Install claude and opencode via bootstrap; drop nvm in favor of fnm

Cheap Savitech chip firmware stalls on rapid SET_INTERFACE / sample-rate
renegotiation, eventually dropping off the USB bus and requiring a
physical replug. Two fixes, both scoped to this exact device only:

- snd_usb_audio quirk_flags (262a:10aa): fixed_rate + ctl_msg_delay +
  iface_delay, applied via /etc/modprobe.d during bootstrap.
- WirePlumber: disable idle-suspend for the device's ALSA node so
  PipeWire doesn't repeatedly reopen the stream during normal use.

.bashrc

@@ -133,11 +133,6 @@ export RIPGREP_CONFIG_PATH="$HOME/.ripgreprc"
 export PASSBOOK_GPG_PATH="/usr/bin/gpg"
 export PASSBOOK_ROOT_DIRECTORY="/home/wholteza/.password-store"
 
-### NVM setup
-export NVM_DIR="$HOME/.nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"                   # This loads nvm
-[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion" # This loads nvm bash_completion
-
 ### Ngrok aliases
 alias ngdo='ngrok http --domain=devops-extension.ngrok.dev 3000'
 
@@ -200,16 +195,11 @@ if [[ -d /home/wholteza/.config/swayprop ]]; then
 	export PATH="/home/wholteza/.config/swayprop:$PATH"
 fi
 
-if [ -e /usr/share/nvm/init-nvm.sh ]; then
-	source /usr/share/nvm/init-nvm.sh
-fi
-
 export ompPath="$HOME/.config/oh-my-posh/theme.omp.json"
 
 ### Start oh my posh
 
 eval "$(oh-my-posh init bash --config $ompPath)"
-eval "$(fnm env --use-on-cd --shell bash)"
 if [ -d "$HOME/.cargo/env" ]; then
 	. "$HOME/.cargo/env"
 fi

.config/screenlayout/apply-screen-layout.sh

@@ -2,16 +2,16 @@
 hostname=$(cat ~/hostname)
 
 if [[ $hostname == "bepis" ]]; then
-  $(~/.config/screenlayout/desktop.sh)
+  ~/.config/screenlayout/desktop.sh
 elif [[ $hostname == "arch-bepis" ]]; then
-  $(~/.config/screenlayout/arch-bepis-desktop-sway.sh)
+  ~/.config/screenlayout/arch-bepis-desktop-sway.sh
 elif [[ $hostname == "printer" ]]; then
-  $(~/.config/screenlayout/printer.sh)
+  ~/.config/screenlayout/printer.sh
 elif [[ $hostname == "surface" ]]; then
-  $(~/.config/screenlayout/surface.sh)
+  ~/.config/screenlayout/surface.sh
 elif [[ $hostname == "bepis-laptop" ]]; then
-  $(~/.config/screenlayout/laptop.sh)
+  ~/.config/screenlayout/laptop.sh
 elif [[ $hostname == "vos" ]]; then
-  $(~/.config/screenlayout/vos.sh)
+  ~/.config/screenlayout/vos.sh
 fi
 

.config/sway/input

@@ -14,4 +14,5 @@ input "type:pointer" {
     accel_profile "flat"
     pointer_accel 0
 }
-input "*" xkb_layout colemak-se
+## Dont do this since my non-laptop keyboard have hardware colemak layout
+#input "*" xkb_layout colemak-se

.config/tmux-prefix-detect.sh

@@ -8,8 +8,8 @@ if tmux show-environment SSH_CONNECTION 2>/dev/null | grep -qv '^-' || \
     tmux unbind-key C-b 2>/dev/null
     tmux display-message "Prefix: C-a (remote)"
 else
-    tmux set -g prefix C-b
-    tmux bind-key C-b send-prefix
+    tmux set -g prefix C-t
+    tmux bind-key C-t send-prefix
     tmux unbind-key C-a 2>/dev/null
-    tmux display-message "Prefix: C-b (local)"
+    tmux display-message "Prefix: C-t (local)"
 fi

