-dlp "$vid_id" --list-formats --remote-components ejs:github --paths "temp:/plex/tmp"
+yt-dlp --list-formats --remote-components ejs:github --paths "temp:/plex/tmp" -- "$vid_id"
 
 prompt_audio_format
 prompt_video_format

bin/lazy-git

@@ -85,6 +85,7 @@ commit() {
     fatal $LINENO "usage: lg <type> <scope> <commit subject>"
   fi
 
+  subject="${subject,}"
   local commit_msg="$type($scope): $subject"
   if [[ "$scope" =~ ^.$ ]]; then
     commit_msg="$type: $subject"

bin/lazy-jujutsu

@@ -56,6 +56,7 @@ commit() {
     fatal $LINENO "usage: lg <type> <scope> <commit subject>"
   fi
 
+  subject="${subject,}"
   local commit_msg="$type($scope): $subject"
 
   if [[ "$scope" =~ ^.$ ]]; then

bin/ollama-unload

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# Check if Ollama is running by attempting to hit the API
+if ! curl -s http://localhost:11434/api/ps >/dev/null 2>&1; then
+  echo "INFO: Ollama is not running." >&2
+  exit 1
+fi
+
+# Fetch the list of loaded models via the API
+models=$(curl -s http://localhost:11434/api/ps | jq -r '.models[].name')
+
+if [ -z "$models" ]; then
+  echo "INFO: No models currently loaded in Ollama." >&2
+  exit 0
+fi
+
+for model in $models; do
+  echo "INFO: Unloading $model..." >&2
+  # Using an empty prompt to trigger the unload via the generate endpoint
+  curl -s -X POST http://localhost:11434/api/generate \
+    -d "{\"model\": \"$model\", \"prompt\": \"\", \"keep_alive\": 0}" >/dev/null
+done
+
+# Give the Ollama process and the GPU driver a few seconds to actually
+# finish the memory release before the system proceeds to sleep.
+echo "INFO: Waiting for models to release VRAM..." >&2
+sleep 3
+
+echo "INFO: All loaded models have been signaled to unload and settling period complete." >&2

bin/system-up

@@ -213,6 +213,7 @@ mise_install_globals() {
   mise use --global go@latest
   mise use --global yarn@1.22.22
   mise use --global npm@latest
+  mise use --global uv@latest
 
   # reinstall missing npm globals
   local packages=(cspell@latest prettier@latest @commitlint/cli@latest @commitlint/config-conventional@latest)
@@ -222,6 +223,12 @@ mise_install_globals() {
   done
 }
 
+# Mise configuration file is sim linked into its /root.
+# Install packages globally for root.
+mise_root_update() {
+  sudo mise install
+}
+
 cleanup_packages() {
   # 19GB of build dependencies of llama.cpp
   yay --remove --recursive --recursive rocm-hip-sdk
@@ -238,6 +245,7 @@ btrfs_check Data2TB Data4TB
 pg_update=$(postgres_up)
 
 mise_install_globals
+mise_root_update
 system_up
 services start postgresql
 refresh_collations

doc/etc.md

@@ -1,8 +1,12 @@
 # etc/ — System Configuration
 
 Files here are symlinked (or hardlinked for `fstab`) into `/etc`. Requires root for install.
-Note: all `/etc` symlinks resolve through `/home/vacation/` — root must be able to traverse it. Ensure `chmod o+x /home/vacation` is set, otherwise systemd and other root processes silently fail to read unit files and configs at boot.
+Note: all `/etc` symlinks resolve through `/home/vacation/` — root must be able to traverse it.
+Ensure `chmod o+x /home/vacation` is set, otherwise systemd and other root processes silently fail to read unit files and configs at boot.
 Note: `/etc/fstab` must be a **hardlink**, not a symlink — the kernel reads it before symlinks resolve.
+Note: due to how the system mounts partitions at boot, and how /home/vacation is its own btrfs subvolume mount, files in etc/ might be unavailable at boot, leading to weird bugs.
+The proposed solution for this is to use an install script that copies files to /etc with correct ownership and permissions.
+Git hook into pull and commit, maintain hashes of all files, maybe adjacent to the files themselves but gitignored, and determine if file needs to be reinstalled.
 
