apf_portal/docs/setup/scripts/20-zsh.sh

#!/usr/bin/env bash
# zsh + Oh My Zsh + Powerlevel10k + plugins (autosuggestions, syntax-highlighting).
# Patches ~/.zshrc to set the theme, plugin list, fzf hook.
set -euo pipefail
# shellcheck source=./lib.sh
source "$(cd "$(dirname "$0")" && pwd)/lib.sh"
require_debian
require_not_root

apt_install zsh

# Hand off to zsh from ~/.bashrc rather than `chsh -s`. The corp infra
# locks the default shell at user-provisioning time and `chsh` is denied
# (the standard PAM-level restriction). The .bashrc hand-off achieves
# the same UX without needing infra escalation, and it's compatible with
# both interactive SSH sessions and VSCode Remote-SSH's bash bootstrap.
BASHRC="$HOME/.bashrc"
[[ -f "$BASHRC" ]] || touch "$BASHRC"
MARKER='# Managed by docs/setup/scripts/20-zsh.sh — apf-portal zsh hand-off.'

if grep -qF "$MARKER" "$BASHRC"; then
  skip "zsh hand-off already in $BASHRC."
else
  cat >> "$BASHRC" <<'EOF'

# Managed by docs/setup/scripts/20-zsh.sh — apf-portal zsh hand-off.
# Hand off to zsh on interactive shells. The `case $-` guard avoids
# breaking non-interactive bash (scp, rsync, cron, …), and the
# ZSH_VERSION check prevents an infinite re-exec loop.
case $- in
  *i*)
    if command -v zsh >/dev/null 2>&1 && [ -z "${ZSH_VERSION-}" ]; then
      exec zsh -l
    fi
    ;;
esac
EOF
  ok "Patched $BASHRC to exec zsh on interactive shells."
fi

# Oh My Zsh — install with RUNZSH=no to avoid spawning zsh during the script.
OMZ_DIR="$HOME/.oh-my-zsh"
if [[ -d "$OMZ_DIR" ]]; then
  skip "Oh My Zsh already installed."
else
  log "Installing Oh My Zsh."
  RUNZSH=no CHSH=no KEEP_ZSHRC=yes sh -c \
    "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
  ok "Oh My Zsh installed."
fi

ZSH_CUSTOM_DIR="${ZSH_CUSTOM:-$OMZ_DIR/custom}"

clone_or_skip() {
  local name="$1" url="$2" dir="$3"
  if [[ -d "$dir" ]]; then
    skip "$name already cloned at $dir."
  else
    log "Cloning $name."
    git clone --depth=1 "$url" "$dir"
    ok "$name installed."
  fi
}

# Powerlevel10k theme.
clone_or_skip "Powerlevel10k" \
  "https://github.com/romkatv/powerlevel10k.git" \
  "$ZSH_CUSTOM_DIR/themes/powerlevel10k"

# Plugins.
clone_or_skip "zsh-autosuggestions" \
  "https://github.com/zsh-users/zsh-autosuggestions.git" \
  "$ZSH_CUSTOM_DIR/plugins/zsh-autosuggestions"

clone_or_skip "zsh-syntax-highlighting" \
  "https://github.com/zsh-users/zsh-syntax-highlighting.git" \
  "$ZSH_CUSTOM_DIR/plugins/zsh-syntax-highlighting"

# Patch ~/.zshrc — theme + plugin list + fzf hook.
ZSHRC="$HOME/.zshrc"
[[ -f "$ZSHRC" ]] || touch "$ZSHRC"

if grep -q '^ZSH_THEME=' "$ZSHRC"; then
  if grep -q '^ZSH_THEME="powerlevel10k/powerlevel10k"' "$ZSHRC"; then
    skip "ZSH_THEME already powerlevel10k."
  else
    sed -i 's#^ZSH_THEME=.*#ZSH_THEME="powerlevel10k/powerlevel10k"#' "$ZSHRC"
    ok "ZSH_THEME → powerlevel10k/powerlevel10k."
  fi
else
  echo 'ZSH_THEME="powerlevel10k/powerlevel10k"' >> "$ZSHRC"
  ok 'Set ZSH_THEME=powerlevel10k/powerlevel10k.'
fi

PLUGINS_LINE='plugins=(git fzf zoxide direnv zsh-autosuggestions zsh-syntax-highlighting)'
if grep -q '^plugins=' "$ZSHRC"; then
  if grep -q "^$PLUGINS_LINE" "$ZSHRC"; then
    skip "plugins=(...) already configured."
  else
    sed -i "s#^plugins=.*#$PLUGINS_LINE#" "$ZSHRC"
    ok "plugins=(...) updated."
  fi
else
  echo "$PLUGINS_LINE" >> "$ZSHRC"
  ok "plugins=(...) added."
fi

ensure_line '[ -f ~/.fzf.zsh ] && source ~/.fzf.zsh' "$ZSHRC"

ok "zsh + Oh My Zsh + Powerlevel10k ready."
log "Next: run 'exec zsh -l' then 'p10k configure' to pick a Powerlevel10k preset."