zsh · macOS · Apple Silicon · Homebrew

a settings file for a terminal

BrotherEye.

A network scanner. A nine-stage OSINT sweep. A DNS checker that queries thirty resolvers at once. An AI client built out of curl and jq. All of it is a shell config.

The rail on the left is that file, drawn to scale. Twenty-five sections at their real lengths, every comment as a mark, every function as a tick. Nothing on this page is typed in: the figures are parsed out of the config when the site builds, so they cannot drift away from it.

A network mapper. A research tool that profiles any website. A checker that asks thirty servers at once. An AI assistant. All of it lives in the file that sets up a terminal window.

That file usually picks a colour and a few shortcuts and gets out of the way. This one does not. The rail on the left is it at true scale, and every figure here is read out of the file rather than typed.

the plain version is a summary, about half the length

code
1,96363%
comment
65721%
withheld
1384%
blank
38112%
ratio
25% comments over 2,620 non-blank

A third of the file is explanation rather than instruction: it exists to say why the rest does what it does.

Section 19 is withheld: 138 lines are redacted in the published copy, so they are drawn as a gap rather than counted as anything. Every figure here therefore describes the 3,001 lines you can actually see. The whole file is 3,139 lines and 25 sections.

What it actually does

None of this belongs in a dotfile

Most shell configs set a prompt and some aliases. This one contains a network reconnaissance suite, an OSINT tool, a DNS propagation checker and an AI client, written in zsh, with no framework, no plugin manager and no SDK under any of it. The four with a control on them below are runnable from here.

what it actually does

None of this belongs in a settings file

Most of these files set a colour and a few shortcuts. This one carries a network scanner, a research tool, a domain checker and an AI assistant, written in the terminal’s own language with nothing installed to help.

nightwing52,000 vendor prefixes · offline

A LAN scanner, written in zsh

Sweeps every host on the subnet in parallel, then reads the kernel’s own ARP cache rather than the ping replies, so the camera that silently drops ICMP still shows up, because the kernel had to resolve its MAC before it could send. Vendors resolve offline against nmap’s IEEE database. It infers what each device actually is from its open ports, keys your labels to the MAC so they survive a DHCP move, and flags anything it has not seen before. No sudo. Nothing about your network leaves the machine.

It maps every device on your network

It pings everything, then asks the machine what it already learned while trying, which catches devices built to ignore pings. No admin password, and nothing sent anywhere.

intelone domain in, a dossier out

A nine-stage OSINT sweep

WHOIS and ownership, DNS by record type, SPF and DMARC posture with a warning when either is missing, the TLS certificate and every SAN on it, subdomain enumeration through certificate transparency, geo and ASN, reverse-IP co-hosting, an HTTP fingerprint pulled from the response headers, and the open port surface.

It researches a website and hands back a dossier

Nine steps in a deliberate order: who owns it, where it points, whether it is protected against forged email, its certificate, and which doors are open.

watchtower30 resolvers, in parallel

DNS propagation across 30 resolvers at once

Every query fires simultaneously against thirty globally distributed resolvers. Each answer is validated against the shape its record type is supposed to have, so a dig error banner can never be mistaken for data. Then it reports consensus, or tells you the resolvers disagree, which is how you catch a split horizon.

It asks thirty servers the same question at once

A change to where a domain points spreads unevenly, so different parts of the world disagree for a while. Thirty answers side by side is the only way to see that.

brothereyecurl · jq · a braille spinner

An AI assistant with no SDK under it

A DeepSeek client assembled from curl and jq: the request is built with jq so arbitrary text quotes safely, curl runs in the background so a spinner can animate against its PID, and the response goes through a parser that repairs the raw control characters the API sometimes emits inside JSON strings. The bearer token is never in the file.

It talks to an AI, with nothing installed to help it

An assistant built from two ordinary command-line tools and nothing else, asking in the background so a spinner can run while it waits. Its password is kept outside the file.

mantlegated on zsh -n

A config that installs itself, carefully

Promotes the working copy over ~/.zshrc, but syntax-checks the source first, because a broken zshrc breaks every shell you would open to repair it, including that one. Backs up before writing, keeps the last ten, and walks any of them back with --revert.