 ## Filesystem & Boot
 

doc/install.md

@@ -1,16 +1,17 @@
 # install — Dotfiles Install Program
 
-A `go run`-able install program at `src/install/`. Replaces t0filer for the `interface` repo.
+A `go run`-able install program at `src/install/`.
+Replaces t0filer for the `interface` repo.
 Processes `install.rc` and applies file operations to the system.
 
 ## Usage
 
 ```bash
-go run ./src/install                        # dry run (default, no changes)
-go run ./src/install -c                     # commit changes
-sudo go run ./src/install -c               # commit changes as root
-go run ./src/install -config path/to/rc    # use a specific config file (default: install.rc)
-go run ./src/install -v                    # print version
+go run ./src/install -commit              # commit changes
+go run ./src/install                      # dry run (default, no changes)
+sudo go run ./src/install -commit         # commit changes as root
+go run ./src/install -config path/to/rc   # use a specific config file (default: install.rc)
+go run ./src/install -v                   # print version
 ```
 
 ## Config file — `install.rc`
@@ -35,17 +36,17 @@ Blank lines are ignored. Lines starting with `#` are comments and are ignored.
 
 ### Actions
 
-| Action    | Args                       | Description                                              |
-| --------- | -------------------------- | -------------------------------------------------------- |
-| `check`   | `binary install-cmd`/line  | Verify binary exists; collect all failures, abort at end |
-| `assert`  | command and hint in pairs  | Run a shell command; collect all failures, abort at end  |
-| `message` | free text, multi-line      | Print a block of text to the user                        |
-| `mkdir`   | one path/line              | Create directory and parents if it does not exist        |
-| `link`    | path pairs                 | Create symlink; source first, link target second         |
-| `copy`    | path pairs                 | Copy file; skipped if target exists and checksums match  |
-| `enable`  | one unit/line              | `systemctl enable --now <unit>`                          |
-| `chmod`   | `mode path`/line           | Apply permission mode to path                            |
-| `reload`  | none                       | `systemctl daemon-reload`                                |
+| Action    | Args                      | Description                                              |
+| --------- | ------------------------- | -------------------------------------------------------- |
+| `check`   | `binary install-cmd`/line | Verify binary exists; collect all failures, abort at end |
+| `assert`  | command and hint in pairs | Run a shell command; collect all failures, abort at end  |
+| `message` | free text, multi-line     | Print a block of text to the user                        |
+| `mkdir`   | one path/line             | Create directory and parents if it does not exist        |
+| `link`    | path pairs                | Create symlink; source first, link target second         |
+| `copy`    | path pairs                | Copy file; skipped if target exists and checksums match  |
+| `enable`  | one unit/line             | `systemctl enable --now <unit>`                          |
+| `chmod`   | `mode path`/line          | Apply permission mode to path                            |
+| `reload`  | none                      | `systemctl daemon-reload`                                |
 
 `$HOME` in paths is expanded to the current user home directory.
 `enable`, `chmod`, and `reload` are Linux-only and implicitly skipped on other systems.
@@ -67,6 +68,7 @@ golangci-lint see https://golangci-lint.run/welcome/install
 ```
 
 Output on failure:
+
 ```
 check: missing binaries
   git           pacman -S git
@@ -178,15 +180,17 @@ in both dry run and commit modes. If validation finds errors, the program exits
 touching anything. This surfaces all problems upfront rather than failing halfway through.
 
 Validation checks:
+
 - Source file exists
 - Target parent directory exists (or will be created via `mkdir`)
-- For `link`: if target exists, verify it already points to the correct source
+- For `link`: if target exists, verify it is a link and already points to the correct source
 - For `copy`: if target exists, checksum both files; identical = already done
 - For `assert`: line count is even
 
 ### Idempotent
 
 Re-running is safe. Each operation detects its already-complete state and skips:
+
 - `link`: target is already a symlink to the correct source → skip
 - `copy`: target exists and checksums match → skip
 - `mkdir`: directory already exists → skip
@@ -196,6 +200,8 @@ Re-running is safe. Each operation detects its already-complete state and skips:
 ### Broken link cleanup
 
 Before linking, any broken symlink at the target path is removed. A warning is printed.
+If a regular file occupies the path of the link, error
+if a link exists, it must point to the correct target, if not remove and re-create.
 
