diff --git a/_home.macos/.chezmoiexternal.yaml.tmpl b/_home.macos/.chezmoiexternal.yaml.tmpl
deleted file mode 100644
index fd4adcb..0000000
--- a/_home.macos/.chezmoiexternal.yaml.tmpl
+++ /dev/null
@@ -1,156 +0,0 @@
-# https://www.chezmoi.io/reference/special-files-and-directories/chezmoiexternal-format/
-#
-# The externals are checked based on the refreshPeriod whenever an `apply` (or `update`) operations run  
-#
-# The simplest form to update all externals:
-# ```sh
-# chezmoi apply --include externals
-# ```
-#
-# Variable              Type            Default Description
-# type                  string          none    External type (file, archive, archive-file, or git-repo)
-# url                   string          none    URL
-# refreshPeriod         duration        0       Refresh period (Examples: one day (24h), one week (168h), or four weeks (672h))
-# executable            bool            false   Add executable_ attribute to file
-# path                  string          none    Path to file in archive
-
-{{- if not (env "OFFLINE") -}}
-
-{{ $defaultRefresh := "168h" -}}
-{{- $externals := dict -}}
-
-{{ $myArch := "aarch64-apple-darwin" }}
-
-{{- with $repo := "zellij-org/zellij" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".cache/chezmoi/tmp/zellij" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/%s/zellij-%s.tar.gz" $repo $version $myArch)
-          "path" "zellij"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end }}
-
-{{- with $repo := "dandavison/delta" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/delta" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/%s/delta-%s-%s.tar.gz" $repo $version $version $myArch)
-          "path" (printf "delta-%s-%s/delta" $version $myArch)
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end -}}
-
-{{- with $repo := "bitwarden/sdk-sm" -}}
-{{-   with $version := trimPrefix "bws-v" (gitHubReleases "bitwarden/sdk-sm" | toJson | fromJson | jq "map(select(.tag_name | startswith(\"bws-v\")))[0] | .tag_name" | first ) -}}
-{{-     $_ := set $externals ".local/bin/bws" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/bws-v%s/bws-%s-%s.zip" $repo $version $myArch $version)
-          "path" "bws"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end -}}
-
-{{ $myArch = "darwin_arm64" }}
-
-{{- with $repo := "hickford/git-credential-oauth" -}}
-{{-   with $version := trimPrefix "v" (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/git-credential-oauth" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/v%s/git-credential-oauth_%s_%s.tar.gz" $repo $version $version $myArch)
-          "path" "git-credential-oauth"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end -}}
-
-{{- with $repo := "knqyf263/pet" -}}
-{{-   with $version := trimPrefix "v" (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/pet" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/v%s/pet_%s_%s.tar.gz" $repo $version $version $myArch)
-          "path" "pet"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end -}}
-
-{{ $myArch = "mac" }}
-
-{{- with $repo := "extrawurst/gitui" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/gitui" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/%s/gitui-%s.tar.gz" $repo $version $myArch)
-          "path" "./gitui"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end }}
-
-{{ $myArch = "Darwin_arm64" }}
-
-{{- with $repo := "theimpostor/osc" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/osc" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/%s/osc_%s.tar.gz" $repo $version $myArch)
-          "path" "osc"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end }}
-
-{{ $myArch = "darwin-arm64" }}
-
-{{- with $repo := "Lifailon/lazyjournal" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/lazyjournal" (dict
-          "type" "file"
-          "url" (printf "https://github.com/%s/releases/download/%s/lazyjournal-%s-%s" $repo $version $version $myArch)
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end }}
-
-{{ $myArch = "macos-arm64" }}
-
-{{- with $repo := "alexpasmantier/television" -}}
-{{-   with $version := (gitHubLatestRelease $repo).GetTagName -}}
-{{-     $_ := set $externals ".local/bin/tv" (dict
-          "type" "archive-file"
-          "url" (printf "https://github.com/%s/releases/download/%s/tv-%s-%s.tar.gz" $repo $version $version $myArch)
-          "path" "tv"
-          "executable" true
-          "refreshPeriod" $defaultRefresh
-) -}}
-{{-   end -}}
-{{- end }}
-
-{{- $externals | toYaml }}
-
-".config/sz.env/lib/delta.themes.gitconfig":
-  type: "file"
-  url: "https://raw.githubusercontent.com/dandavison/delta/refs/heads/main/themes.gitconfig"
-  refreshPeriod: "{{ $defaultRefresh }}"
-
-".config/nvim":
-  type: "git-repo"
-  url: "https://code.lksz.me/szmedia/kickstart-modular.nvim.sz.git"
-  refreshPeriod: "{{ $defaultRefresh }}"
-
-{{- else -}}
-# .chezmoiexternal is disabled because OFFLINE env is defined
-{{- end -}}
-
-# vim: set ft=go sw=2 sts=2 et:
diff --git a/_home.macos/.chezmoiexternal.yaml.tmpl b/_home.macos/.chezmoiexternal.yaml.tmpl
new file mode 120000
index 0000000..4375c3c
--- /dev/null
+++ b/_home.macos/.chezmoiexternal.yaml.tmpl
@@ -0,0 +1 @@
+../_src.posix/.chezmoiexternal.yaml.tmpl
\ No newline at end of file
diff --git a/_home.macos/dot_finicky.js b/_home.macos/dot_finicky.js
index ec20b80..aa0593b 100644
--- a/_home.macos/dot_finicky.js
+++ b/_home.macos/dot_finicky.js
@@ -29,13 +29,13 @@ module.exports = {
         finicky.matchDomains(/.*\.catonetworks\.com/),
         "deeplinks.mindtickle.com*"
       ],
-      browser: "Google Chrome"
+      browser: "Browserosaurus"
     },
     {
       match: [
         finicky.matchDomains(/127\.0\.0\.1/)
       ],
-      browser: "DuckDuckGo"
+      browser: "Browserosaurus"
     },
     {
       // Open these in Browserosaurus
diff --git a/_home.macos/private_dot_config/sz.env/.aliases.macos.env b/_home.macos/private_dot_config/sz.env/.aliases.macos.env
new file mode 120000
index 0000000..5e43498
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/.aliases.macos.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/.aliases.macos.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env b/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env
deleted file mode 120000
index 9ad1a34..0000000
--- a/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env
+++ /dev/null
@@ -1 +0,0 @@
-../../../_src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh b/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh
new file mode 120000
index 0000000..4665313
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env b/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env
deleted file mode 120000
index 089a0d8..0000000
--- a/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env
+++ /dev/null
@@ -1 +0,0 @@
-../../../_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh b/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh
new file mode 120000
index 0000000..9db759c
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env b/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env
deleted file mode 120000
index dbe81b1..0000000
--- a/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env
+++ /dev/null
@@ -1 +0,0 @@
-../../../_src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh b/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh
new file mode 120000
index 0000000..ee5878c
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/aliases.env.tmpl b/_home.macos/private_dot_config/sz.env/aliases.env.tmpl
new file mode 120000
index 0000000..308fd94
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/aliases.env.tmpl
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/aliases.env.tmpl
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env b/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env
deleted file mode 120000
index b13a0db..0000000
--- a/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env
+++ /dev/null
@@ -1 +0,0 @@
-../../../_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env.bash b/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env.bash
new file mode 120000
index 0000000..882b92d
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/bbb_bash_preexec.env.bash
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env.bash
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env b/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env
deleted file mode 120000
index 75fb560..0000000
--- a/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env
+++ /dev/null
@@ -1 +0,0 @@
-../../../_src.posix/private_dot_config/sz.env/bbb_ble.sh.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env.bash b/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env.bash
new file mode 120000
index 0000000..33a3cce
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/bbb_ble.sh.env.bash
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/bbb_ble.sh.env.bash
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env
new file mode 120000
index 0000000..192589d
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env
new file mode 120000
index 0000000..8051f78
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env
new file mode 120000
index 0000000..35e3ae4
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/remove_aliases.env b/_home.macos/private_dot_config/sz.env/remove_aliases.macos.env
similarity index 100%
rename from _home.macos/private_dot_config/sz.env/remove_aliases.env
rename to _home.macos/private_dot_config/sz.env/remove_aliases.macos.env
diff --git a/_home.macos/private_dot_config/sz.env/remove_bbb_bash_preexec.env b/_home.macos/private_dot_config/sz.env/remove_bbb_bash_preexec.env
new file mode 120000
index 0000000..0ae3324
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/remove_bbb_bash_preexec.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/remove_bbb_bash_preexec.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/remove_bbb_ble.sh.env b/_home.macos/private_dot_config/sz.env/remove_bbb_ble.sh.env
new file mode 120000
index 0000000..b23615d
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/remove_bbb_ble.sh.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/remove_bbb_ble.sh.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/sz.env/zzz_teleport.env b/_home.macos/private_dot_config/sz.env/zzz_teleport.env
new file mode 120000
index 0000000..429b263
--- /dev/null
+++ b/_home.macos/private_dot_config/sz.env/zzz_teleport.env
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/sz.env/zzz_teleport.env
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/vim b/_home.macos/private_dot_config/vim
deleted file mode 120000
index b02d60b..0000000
--- a/_home.macos/private_dot_config/vim
+++ /dev/null
@@ -1 +0,0 @@
-../../_src.posix/vim
\ No newline at end of file
diff --git a/_home.macos/private_dot_config/vim/_init b/_home.macos/private_dot_config/vim/_init
new file mode 120000
index 0000000..6a433f0
--- /dev/null
+++ b/_home.macos/private_dot_config/vim/_init
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_config/vim/_init
\ No newline at end of file
diff --git a/_home.macos/private_dot_local/bin/.keep b/_home.macos/private_dot_local/bin/.keep
new file mode 120000
index 0000000..3a6bac8
--- /dev/null
+++ b/_home.macos/private_dot_local/bin/.keep
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_local/bin/.keep
\ No newline at end of file
diff --git a/_home.macos/private_dot_local/bin/executable_tsh-get b/_home.macos/private_dot_local/bin/executable_tsh-get
new file mode 120000
index 0000000..7c62216
--- /dev/null
+++ b/_home.macos/private_dot_local/bin/executable_tsh-get
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_local/bin/executable_tsh-get
\ No newline at end of file
diff --git a/_home.macos/private_dot_local/bin/executable_tssh b/_home.macos/private_dot_local/bin/executable_tssh
new file mode 120000
index 0000000..8f59b48
--- /dev/null
+++ b/_home.macos/private_dot_local/bin/executable_tssh
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_local/bin/executable_tssh
\ No newline at end of file
diff --git a/_home.macos/private_dot_local/bin/executable_tssh-with-tunnel b/_home.macos/private_dot_local/bin/executable_tssh-with-tunnel
new file mode 120000
index 0000000..2322671
--- /dev/null
+++ b/_home.macos/private_dot_local/bin/executable_tssh-with-tunnel
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_local/bin/executable_tssh-with-tunnel
\ No newline at end of file
diff --git a/_home.macos/private_dot_local/bin/executable_vast-teleport b/_home.macos/private_dot_local/bin/executable_vast-teleport
new file mode 100644
index 0000000..df3e6ac
--- /dev/null
+++ b/_home.macos/private_dot_local/bin/executable_vast-teleport
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+# Usage: ./vast-teleport get version [auto|major|<vMajor>]
+# Example: ./latest_teleport_version.sh get major
+
+set -e
+
+SCRIPT_NAME="${0##/*}"
+usage() {
+    printf '%s\n' \
+        "${SCRIPT_NAME} command..." \
+        '' \
+        'Usage:' \
+        '  get version               same as running `tsh version`' \
+        '  get version server        grabs the version of the server' \
+        '  get version server major  grabs the major version of the server' \
+        '  get version client 15     grabs the latest version of the client for major' \
+        "  get version client auto   grab the latest version based on the server's major version" \
+        '' \
+        "  To update teleport's \`tsh\` with \`chezmoi\` run the following" \
+        '    eval "$(vast-teleport get version server major -) czx status"' \
+        ''
+    exit 2
+}
+
+get_server_version() {
+    curl -s https://teleport.vastdata.com:3080/webapi/ping \
+    | jq -r '.server_version'
+}
+get_server_major() {
+    get_server_version | awk -F. '{print $1}'
+}
+
+get_latest_version_by_major() {
+    local MAJOR="$1"
+    curl -s "https://api.github.com/repos/gravitational/teleport/releases?per_page=100" \
+    | jq -r ".[].tag_name" \
+    | grep -E "^v${MAJOR}\." \
+    | sort -V \
+    | tail -n 1
+}
+
+case "$1" in
+    get) shift; case $1 in
+        version) shift; case $1 in
+            '')     tsh version ;;
+            server) shift; case $1 in
+                '')     get_server_version ;;
+                major)  shift; case $1 in
+                    '')  get_server_major ;;
+                    '-') printf 'TELEPORT_MAJOR=' && get_server_major ;;
+                    *)   usage ;;
+                esac;;
+                *) usage ;;
+            esac ;;
+            client) shift; case $1 in
+                '')     usage ;;
+                auto)   get_latest_version_by_major "$(get_server_major)" ;;
+                *)      get_latest_version_by_major "${@}" ;;
+            esac;;
+            *) usage ;;
+        esac;;
+        *) usage ;;
+        esac ;;
+    *)  usage ;;
+esac
+# MAJOR="$1"
+# 
+# if [[ -z "$MAJOR" ]]; then
+#   echo "Usage: $0 <major_version>"
+#   exit 1
+# fi
+# 
+# curl -s "https://api.github.com/repos/gravitational/teleport/releases?per_page=100" | \
+#   jq -r ".[].tag_name" | \
+#   grep -E "^v${MAJOR}\." | \
+#   sort -V | \
+#   tail -n 1
diff --git a/_home.macos/private_dot_local/bin/executable_vastconnect b/_home.macos/private_dot_local/bin/executable_vastconnect
index 228be92..7ee44e7 100644
--- a/_home.macos/private_dot_local/bin/executable_vastconnect
+++ b/_home.macos/private_dot_local/bin/executable_vastconnect
@@ -9,9 +9,10 @@ set -e
 # Test with ping
 # Connect with SSH
 
