Executed for every bash session (interactive and non-interactive). The file is organized into two phases: environment setup (always) and interactive setup (gated).

The internal variable __INTERACTIVE (yes or empty) gates interactive-only setup. Non-interactive shells (e.g., ssh host some-command) get PATH, exports, and aliases but skip completions, tool initialization, keybindings, and fastfetch. VISUAL is exported as micro independently.

• Color prompt enabled for xterm-color, xterm-256color, screen-256color
• Uses bash-git-prompt (via brew) with Single_line theme
• xterm title set to user@host: dir

Brew shell environment is initialized early. On Linux it uses the standard /home/linuxbrew/.linuxbrew path; on macOS it checks /opt/homebrew (Apple Silicon) then /usr/local (Intel).

PATH is deduplicated at the end of .bashrc using a bash function _dedup_path() that also ensures the nvm path comes first.

On Linux, ssh-agent runs as a systemd user service at ~/.config/systemd/user/ssh-agent.service. The service binds the well-known path %t/ssh-agent.socket (%t = $XDG_RUNTIME_DIR) via ExecStart=/usr/bin/ssh-agent -D -a %t/ssh-agent.socket and publishes SSH_AUTH_SOCK into the systemd user environment via ExecStartPost=systemctl --user set-environment.

ssh-agent has no LISTEN_FDS support, so a separate .socket unit would be a dead listener on OpenSSH <10 — every client would hang. (OpenSSH 10.0p2+ added a fallback that reads $SSH_AUTH_SOCK from the service's environment, but the explicit -a works on every version.) The service also overrides distro-shipped /usr/lib/systemd/user/ssh-agent.{service,socket} — notably Ubuntu 25.10's units listening at %t/openssh_agent — unifying the whole fleet on one socket path.

For shells that don't inherit the systemd user environment (e.g. ssh host bash non-interactive), .bashrc defensively exports SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/ssh-agent.socket when XDG_RUNTIME_DIR is set.

One agent per user login, shared by every shell. No eval "$(ssh-agent)" in .bashrc, no orphaned agent processes. ~/.ssh/config sets AddKeysToAgent yes globally, so the first time ssh uses a key it's auto-added to the agent — no explicit ssh-add needed. Keys persist until logout or systemctl --user restart ssh-agent.

On macOS the Keychain-integrated launchd agent handles this — the systemd unit is excluded via .chezmoiignore on non-Linux. On Linux hosts without a user systemd manager (rare: bare containers), the installer script skips gracefully and SSH still works manually.

See Setting Up a New Machine § After setup: what's running for the full list of services.

fzf is a general-purpose fuzzy finder, wired into bash so that common operations become a fuzzy-pick instead of a typed path or a half-remembered command.

Default key bindings (shipped by fzf's key-bindings.bash):

Beyond the key bindings, fzf powers:

• Per-command completions for directory/path/host arguments on common commands (see fzf completions below) — trigger with Tab after the trigger sequence **.
• fzf-git.sh key bindings (branches, tags, remotes, stashes, PRs) if the script is present at ~/.local/vendors/fzf-git.sh.
• pick — the interactive command reference uses fzf to browse and execute curated commands by topic.
• pet — snippet manager search (Ctrl+x Ctrl+r).

When fzf is available, custom completions are registered:

Also sources fzf-git.sh from ~/.local/vendors/ if available.

On interactive terminals (not inside Windsurf), fastfetch is shown at shell level 1 (direct terminal) or level 2 inside tmux.

If ~/.env exists, its contents are exported via set -a / . ~/.env / set +a.

Shape. ~/.env is a plain KEY=value file, one variable per line, sourced by bash. No export keyword needed (set -a handles it). Comments start with #. Values containing spaces or special characters should be quoted. Example:

# ~/.env — per-machine environment, not tracked in the dotfiles repo
# Secrets and per-machine overrides. Non-secret values chezmoi already knows
# (e.g. GITHUB_USERNAME) are rendered into .bashrc directly.

EXAMPLE_API_URL=http://localhost:8080
EXAMPLE_API_TOKEN=...