 ### Directory creation
 
@@ -207,6 +213,13 @@ If a target parent directory does not exist, it is created. A warning is printed
 If an unexpected error occurs during commit (after validation passed), the program exits
 immediately. The next run skips already-completed operations and picks up where it left off.
 
+### etc/
+
+Because of complex boot time filesystem mounting order, and the current layout of /home/vacation as a sub volume, etc/ files should be copied not linked, by user root.
+
+### git hooks
+
+Hooks for commit and pull should re-run install to verify targets of copy and link are still accurate with new source files.
 
 ## Testing
 
@@ -289,6 +302,7 @@ This should not print on Linux.
 ```
 
 Expected outcomes to verify manually:
+
 - Warning printed for missing user declaration at top
 - `check` fails listing the missing binary with its hint, does not abort before checking all
 - `assert` fails listing the failing assertion with its hint, does not abort before checking all
@@ -337,4 +351,4 @@ src/install/
 
 ## todo once completed and tested
 
-delete t0filer, migrate config files
+delete t0filer, migrate config files

doc/prompts/chat-work-session-jail.md

@@ -0,0 +1,24 @@
+Call the jail MCP context tool at the start of each session to orient yourself.
+Then run the setup tool on the project path to prepare the environment.
+Use exec_sync for most file tasks (cat, find, grep, sed). This is the only way to interact with project files.
+Use exec_background for slow commands; poll with the status tool. You can do other work while waiting.
+  - Go projects may have private dependencies — run bin/setup, not just go mod download.
+Start by reading AGENTS.md at the project root, then look for docs in .md files under doc/.
+Projects named foo-1, foo-2 are git worktrees of foo — same codebase, different branch.
+
+Editing files in /projects/ via jail:
+- str_replace cannot reach volume-mounted paths. Use Python via exec_sync instead.
+- Always use a quoted heredoc (<< 'PYEOF') to prevent bash from interpreting backticks, $variables, or special characters inside the Python code.
+- Prefer two small targeted replaces over one large multi-line block match — large blocks are brittle.
+
+python3 << 'PYEOF'
+with open('/projects/server/path/to/file', 'r') as f:
+    content = f.read()
+content = content.replace('old', 'new')
+with open('/projects/server/path/to/file', 'w') as f:
+    f.write(content)
+print('ok')
+PYEOF
+
+project:
+task:

doc/prompts/claude-code.md

@@ -0,0 +1,3 @@
+read AGENTS.md at the root first, if it doesn't exist, mention this to user.
+search for project docs in .md files under doc/, fast way to discover the codebase.
+note that PR titles must be conventional commits.

doc/prompts/code-reviewer.md

@@ -0,0 +1,5 @@
+You are a code review agent providing code review for another agent.
+You will receive the code or the plan they are interested in implementing and any context necessary.
+Provide code review optimized for an agent, not a human.
+Ask questions if necessary and be critical.
+Above all, provide a good review!

doc/prompts/sql-work-jail.md

@@ -0,0 +1,33 @@
+Let's work with postgreSQL and queries.
+Call the jail MCP context tool at the start of each session to orient yourself.
+You should have direct access to the database using the postgres MCP tool.
+
+Database documentation should be under /projects/\*/doc/db.
+If there is no documentation, offer to build one.
+
+- README.md — full table index with descriptions
+- public.<table>.md — per-table columns, indexes, constraints, and FK relations
+