+SCRIPT_NAME="${0##*/}"
 if [ $# -eq 0 ]; then
     printf '%s\n' \
-        "${0#/*} <TO> [<FROM>] [<Interface>]" \
+        "${SCRIPT_NAME} <TO> [<FROM>] [<Interface>]" \
         "" \
         "Configure MacOS iface to connect to <TO> address from <FROM> address" \
         "Default <Interface> is en9" \
@@ -21,8 +22,36 @@ if [ $# -eq 0 ]; then
         "    192.168.[1 or 2].0/24" \
         "" \
         "for other subnets, you'll need to specify a FROM argument and a FROM_SN env variable" \
+        "" \
+        "What the script does:" \
+        "    1. Attempts a ping to the destination IP." \
+        "    2. If unsuccessful:" \
+        "       a. if FROM (2nd arg) isn't specified or set to 'dhcp':" \
+        "       - tries to guess the FROM and FROM_SN based on known TO ranges." \
+        "       b. if FROM was specied - uses FROM/2nd argument and FROM_SN from env" \
+        "       c. compares desired FROM and assigned IP on outgoing interface (IFACE env or default: en9)" \
+        "       d. if different, asssigns ip address to interface (temporary, using sudo)" \
+        "       e. Attempts ping once again" \
+        "    3. If ping was successful, tries to grab hostname via ssh" \
+        "" \
+        "    The entire process will do it's best to communicate error states and" \
+        "    recommend possible actions if any steps fail" \
+        ""\
+        "Predefined CIDR and  aliases" \
+        "    10.117.10.254/24  " \
+        "    192.168.1.254/24  " \
+        "    192.168.2.254/24  " \
+        "    169.254.1.15/27   " \
+        "    169.254.111.15/27 " \
+        "    169.254.3.254/24  " \
+        "" \
+        "Examples:" \
+        "    ${SCRIPT_NAME} 192.168.2.2 # connect to tech port" \
         ""
     exit 2
+elif [[ $# -eq 1 && "$1" == "editme" ]]; then
+    exec ${VISUAL:-${EDITOR:-vi}} "$(readlink -f "$0")"
+    exit 0
 fi
 