It installs itself, carefully

A broken settings file breaks every terminal you open afterwards, including the one you would fix it in. So it checks before writing, and keeps the last ten versions.

The prompt · section 2, lines 186–274

The frame is the status light

Two lines: a bracket, a seeker reticle, a caret. What makes it worth explaining is what happens on success: nothing. No colour escape is emitted at all, so the prompt inherits whatever foreground your terminal already uses instead of fighting it. Only failure paints the frame red.

the prompt

The interesting part is what it does when nothing is wrong

The prompt is the marker shown before everything you type. When a command succeeds, this one emits no colour instruction at all, so it inherits whatever colour your terminal already uses instead of arguing with it. Only failure paints it red.

PROMPT='%(?..%F{red})╭╴ ${_BE_SEEK} %f%B${_be_path}%b
%(?..%F{red})╰╴❯%f '
previous command succeeded
emits no colour escape at all. inherits your terminal theme instead of overriding it
previous command failed
emits %F{red}. the frame itself becomes the status light

Run something that fails and watch the frame.

Run something that fails and watch the frame turn red.

zsh · targeting hud
╭╴~/Projects/neovolt
╰╴❯

Exit 0. No colour escape is emitted, so the frame is your terminal's own foreground.

The sweep · section 11, lines 1358–1547

Nine stages, one domain

The stages are ordered, and the order is the design: ownership before DNS, DNS before the certificate, the certificate before the subdomains it leaks. Stage 03 is the one worth watching, because it reports an absence. A domain with no DMARC record does not produce an empty line, it produces a finding.

the research sweep

Nine steps, in a deliberate order

The order is the design: who owns it before where it points, because each answer narrows the next question. The third step is the interesting one, because it reports something missing rather than something present.

Advance the sweep a stage at a time.

Step through the sweep one stage at a time.

intel example.com · sample
❯ intel example.com

Nine stages, in order. Advance them one at a time.

Stage 1 of 9: WHOIS and ownership.

The resolvers · section 18, lines 1794–2012

Thirty answers, because one can lie to you

A single dig asks one resolver, so a split horizon looks exactly like a normal answer. Thirty answers side by side is the only arrangement in which the disagreement is visible at all. Every response is validated against the shape its record type should have, so a resolver returning an error banner can never be counted as data.

the domain checker

Thirty answers, because one can lie to you

Ask one server and you get one answer, which looks equally convincing whether or not it is what everyone else is seeing. Thirty side by side is the only arrangement in which a disagreement is visible at all.

Fire the query, then switch to the split case.

Fire the query, then switch to the case where the answers disagree.

watchtower example.com A · sample
❯ watchtower example.com A
Google· · ·
Google 2· · ·
Cloudflare· · ·
Cloudflare 2· · ·
Quad9· · ·
Quad9 2· · ·
OpenDNS· · ·
OpenDNS 2· · ·
AdGuard· · ·
AdGuard 2· · ·
Level3· · ·
Verisign· · ·
Comodo· · ·
Neustar· · ·
Hurricane· · ·
Dyn· · ·
Yandex· · ·
DNS.WATCH· · ·
FreeDNS· · ·
OpenNIC· · ·
CIRA· · ·
SafeDNS· · ·
Alternate· · ·
UncensoredDNS· · ·
Digitale· · ·
CZ.NIC· · ·
Applied· · ·
Fourth Estate· · ·
Nawala· · ·
CNNIC· · ·

Fire the query, then switch the case to see what one resolver would have hidden.

The scan · section 23, lines 2556–3075, 520 of them

Map every device on the network. No sudo, no cloud lookup.

The largest single function in the file, and the one whose trick is worth the most. It never asks for elevated privileges and nothing about your network leaves the machine. Step 02 is where it earns its keep: the table stops reporting what answered and starts reporting what the kernel had to resolve.

the network scan

Map every device on the network, with no admin password

Pinging finds most things, but not the devices built to ignore it, which is most cameras and printers. So it asks the machine what it already learned while trying: to send anything at all, it had to identify each neighbour first.

Step the sweep. Watch the table at step 02.

nightwing 10.0.0.0/24 · sample
❯ nightwing

Five steps. Watch what appears at step 02.