.config/wireplumber/wireplumber.conf.d/51-nuforce-no-suspend.conf

@@ -0,0 +1,23 @@
+# The NuForce uDAC (Savitech chip) has flaky firmware: when PipeWire
+# idles and then resumes its ALSA node, the device often fails the
+# resulting SET_INTERFACE / sample-rate renegotiation with a USB stall
+# (spa.alsa: set_hw_params: Broken pipe). Enough of these in a row make
+# the device drop off the USB bus and require a physical replug.
+#
+# Keeping the node's hardware stream open (no idle-suspend) avoids the
+# repeated renegotiation and stops the crashes.
+
+monitor.alsa.rules = [
+  {
+    matches = [
+      {
+        node.name = "~alsa_output.usb-Nuforce_Inc\\._NuForce_USB_Audio-.*"
+      }
+    ]
+    actions = {
+      update-props = {
+        session.suspend-timeout-seconds = 0
+      }
+    }
+  }
+]

.config/yadm/CLAUDE.md

@@ -0,0 +1,7 @@
+# Agent Instructions
+
+- Be clear and concise.
+- Never include AI attributions (e.g. "Co-Authored-By", "Generated with Claude") in commit messages.
+- This is a yadm-managed dotfiles repo rooted at `$HOME`. Always use `yadm` (not plain `git`) for version control: `yadm status`, `yadm add`, `yadm commit`, `yadm push`, etc.
+- Any change made here must be reproducible on other systems via `yadm bootstrap` — keep the bootstrap scripts (`bootstrap##*`) up to date when adding dependencies, packages, or setup steps a fresh system would need.
+- Keep `readme.md` updated when relevant, and keep it short and to the point.

.config/yadm/bootstrap##distro.arch

@@ -1,15 +1,15 @@
 #!/bin/bash
 # Installs requirements for my arch setup.
 
-set -e
+set -euo pipefail
 
-sudo pacman -Suy --noconfirm archlinux-keyring
-sudo pacman -Suy --noconfirm
+# Refresh the keyring first, then do the full upgrade against synced dbs.
+sudo pacman -Sy --noconfirm archlinux-keyring
+sudo pacman -Su --noconfirm
 
-sudo pacman -Sy --noconfirm \
+sudo pacman -S --needed --noconfirm \
   fd \
   tmux \
-  nvm \
   telegram-desktop \
   signal-desktop \
   alacritty \
@@ -23,33 +23,92 @@ sudo pacman -Sy --noconfirm \
   jq \
   bob \
   gvfs-smb \
-  pcmanfms \
-  wl-clipboard
+  pcmanfm \
+  wl-clipboard \
+  openssh \
+  mosh \
+  opencode
 