 TO="${1}"
@@ -57,7 +86,7 @@ else
         SLEEP="${SLEEP:-15s}"
     else
         SLEEP="${SLEEP:-3s}"
-        case "${TO}" in
+        case "${FROM:+__}${TO}" in
             10.117.10.*)
                 FROM=10.117.10.254
                 FROM_SN=255.255.255.0
@@ -79,7 +108,7 @@ else
                 FROM_SN=255.255.255.224
                 ;;
             169.254.3.*)
-                FROM=169.254.3.254
+                FROM=169.254.3.253
                 FROM_SN=255.255.255.0
                 ;;
             *)
diff --git a/_home.macos/private_dot_ssh/config.d/.keep b/_home.macos/private_dot_ssh/config.d/.keep
new file mode 120000
index 0000000..f5acf40
--- /dev/null
+++ b/_home.macos/private_dot_ssh/config.d/.keep
@@ -0,0 +1 @@
+../../../_src.posix/private_dot_ssh/config.d/.keep
\ No newline at end of file
diff --git a/_home.macos/private_dot_ssh/config.d/vast b/_home.macos/private_dot_ssh/config.d/vast
index 8656b53..4385c0d 100644
--- a/_home.macos/private_dot_ssh/config.d/vast
+++ b/_home.macos/private_dot_ssh/config.d/vast
@@ -1,6 +1,9 @@
-Host cs-dbg
-    User gal.szkolnik
-    HostName 10.27.70.101
+# [cs-dbg is dead as of 2025-03-09](https://vastdata.slack.com/archives/C04VA6PANDA/p1741536411791709) 
+# Host cs-dbg
+#     HostName 10.27.70.101
+
+Host crater-kfs2
+    HostName crater-kfs2
 