Step through the sweep.

  • A /16 is 65,000 pings, so anything wider than a /22 is clamped to the local /24.
  • The locally-administered bit marks a privacy-randomised MAC, reported as such rather than as a bogus vendor.
  • Broadcast and multicast entries are wiring, not devices, and are filtered out.
  • On a narrow terminal the MAC column is dropped first, because it carries the least meaning per column and is still in both exports.

The utility belt

the utility belt

54 commands, 13 compartments

Every command it adds, in one list

Running belt prints this manifest to the terminal. The config documents itself, because a shell with this many additions is useless if you cannot remember what you gave it.

Typing one word prints this list into the terminal. A file that adds this many commands is useless if you cannot remember them, so it documents itself. Drag sideways to read across.

01

AI uplink

1 cmd
  • brothereye | oracle <q>tactical AI assistant (DeepSeek)
02

Recon & OSINT

2 cmd
  • intel <domain>WHOIS / DNS / TLS / subdomains / ports
  • watchtower | dnscheck <dom> [t]30-resolver DNS propagation sweep
03

Network

9 cmd
  • gcpdestablished TCP connections
  • perimeterlistening ports + firewall state
  • scanprocesses listening on TCP ports
  • sniffraw packet capture on en0 (sudo)
  • nightwing | lanscan [-p][-r]map every device on the LAN
  • killport <port>free a held TCP port (confirm)
  • serve [port] [dir]static HTTP server (local + LAN)
  • uplink <host…>ssh with themed bookends
  • ip · ping · speedexternal IP · gping · speedtest
04

System & power

9 cmd
  • reportsystem status snapshot
  • sitrepcompact combined dashboard
  • luciushardware + toolchain + repo inventory
  • threattop processes by CPU
  • batcavecd ~ and run report
  • blackout <pattern>hunt & kill matching procs (confirm)
  • override <cmd…>sudo with banners
  • nightfall [secs]put the machine to sleep
  • topbtop resource monitor
05

Maintenance

4 cmd
  • alfredbrew / rust / App-Store upkeep
  • reload · zconfre-source ~/.zshrc · edit it in Zed
  • cowl | detective [on|off]prompt: targeting HUD / plain one-liner
  • mantle | suituppromote the working copy over ~/.zshrc
06

Files & forensics

7 cmd
  • forensics <file>file type, checksums, strings
  • autopsy [app]recent crash/fault log sweep
  • extract <archive>universal archive extractor
  • backup <file|dir>timestamped .bak copy
  • sweep [dir]largest directories under dir
  • mkcd · pathmkdir+cd · print $PATH per line
  • ll | la | ldeza listings: long / all / dirs
07

Git & dev

4 cmd
  • gac <msg>git add . && commit
  • gs · gl · gp · ga · gcstatus · log · push · add . · commit -m
  • lglazygit TUI
  • vsim · cloc · pyiverilog+vvp · tokei · python3
08

Media

2 cmd
  • ytv <url>download best-quality MP4 (subs + meta)
  • yta <url>extract MP3 (meta + thumbnail)
09

Utility gadgets

4 cmd
  • genpass [len]random password → clipboard
  • qr <text|url>QR code in the terminal
  • weather [city]wttr.in forecast
  • mapmapscii world map (telnet)
10

Case file & crypto

3 cmd
  • casefile | note [text]timestamped field journal
  • cipher <op> <text>b64 / hex / url / hash encode-decode
  • timer <dur> [label]focus countdown + notification
11

Dev stack

4 cmd
  • cr · cb · cbr · ct · cch · ccl · cfcargo run/build/rel/test/check/clippy/fmt
  • jsrun · dev · build · lintpackage.json scripts (auto package manager)
  • sb · sbstart · sbstatus · sbtypessupabase CLI (when installed)
  • scaffold <name> [kind]new project skeleton + git init
12

Fun / visual

2 cmd
  • matrix · pipes · quoteterminal toys
  • ascii · decryptjp2a ASCII art · nms decrypt FX
13

The shell itself

3 cmd
  • <text> then ↑search history for that prefix only
  • ctrl-R · ctrl-Tfzf: history · files
  • dirs -v · popdwhere you have been · go back

01 / 13

swipe →

The engineering log

What it cost to get right

What it cost to get right. Startup time that every shell pays, traps that only appear once a config is big enough to contradict itself, and the handful of choices that had to be argued for.