# Optional — override the default JOT_AWS_S3_BUCKET (defaults to
# ${GITHUB_USERNAME}-notes if GITHUB_USERNAME is set)
# JOT_AWS_S3_BUCKET=my-custom-bucket

Why ~/.env and not a template. Secrets and per-machine values stay outside the chezmoi-managed tree. This keeps credentials out of git and makes a machine's setup easy to diverge from the default.

What's not needed in ~/.env. Non-secret values chezmoi already collected at chezmoi init — currently GITHUB_USERNAME — are rendered into .bashrc by chezmoi. You can still put GITHUB_USERNAME=... in ~/.env as an override, but nothing breaks if you don't.

Tools like jot, vault, and other skills document their own required variables; add them to ~/.env as you adopt each tool.

Propagating ~/.env to other machines. It's user-managed, so copy it deliberately — playbash put ~/.env host: (or the planned jot bundle flow) rather than checking it into the repo.

GITHUB_USERNAME is collected once by chezmoi: during chezmoi init it prompts for the githubUsername data value (default uhop, overridable from a GITHUB_USERNAME env var set when running chezmoi init). From there it flows in two places:

• .bashrc (via dot_bashrc.tmpl): chezmoi renders export GITHUB_USERNAME=<value> near the top of the exports block, before ~/.env is sourced — so ~/.env can override if a machine needs a different identity.
• Chezmoi run-scripts and templates (via [scriptEnv] in .chezmoi.toml.tmpl): used by private_dot_ssh/create_private_authorized_keys.tmpl to pull GitHub-registered SSH keys, and by any other chezmoi-managed scripts that need it.

JOT_AWS_S3_BUCKET is derived as ${GITHUB_USERNAME}-notes only when (a) it's not already set and (b) GITHUB_USERNAME is non-empty. That means users without a GitHub identity get no bogus -notes bucket, and anyone wanting a custom bucket can just set JOT_AWS_S3_BUCKET=my-bucket in ~/.env. If jot runs with neither set, it prints a warning explaining the relationship and exits.

Sourced by .bashrc unconditionally (available to both interactive and non-interactive shells). Contains aliases, functions, and safety nets grouped by category.

Git alias completions are declared in .bash_aliases via the __git_alias_completions associative array (maps alias name to git subcommand), then wired up by .bashrc in the interactive block after bash-completion is loaded.

If doas is installed and configured (/etc/doas.conf exists), sudo is aliased to doas.

l. — function that lists dotfiles only: l. [dir]

up N — go up N directories: up 3 = cd ../../../

zl [dir] — z into a directory and list it.

mkz / mkcd — create directory and z into it.

zpush / zp — pushd that matches a keyword the way z does: zp proj pushes the directory z proj would go to. pushd's own arguments (-n, +N, -N, -) and an existing directory go to pushd as they are, so zp +2 rotates the stack and zp -n proj adds proj without going there. A directory is in the stack once: when it is already there, zp moves that entry to the top, so zpop still takes you back to where you were.

zpop — popd.

zdirs — the directory stack in fzf, numbered as dirs -v numbers it, with the keys in a one-line legend. Typing filters the list. Enter moves the picked directory to the top and goes there, as zp does. Ctrl-R rotates the stack to it instead (pushd +N). Ctrl-D drops it from the stack (the current directory stays) and reopens the list. Del drops it too, and so does Backspace when the filter is empty. On a Mac keyboard, the key labeled Delete is Backspace, and Fn+Delete is Del. Esc closes it. With any option or argument it is plain dirs.

Available when rsync is installed:

Shortcuts that wrap git commands with colored output via echoRun:

where "pattern" [path/wildcard] — recursive grep with glob support, e.g., where "TODO" "src/*.js". Uses noGlob to prevent shell expansion.

upfind [args] — run find in current directory and each parent up to /. Use -h flag to stop at $HOME.

upfd [args] — same as upfind but uses fd instead of find.

upsearch pattern — shortcut for upfd -gH pattern (glob, hidden files).

nowrap [start] [-end] — pipe filter to truncate output to terminal width. Positive arg sets start column, negative sets offset from right edge.

Default session name is ssh_tmux.

Both files are identical: they conditionally source .bashrc only when $BASH_VERSION is set.

• .bash_profile — sourced by bash login shells. Sources .bashrc to get the full interactive environment.
• .profile — sourced by non-bash login shells (bash prefers .bash_profile). Also sources .bashrc when running under bash.