 Host my-loop sales-devvm-gal-szkolnik-spot
     User centos
diff --git a/_src.all/.chezmoi.toml.tmpl b/_src.all/.chezmoi.toml.tmpl
index 67db791..b6e776d 100644
--- a/_src.all/.chezmoi.toml.tmpl
+++ b/_src.all/.chezmoi.toml.tmpl
@@ -40,6 +40,8 @@ scriptTempDir={{- $scriptTempDir | quote }}
 [data.sz.os]
 {{- if eq .chezmoi.os "linux" }}
     short={{- .chezmoi.os | quote }}
+{{- else if eq .chezmoi.os "darwin" }}
+    short="mac"
 {{- else }}
     short={{- substr 0 3 (.chezmoi.os) | quote }}
 {{- end }}
diff --git a/_src.posix/vim/_init b/_src.all/private_dot_config/vim/_init
similarity index 100%
rename from _src.posix/vim/_init
rename to _src.all/private_dot_config/vim/_init
diff --git a/_src.posix/.chezmoiexternal.yaml b/_src.posix/.chezmoiexternal.yaml.tmpl
similarity index 81%
rename from _src.posix/.chezmoiexternal.yaml
rename to _src.posix/.chezmoiexternal.yaml.tmpl
index 62caaa2..8baf005 100644
--- a/_src.posix/.chezmoiexternal.yaml
+++ b/_src.posix/.chezmoiexternal.yaml.tmpl
@@ -81,6 +81,18 @@
 {{-   end -}}
 {{- end -}}
 
+{{- with $repo := "noborus/ov" -}}
+{{-   with $version := trimPrefix "v" (gitHubLatestRelease $repo).GetTagName -}}
+{{-     $_ := set $externals ".local/bin/ov" (dict
+          "type" "archive-file"
+          "url" (printf "https://github.com/%s/releases/download/v%s/ov_%s_%s.zip" $repo $version $version $myArch)
+          "path" "ov"
+          "executable" true
+          "refreshPeriod" $defaultRefresh
+) -}}
+{{-   end -}}
+{{- end -}}
+
 {{/*
 # valid arch strings:
 # linux-aarch64
@@ -161,6 +173,30 @@
 {{-   end -}}
 {{- end -}}
 