 bob install nightly
 bob use nightly
-vim --version
+nvim --version
 
-if [ ! -d /home/wholteza/repos/yay ]; then
-	cd ~
-	mkdir -p repos
-	cd repos
-        sudo pacman -S --needed git base-devel
+# --- ssh / mosh: public-key-only access --------------------------------
+sudo systemctl enable --now sshd
+
+install -d -m 700 "$HOME/.ssh"
+touch "$HOME/.ssh/authorized_keys"
+chmod 600 "$HOME/.ssh/authorized_keys"
+
+# Public keys trusted for this account (safe to publish, no private key
+# material). Snapshot of `ssh-add -L` on 2026-08-14; appended if missing,
+# never removes keys added by other means.
+ssh_authorized_keys=(
+  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQU7E/vo/+//WgeDPYX8wQudAQpx8FY2L7nv1wFCWaTrHqyUKL/ggmvtAXbkg9WqW/p6DmKbpDFNMKwKScK2OxjcxkPyQnmrmPW3SVU44RsN4R6Z0TKDSmVJ4wO35njYEfd8yKO4BDX8Q2T34lKHuBxqH/Q4Heknj4AEKB0l6xuHzfGumK4qN58qPZ6hFfPHffeOiYSh2hVWa/pRxbzD0ZDJ4eLXvUHPsQ+GVerLKv2ozVrhHOjouAQyuIFD86j8rUUnRp7keKawLUsmXvnO0IdJwi3c82j42+mUa8A3fb1glLGlax4glAhz3nw6v2NPk1V5BObCvT3zng3v6eteyEMW8E6qrUX3N9AUHABq4i8dkRKjQXL3V5dkAhTV0BzdxyBQ8/i8cWKGl2CZSPDzi37Si6RpiLboPtm3iY0mf74HbJPBUkA6YVYZEOLy0TPUkEQxkKVE/zI7GDe9CmGDRWOKm+naLSoQEr1/9xqAJlhz+HbWUkmam3MEaXXqDbY1s= wholteza_rsa"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIArtt5fhcXt2IVAmU2FWfQyrFiQmV/ym/cUM6jtpJ7CA ansible"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFFYS4L05dihHbrxX8NuPuOgAfRpMx7UJk95po5EdMQv HIT manually created id_ed25519"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxWpXrFMFtG4KlqfMZ2kYUTEZ1sMfvpNFSUlQBkaeq0 wholteza"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKIZHsSfRcBFdg1pmV5ig/zZ5ZEy9iS6GiLK7kOy0Vcu HIT zacmon001"
+)
+
+for key in "${ssh_authorized_keys[@]}"; do
+  grep -qxF "$key" "$HOME/.ssh/authorized_keys" || echo "$key" >> "$HOME/.ssh/authorized_keys"
+done
+
+# Public-key-only: no passwords, no keyboard-interactive fallback.
+# mosh's initial handshake goes through sshd, so this covers it too.
+sudo install -d -m 755 /etc/ssh/sshd_config.d
+sudo tee /etc/ssh/sshd_config.d/10-pubkey-only.conf > /dev/null <<'EOF'
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+ChallengeResponseAuthentication no
+AuthenticationMethods publickey
+EOF
+
+sudo systemctl reload sshd
+
+# --- NuForce uDAC USB audio quirks --------------------------------------
+# This DAC's firmware (262a:10aa) stalls on rapid SET_INTERFACE / sample
+# rate renegotiation, which without these quirks eventually drops the
+# device off the USB bus and requires a physical replug. Scoped to this
+# exact VID:PID so it's a no-op on any machine without the device
+# attached. Takes effect next time snd_usb_audio (re)probes the device
+# (reboot, module reload, or replug) -- not applied retroactively here.
+sudo install -d -m 755 /etc/modprobe.d
+sudo tee /etc/modprobe.d/nuforce-udac-quirks.conf > /dev/null <<'EOF'
+# fixed_rate (bit 21): device only offers one sample rate; stop the
+#   driver re-sending SET_CUR for it ("cannot set freq 48000 to ep 0x3").
+# ctl_msg_delay (bit 8): 20ms pause around each USB control message.
+# iface_delay (bit 11): 50ms pause around each SET_INTERFACE call.
+options snd_usb_audio quirk_flags=262a:10aa:0x200900
+EOF
+
+if [ ! -d "$HOME/repos/yay" ]; then
+	mkdir -p "$HOME/repos"
+	cd "$HOME/repos"
+	sudo pacman -S --needed --noconfirm git base-devel
 	git clone https://aur.archlinux.org/yay.git
 	cd yay
-	makepkg -si
+	makepkg -si --noconfirm
 fi
 
-yay -S --noconfirm \
+yay -S --needed --noconfirm \
   fnm \
   oh-my-posh \
   wezterm
 
+# --- migrate off nvm to fnm ---------------------------------------------
+if pacman -Qi nvm &>/dev/null; then
+  sudo pacman -R --noconfirm nvm
+fi
+rm -rf "$HOME/.nvm"
+
 export PATH=/home/$USER/.fnm:$PATH
 eval "$(fnm env --use-on-cd --version-file-strategy=recursive)"
 
 fnm install 24
 fnm use 24
 
-npm install
+npm install -g @anthropic-ai/claude-code
 

.tmux.conf

@@ -1,5 +1,5 @@
-set -g prefix C-b
-bind C-b send-prefix
+set -g prefix C-t
+bind C-t send-prefix
 
 set -g mouse on
 set -g base-index 1 # start windows numbering at 1wq