Speed that every terminal window pays for, traps that only appear once a file is big enough to contradict itself, and a few decisions that had to be argued for.

  1. 01

    The banner stopped shelling out to Python~110ms

    The login glitch effect ran a small inline Python script. It fires twice on every login shell, and almost all of the cost was interpreter startup rather than the animation itself.

    Rewritten in pure zsh: the same six-step reveal, none of the launch overhead. Two calls per login shell, so roughly a fifth of a second back on every new tab.

    The opening animation was starting a second language to draw itselfabout 110ms

    Almost all of its cost was starting that language, not animating. Rewritten to use only what the terminal has, it gives a fifth of a second back per tab.

  2. 02

    compinit trusts its cache for a day24h

    compinit re-scans fpath and security-checks every directory on each startup, which costs well over 100ms on every single shell.

    -C reuses the cached dump and skips the check. A glob qualifier forces one full rebuild a day, so completions for newly installed formulae still appear without paying the cost every time.

    The tab-completion cache is trusted for a dayonce a day

    The machinery behind pressing Tab rechecked every folder it knows on every startup. It now trusts yesterday’s answer and rebuilds daily.

    if [[ -n ${_be_zcompdump}(#qN.mh+24) ]]; then
      compinit -d "$_be_zcompdump"      # older than 24h — full rebuild
    else
      compinit -C -d "$_be_zcompdump"   # fresh — trust the cache
    fi
  3. 03

    The banner greets you once, not everywhere-o login

    Gated on a TTY alone, the figlet + fastfetch + glitch sequence fired in every subshell, every nested zsh, every split pane, at roughly 0.6s each time.

    Gating on a login shell keeps it to the places you actually open a terminal. Terminal.app and iTerm2 start each new tab as a login shell, so it still greets you exactly where you expect.

    The greeting was firing everywhere, not just where you open a terminal

    It was running in every nested shell and split pane, at over half a second each. It now fires only where you open a window.

  4. 04

    Your own aliases ambush your functions

    ls is aliased to eza, ping to gping, du to ncdu, cat to bat. An alias is expanded when a function is PARSED, not when it runs, so every one of those aliases silently rewrites the internals of any function that uses the bare command.

    command ls, command ping, command du, command cat wherever the real tool is the one that matters. Forensic metadata should be genuine stat output, not a themed listing with icons and git columns.

    Its own shortcuts were ambushing its own commands

    The file swaps several standard commands for nicer ones, and those swaps were silently rewriting the insides of its own tools.

  5. 05

    Re-sourcing over a stale alias aborts the parse

    weather, vsim and ip all started life as aliases and became functions. Sourcing the new file into a shell that still holds the old alias fails outright with "defining function based on alias", which breaks the rest of the file rather than just that line.

    unalias <name> 2>/dev/null immediately before each definition, so reload is always safe.

    Reloading the file could abort halfway through

    Three shortcuts grew into real functions. Reloading into a terminal still holding the old one failed outright, and took the rest of the file with it.

    unalias vsim 2>/dev/null
    vsim() {
      [[ $# -eq 0 ]] && { echo "Usage: vsim <file.v> [more.v...]"; return 1 }
      iverilog -o sim.out "$@" && vvp sim.out
    }
  6. 06

    An alias appends arguments at the end

    As an alias, vsim adder.v would expand to iverilog -o sim.out && vvp sim.out adder.v, handing the input file to the simulator instead of the compiler, and leaving iverilog with nothing to compile.

    It has to be a function so "$@" lands in the middle of the pipeline where the compiler expects it.

    A shortcut puts your arguments in the wrong place

    A shortcut can only bolt what you type onto the end. This one needed it in the middle, so it had to become a real function.

  7. 07

    A lexical sort hides the busiest process on the machine

    Sorting ps output by CPU without -n compares "9.5" against "36.2" as text and ranks the wrong one first. Leaving the header in before sorting lets it resurface as a fake row mid-table.

    tail -n +2 drops the header before sorting, and -rnk3 compares numerically.