+{{/*
+# valid arch strings:
+# darwin-amd64
+# darwin-arm64
+# linux-386
+# linux-amd64
+# linux-arm64
+*/}}
+{{- $myArch = (printf "%s-%s" .chezmoi.os .chezmoi.arch) -}}
+
+{{- if and (env "TELEPORT_MAJOR") (not (eq .chezmoi.os "windows")) -}}
+{{- with $repo := "gravitational/teleport" -}}
+{{-   with $version := (gitHubReleases $repo | toJson | fromJson | jq (printf "map(select(.tag_name | startswith(\"v%s\")))[0] | .tag_name" (env "TELEPORT_MAJOR")) | first ) -}}
+{{-     $_ := set $externals ".local/bin/tsh" (dict
+          "type" "archive-file"
+          "url" (printf "https://cdn.teleport.dev/teleport-%s-%s-bin.tar.gz" $version $myArch)
+          "path" "teleport/tsh"
+          "executable" true
+          "refreshPeriod" $defaultRefresh
+) -}}
+{{-   end -}}
+{{- end -}}
+{{- end }}
+
 {{- $externals | toYaml }}
 ".config/sz.env/lib/ble.sh.curl":
   type: "archive"
@@ -177,11 +213,13 @@
   url: "https://raw.githubusercontent.com/rcaloras/bash-preexec/master/bash-preexec.sh"
   refreshPeriod: "{{ $defaultRefresh }}"
 
+{{- if eq .chezmoi.os "linux" -}}
 ".local/bin/nvim.AppImage":
   type: "file"
   url: "https://github.com/neovim/neovim/releases/download/stable/nvim-linux-x86_64.appimage"
   executable: true
   refreshPeriod: "{{ $defaultRefresh }}"
+{{- end -}}
 
 {{- else -}}
 # .chezmoiexternal is disabled because CZ_EXTR env is undefined
diff --git a/_src.posix/dot_gitconfig.tmpl b/_src.posix/dot_gitconfig.tmpl
index 960e3c9..c3756fd 100644
--- a/_src.posix/dot_gitconfig.tmpl
+++ b/_src.posix/dot_gitconfig.tmpl
@@ -5,6 +5,9 @@
 [include]
     path = .config/sz.env/lib/delta.themes.gitconfig
 
+[init]
+    defaultBranch = main
+
 [user]
   name = {{ .gitName }}
   email = {{ .gitEmail }}
@@ -36,13 +39,20 @@
 # oauthScopes = read_repository
 [core]
     editor = vim
-    pager = delta
+    # delta will used as the default pager for git
+    # and ov as the default pager for delta
+    # the pager will be overloaded via the [pager] section for a few commands
+    pager = delta --pager='ov -F'
 
-[init]
-    defaultBranch = main
+[pager]
+    # overload delta pager for some commands
+    show = delta --pager='ov -F --header 3'
 
-[core]
-    pager = delta
+    # We are now overloading some commands via "delta features"
+    # This allows us to use different pager per git command
+    # It allows to maintain a simpler config file and avoid escaping quotes
+    diff = delta --features ov-diff
+    log  = delta --features ov-log
 
 [interactive]
     diffFilter = delta --color-only
@@ -52,6 +62,20 @@
     navigate = true  # use n and N to move between diff sections
     line-numbers = true
     side-by-side = true
+    file-style = yellow
+
+# we define the delta feature "ov-diff" we are using for git diff
+[delta "ov-diff"]
+    # the idea is to overload the pager used by delta when using git diff
+    # we are using the same pattern used by delta when the default pager (less) is used
+    # using ov section feature brings a better experience
+    pager=ov -F --section-delimiter '^(commit|added:|removed:|renamed:|Δ)' --section-header --pattern '•'
+
+# we define the delta feature "ov-log" we are using for git log
+[delta "ov-log"]
+    # the idea is to overload the pager used by delta when using git log
+    # using ov section feature brings a better experience
+    pager=ov -F --section-delimiter '^commit' --section-header-num 3
 
 [diff]
     tool = nvimdiff
diff --git a/_home.macos/private_dot_config/sz.env/aliases.macos.env b/_src.posix/private_dot_config/sz.env/.aliases.macos.env
similarity index 100%
rename from _home.macos/private_dot_config/sz.env/aliases.macos.env
rename to _src.posix/private_dot_config/sz.env/.aliases.macos.env
index cc60cc7..aeec94d 100644
--- a/_home.macos/private_dot_config/sz.env/aliases.macos.env
+++ b/_src.posix/private_dot_config/sz.env/.aliases.macos.env
@@ -1,9 +1,9 @@
 #!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
 
 alias l='ls -lahF --color=auto '
-alias lu='l -U '
 alias lold='l -t '
 alias lnew='l -tr '
+alias lu='l -U '
 alias ll='l -A'
 