+Before writing a query, read the relevant table docs if you're unsure of column names or relationships.
+Prefer read-only queries (SELECT), mutate data only if asked explicitly.
+
+## Modes
+
+user can turn modes on and off.
+at the beginning of the session inform which modes exist and which are ON.
+
+Mirror mode: After running a query, display the query to the user.
+Output mode: After running a query, display raw query output to the user, after any output from mirror mode.
+Summary mode: After running a query, produce a concise, information-rich natural language summary of the results.
+Prioritize operationally relevant fields (dates, names, types, statuses, modalities).
+Omit raw IDs, redundant nulls, and column noise.
+Example: "Jan 9, 2026 · 1:00–1:40 PM UTC · Virtual — Obat For All (60 min) with Melissa Gorrin, RN · not cancelled, not group therapy."
+
+summary mode: default ON.
+mirror mode: default ON.
+output mode: default OFF.
+
+## Instructions
+
+project:
+task:

dotfiles/.aliases.sh

@@ -246,6 +246,7 @@ alias jn="jj new"
 alias jsq="jj squash -m"
 alias jre="jj resolve"
 alias jbf="jj bookmark forget"
+alias jd="jj diff"
 
 # general
 alias la='ls -A'

dotfiles/.bash_env

@@ -4,7 +4,7 @@
 # BASH_ENV must be set to this script in bash config files
 
 # envs
-export GOPRIVATE="github.com/eleanorhealth/\* github.com/tcodes0/\*"
+export GOPRIVATE="github.com/eleanorhealth/* github.com/tcodes0/*"
 export T0_COLOR=true
 
 # shellcheck source=lib.sh

dotfiles/.bashrc

@@ -9,7 +9,7 @@ src() {
   local path=$1 fileLine=$2
 
   # shellcheck disable=SC1090
-  if ! source "$path" 2>/dev/null; then
+  if ! source "$path"; then
     echo "$fileLine" source "$path": not found
   fi
 }
@@ -20,7 +20,7 @@ src_dotfile() {
 }
 
 export DOTFILES="$HOME/Desktop/interface/dotfiles"
-export GOPRIVATE="github.com/eleanorhealth/\* github.com/tcodes0/\*"
+export GOPRIVATE="github.com/eleanorhealth/* github.com/tcodes0/*"
 export BASH_ENV="$HOME/.bash_env"
 export CMD_COLOR=true
 export T0_COLOR=true
@@ -41,7 +41,7 @@ export GPG_TTY=$(tty)
 export XDG_RUNTIME_DIR
 export WAYLAND_DISPLAY
 # see lazy-git
-export PUSH_REPOS="member-client go-common interface priv hub-client server server-1 server-2 server-3 server-4 member-server shared go-athenahealth scheduling jail-mcp comms programming-problems"
+export PUSH_REPOS="member-client go-common interface priv hub-client server server-1 member-server shared go-athenahealth scheduling jail-mcp comms programming-problems online-start go compose-files"
 
 # libs
 src_dotfile "lib.sh" "$LINENO"
@@ -88,7 +88,7 @@ if macos; then
   src_dotfile ".bashrc.mac.sh" "$LINENO"
   src_dotfile ".aliases.mac.sh" "$LINENO"
   src_dotfile ".functions.mac.sh" "$LINENO"
-  src /opt/homebrew/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/path.bash.inc "$DOTFILES/.bashrc:$LINENO"
+  src /opt/homebrew/Caskroom/gcloud-cli/latest/google-cloud-sdk/path.bash.inc "$DOTFILES/.bashrc:$LINENO"
 else
   src_dotfile ".bashrc.linux.sh" "$LINENO"
   src_dotfile ".aliases.linux.sh" "$LINENO"

dotfiles/.bashrc.mac.sh

@@ -8,7 +8,7 @@
 if [ ! "$(pgrep ssh-agent)" ]; then
   eval "$(ssh-agent)" >/dev/null
 elif [[ ! "$SSH_AUTH_SOCK" =~ $(pgrep ssh-agent) ]]; then
-  SSH_AUTH_SOCK=$(find /var/folders -name 'agent.*' 2>/dev/null)
+  SSH_AUTH_SOCK=$(find /var/folders -name 'agent.*' 2>/dev/null | head -1)
 fi
 
 export GOPATH=$HOME/go
@@ -18,6 +18,7 @@ export GOBIN=$HOME/go/bin
 export PATH="\
 $HOME/.local/share/mise/shims:\
 $HOME/bin:\
+$HOME/.local/bin:\
 /opt/homebrew/bin:\
 /opt/homebrew/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/bin:\
 /Applications/Docker.app/Contents/Resources/bin:\