    Sorting numbers as text ranks the wrong one first

    The command listing the busiest programs compared its numbers character by character, which puts 9.5 above 36.2.

    ps aux | tail -n +2 | sort -rnk3 | head -15
  8. 08

    read folds consecutive tabs together

    Tab is an IFS whitespace character, so reading a tab-separated row with read -r collapses empty fields. A device with no label would shift its STATUS flag left into the NAME column.

    Split with a quoted array expansion instead, ${(@ps:\t:)line}, which preserves empty fields.

    Reading a table collapsed its empty columns

    The ordinary way of reading tab-separated rows treats several tabs as one, so a device with no label had its columns shift left.

  9. 09

    macOS arp drops leading zeros from MAC octets

    arp prints c4:79:5:43:77:13, not c4:79:05:43:77:13. A raw prefix taken from that never matches the IEEE OUI table, so every vendor lookup came back empty.

    Re-pad every octet to two hex digits and upper-case it before the lookup.

    Hardware addresses arrive missing their leading zeros

    The machine reports them shortened. The manufacturer lookup expects the full form, so every lookup came back empty.

  10. 10

    No git integration, deliberately

    Prompts that show branch and dirty state run git status before every single prompt, which is exactly where a large repository makes the shell feel slow.

    The prompt costs nothing inside a repo, however large. sitrep reports branch and dirty count on demand instead.

    No repository information in the prompt, deliberately

    Prompts that show your branch interrogate the repository before drawing every prompt, which is what makes a terminal feel slow in a large project. This one reports it on request.

  11. 11

    The reveal animates as one block, not one line

    A single carriage return only rewinds the last visual line, so a MISSION banner long enough to wrap animated its tail while its head sat frozen. That is what forced an earlier 60-character truncation.

    Draw every line, then walk the cursor back up with an explicit escape before the next frame, so a wrapped banner is shown whole.

    The reveal animates as a block, not a line

    Redrawing an animating line only rewinds the last line on screen, so a banner long enough to wrap animated its tail while its head sat frozen.

  12. 12

    Syntax highlighting must be sourced last

    zsh-syntax-highlighting wraps every ZLE widget that exists at the moment it is sourced. Anything binding widgets afterwards goes un-highlighted.

    It is the final statement in the file, with a comment saying so. New integrations go above it, never below.

    The syntax colouring has to load last

    The component that colours your typing wraps whatever exists when it loads, so anything added after is never coloured. It is the last line of the file.

  13. 13

    History depth is a feature, not housekeeping

    zsh defaults to 1000 entries. Autosuggestions draw purely from history, so a shallow history directly weakens every suggestion the shell can offer.

    100,000 entries, shared across tabs, deduplicated. Every entry lost is a suggestion that never appears, and it costs a few megabytes.

    How much history it keeps is a feature100,000 entries

    The suggestions the terminal offers come entirely from past commands, so keeping only the default thousand weakens every one of them.

Safety

A shell config can lock you out of your own machine

safety

A settings file like this can lock you out of your own machine

zsh -nIt refuses to install a config that does not parse
mantle syntax-checks the source before a single byte is written, backs up the old file, keeps the last ten, and can walk any of them back with --revert.
It refuses to install a file that does not work
A broken one breaks every terminal you open afterwards, including the one you would repair it in. It checks before writing.
chmod 600No credential is in the file
The key is read from ~/.secrets, sourced early and never echoed. That is the whole reason this config can be shown to you at all.
No password is in the file
The AI assistant needs one. Keeping it inline would mean the file could never be shown to anyone.
␣A leading space keeps a command out of history
HIST_IGNORE_SPACE means prefixing a command with a single space keeps it out of the history file entirely.
A leading space keeps a command out of the history
Anything typed with a password in it is normally written to disk. A leading space keeps it out entirely.
[y/N]Everything destructive asks first
Each one acquires its targets, prints them with their PIDs, and waits for an explicit y. The default on an empty answer is no.
Everything destructive asks first
Two of these close programs by pattern and are easy to aim wrongly. Each shows what it will close and waits. Saying nothing means no.

The other terminal is real too

This site ships the same content twice: as this editorial page, and as a shell you can actually type into. Same data, different skin.