 alias sudo='sudo '
diff --git a/_src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env b/_src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh
similarity index 100%
rename from _src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env
rename to _src.posix/private_dot_config/sz.env/aaa_zsh_0_perp.env.zsh
diff --git a/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env b/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env
deleted file mode 100644
index 6024fa0..0000000
--- a/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/usr/bin/env -S zsh -c 'echo "Not a user script. source(aka .) only"'
-
-BASE_SHELL=${BASE_SHELL:-${SHELL##*/}}
-
-if [[ "${BASE_SHELL}" == "zsh" ]]; then
-    # true  = install zdharma-continuum/zinit
-    # false = install z-shell/zi
-
-    if false; then
-        # Auto install zdharma-continuum/zinit
-        ZINIT_HOME="${XDG_DATA_HOME:-${HOME}/.local/share}/zinit/bin"
-        if [[ ! -d "$ZINIT_HOME/.git" ]]; then
-            print -P "%F{33}▓▒░ %F{220}Installing DHARMA Initiative Plugin Manager (zdharma-continuum/zinit)…%f"
-            command mkdir -p "$(dirname "$ZINIT_HOME")" \
-                && command chmod go-rwX "$(dirname "$ZINIT_HOME")"
-	    command git clone -q --depth=1 --branch "main" \
-                https://github.com/zdharma-continuum/zinit.git "$ZINIT_HOME" \
-                && print -P "%F{33}▓▒░ %F{34}Installation successful.%f%b" \
-                || print -P "%F{160}▓▒░ The clone has failed.%f%b"
-	fi
-        source "${ZINIT_HOME}/zinit.zsh"
-
-        autoload -Uz _zinit
-        (( ${+_comps} )) && _comps[zinit]=_zinit
-        ### End of Zinit installer's chunk
-        alias zi='zinit '
-
-        [[ -n "${DBG}" ]] && echo "zinit ready"
-    else
-        #""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
-        #"""                              z-shell/zi                                  """
-        #""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
-        #
-        # ### Added by z-shell/zi's installer
-        ZI_HOME="${XDG_DATA_HOME:-${HOME}/.local/share}/zi/bin"
-        mkdir -p "$(dirname "$ZI_HOME")"
-        if [[ ! -d "$ZI_HOME/.git" ]]; then
-            print -P "%F{33}▓▒░ %F{160}Installing (%F{33}z-shell/zi%F{160})…%f"
-            command mkdir -p "$(dirname "$ZINIT_HOME")" \
-                && command chmod go-rwX "$(dirname "$ZI_HOME")"
-            command git clone -q --depth=1 --branch "main" \
-                https://github.com/z-shell/zi.git "$ZI_HOME" \
-                && print -P "%F{33}▓▒░ %F{34}Installation successful.%f%b" \
-                || print -P "%F{160}▓▒░ The clone has failed.%f%b"
-        fi
-        source "${ZI_HOME}/zi.zsh"
-        autoload -Uz _zi
-        (( ${+_comps} )) && _comps[zi]=_zi
-        # examples here -> https://wiki.zshell.dev/ecosystem/category/-annexes
-        zicompinit # <- https://wiki.zshell.dev/docs/guides/commands
-        ### End of z-shell/zi installer's chunk
-	alias zinit=zi
-	
-        [[ -n "${DBG}" ]] && echo "zi ready"
-    fi
-
-fi
-
diff --git a/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh b/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh
new file mode 100644
index 0000000..551db82
--- /dev/null
+++ b/_src.posix/private_dot_config/sz.env/aaa_zsh_2_zinit.env.zsh
@@ -0,0 +1,28 @@
+#!/usr/bin/env -S zsh -c 'echo "Not a user script. source(aka .) only"'
+
+#""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+#"""                              z-shell/zi                                  """
+#""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+#
+# ### Added by z-shell/zi's installer
+ZI_HOME="${XDG_DATA_HOME:-${HOME}/.local/share}/zi/bin"
+mkdir -p "$(dirname "$ZI_HOME")"
+if [[ ! -d "$ZI_HOME/.git" ]]; then
+    print -P "%F{33}▓▒░ %F{160}Installing (%F{33}z-shell/zi%F{160})…%f"
+    command mkdir -p "$(dirname "$ZINIT_HOME")" \
+        && command chmod go-rwX "$(dirname "$ZI_HOME")"
+    command git clone -q --depth=1 --branch "main" \
+        https://github.com/z-shell/zi.git "$ZI_HOME" \
+        && print -P "%F{33}▓▒░ %F{34}Installation successful.%f%b" \
+        || print -P "%F{160}▓▒░ The clone has failed.%f%b"
+fi
+source "${ZI_HOME}/zi.zsh"
+autoload -Uz _zi
+(( ${+_comps} )) && _comps[zi]=_zi
+# examples here -> https://wiki.zshell.dev/ecosystem/category/-annexes
+zicompinit # <- https://wiki.zshell.dev/docs/guides/commands
+### End of z-shell/zi installer's chunk
+alias zinit=zi
+
+[[ -n "${DBG}" ]] && echo "zi ready"
+
diff --git a/_src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env b/_src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh
similarity index 100%
rename from _src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env
rename to _src.posix/private_dot_config/sz.env/aaa_zsh_3_completion_system.env.zsh
diff --git a/_src.posix/private_dot_config/sz.env/aliases.env b/_src.posix/private_dot_config/sz.env/aliases.env.tmpl
similarity index 73%
rename from _src.posix/private_dot_config/sz.env/aliases.env
rename to _src.posix/private_dot_config/sz.env/aliases.env.tmpl
index fb96806..ba9abca 100644
--- a/_src.posix/private_dot_config/sz.env/aliases.env
+++ b/_src.posix/private_dot_config/sz.env/aliases.env.tmpl
@@ -1,14 +1,21 @@
 #!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
 
+{{- if eq .chezmoi.os "darwin" }}
+alias l='ls -lahF --color=auto '
+alias lold='l -t '
+alias lnew='l -tr '
+{{ else }}
 alias l='ls -lahF --color=auto --group-directories-first '
-alias lu='l -U '
 alias lold='l --sort=time '
 alias lnew='l --sort=time --reverse '
+{{- end }}
 alias ll='l -A'
+alias lu='l -U '
 
 alias sudo='sudo '
 
 is_cmd nvim \
+&& export VISUAL="nvim" EDITOR="nvim" \
 && alias nvim='POSTFIX_BUITINS=1 command nvim -p ' \
 || alias nvim='POSTFIX_BUITINS=1 command vim -p '
 alias vi='nvim '
diff --git a/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env b/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env
deleted file mode 100644
index bde5808..0000000
--- a/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
-
-BASE_SHELL=${BASE_SHELL:-${SHELL##*/}}
-
-if [[ "${BASE_SHELL}" == "bash" ]]; then
-    update-bash-preexec() {
-        local workdir="$SZ_ENV_ROOT/lib/bash-preexec"
-        [ -d "$workdir" ] && rm -fR "$workdir"
-        mkdir -p "$workdir"
-        
-        cd "$workdir"
-    
-        # Pull down our file from GitHub and write it to your home directory as a hidden file.
-        curl https://raw.githubusercontent.com/rcaloras/bash-preexec/master/bash-preexec.sh -o ./bash-preexec.sh
-        # Source our file to bring it into our environment
-        source .bash-preexec.sh
-        
-        source "$workdir/ble-nightly/ble.sh"
-    }
-    
-    # shellcheck disable=SC1091 source=$HOME/.bash-preexec.sh
-    if [[ -f "$SZ_ENV_ROOT/lib/bash-preexec/.bash-preexec.sh" ]]; then
-        SZ_ENV_BASH_LOAD_PREEXEC='. "$SZ_ENV_ROOT/lib/bash-preexec/.bash-preexec.sh"'
-    
-        [[ -n "${DBG}" ]] && echo "Bash-preexec will be loaded."
-    fi
-fi
-
diff --git a/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env.bash b/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env.bash
new file mode 100644
index 0000000..19edd01
--- /dev/null
+++ b/_src.posix/private_dot_config/sz.env/bbb_bash_preexec.env.bash
@@ -0,0 +1,24 @@
+#!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
+
+update-bash-preexec() {
+    local workdir="$SZ_ENV_ROOT/lib/bash-preexec"
+    [ -d "$workdir" ] && rm -fR "$workdir"
+    mkdir -p "$workdir"
+    
+    cd "$workdir"
+
+    # Pull down our file from GitHub and write it to your home directory as a hidden file.
+    curl https://raw.githubusercontent.com/rcaloras/bash-preexec/master/bash-preexec.sh -o ./bash-preexec.sh
+    # Source our file to bring it into our environment
+    source .bash-preexec.sh
+    
+    source "$workdir/ble-nightly/ble.sh"
+}
+
+# shellcheck disable=SC1091 source=$HOME/.bash-preexec.sh
+if [[ -f "$SZ_ENV_ROOT/lib/bash-preexec/.bash-preexec.sh" ]]; then
+    SZ_ENV_BASH_LOAD_PREEXEC='. "$SZ_ENV_ROOT/lib/bash-preexec/.bash-preexec.sh"'
+
+    [[ -n "${DBG}" ]] && echo "Bash-preexec will be loaded."
+fi
+
diff --git a/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env b/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env
deleted file mode 100644
index 7c2e99e..0000000
--- a/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
-
-BASE_SHELL=${BASE_SHELL:-${SHELL##*/}}
-
-if [[ "${BASE_SHELL}" == "bash" ]]; then
-    update-ble.sh() {
-        [[ -n "${DBG}" ]] && set -x
-        local workdir="$SZ_ENV_ROOT/lib/ble.sh.curl"
-        [ -d "$workdir" ] && rm -fR "$workdir"
-        mkdir -p "$workdir"
-        
-        cd "$workdir"
-        curl -L https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly.tar.xz | tar xJf -
-        
-        source "$workdir/ble-nightly/ble.sh"
-        [[ -n "${DBG}" ]] && set +x
-    }
-    if [ -f "$SZ_ENV_ROOT/lib/ble.sh.curl/ble-nightly/ble.sh" ]; then
-        source "$SZ_ENV_ROOT/lib/ble.sh.curl/ble-nightly/ble.sh" --noattach
-    fi
-    
-    if [[ -n "${DBG}" && -n "${BLE_VERSION-}" ]]; then
-        echo "ble.sh will be loaded."
-    fi
-fi
-
diff --git a/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env.bash b/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env.bash
new file mode 100644
index 0000000..787d5f4
--- /dev/null
+++ b/_src.posix/private_dot_config/sz.env/bbb_ble.sh.env.bash
@@ -0,0 +1,22 @@
+#!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
+
+update-ble.sh() {
+    [[ -n "${DBG}" ]] && set -x
+    local workdir="$SZ_ENV_ROOT/lib/ble.sh.curl"
+    [ -d "$workdir" ] && rm -fR "$workdir"
+    mkdir -p "$workdir"
+    
+    cd "$workdir"
+    curl -L https://github.com/akinomyoga/ble.sh/releases/download/nightly/ble-nightly.tar.xz | tar xJf -
+    
+    source "$workdir/ble-nightly/ble.sh"
+    [[ -n "${DBG}" ]] && set +x
+}
+if [ -f "$SZ_ENV_ROOT/lib/ble.sh.curl/ble-nightly/ble.sh" ]; then
+    source "$SZ_ENV_ROOT/lib/ble.sh.curl/ble-nightly/ble.sh" --noattach
+fi
+
+if [[ -n "${DBG}" && -n "${BLE_VERSION-}" ]]; then
+    echo "ble.sh will be loaded."
+fi
+
diff --git a/_src.posix/private_dot_config/sz.env/executable__.load.sh b/_src.posix/private_dot_config/sz.env/executable__.load.sh
index 618204c..da3abee 100644
--- a/_src.posix/private_dot_config/sz.env/executable__.load.sh
+++ b/_src.posix/private_dot_config/sz.env/executable__.load.sh
@@ -46,22 +46,29 @@ if is_sourced; then
             LOAD_EXIT=0
 
             # The following constructs a list of load_next ... commands
-            ALL_ENV_FILES="$(
-                find ~/.config/sz.env -xdev -type d -not -name '*.off' \
-                    -exec sh -c '
-                        find "$1" -xdev -maxdepth 1 -type f -name "ID_*.env" | sort
-                    ' shell '{}' ';' \
-                    -exec sh -c '
-                        find "$1" -xdev -maxdepth 1 -type f -name "PATH_*.env" | sort
-                    ' shell '{}' ';' \
-                    -exec sh -c '
-                        find "$1" -xdev -maxdepth 1 -type f -name "*.env" -not -name "ID_*" -not -name "PATH_*" -print | sort
-                    ' shell '{}' ';' \
-                    -exec sh -c '
-                        find "$1" -xdev -maxdepth 1 -type f -name "PATH_zz_cleanup.env"
-                    ' shell '{}' ';' \
-                | sed -e 's/^/load_next "/; s/$/";/'
+            FIND_CMD="$( printf "%s " \
+                "find ~/.config/sz.env -xdev -type d -not -name '*.off'" \
+                    "-exec sh -c '" \
+                        'find "$1" -xdev -maxdepth 1 -type f' \
+                            '-name "ID_*.env" -or -name "ID_*.env.'"${BASE_SHELL}"\" \
+                        "| sort' shell '{}' ';'" \
+                    "-exec sh -c '" \
+                        'find "$1" -xdev -maxdepth 1 -type f' \
+                            '-name "PATH_*.env" -or -name "PATH_*.env.'"${BASE_SHELL}"\" \
+                        "| sort' shell '{}' ';'" \
+                    "-exec sh -c '" \
+                        'find "$1" -xdev -maxdepth 1 -type f' \
+                            '-name "*.env" -or -name "*.env.'"${BASE_SHELL}"\" \
+                        '| grep -Ev "/(PATH|ID)_[^/]+$"' \
+                        "| sort' shell '{}' ';'" \
+                    "-exec sh -c '" \
+                        'find "$1" -xdev -maxdepth 1 -type f -name "PATH_zz_cleanup.env"' \
+                    "' shell '{}' ';'"
             )"
+            ALL_ENV_FILES="$(
+                eval "$FIND_CMD" | sed -e 's/^/load_next "/; s/$/";/'
+            )"
+            ${DBG/%1/:} unset FIND_CMD
             if [ -n "$DBG_NO_SZ_LOAD" ]; then
                ALL_ENV_FILES=$(<<<"$ALL_ENV_FILES" sed -Ee '
                    /PATH_/!s/^(load_next )/# \1/
@@ -70,6 +77,7 @@ if is_sourced; then
             fi
             # Run the constructed (see above) list
             eval "$ALL_ENV_FILES"
+            ${DBG/%1/:} unset ALL_ENV_FILES
         fi
     }
     load_all
diff --git a/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env b/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_0_perp.env
new file mode 100644
index 0000000..e69de29
diff --git a/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env b/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_2_zinit.env
new file mode 100644
index 0000000..e69de29
diff --git a/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env b/_src.posix/private_dot_config/sz.env/remove_aaa_zsh_3_completion_system.env
new file mode 100644
index 0000000..e69de29
diff --git a/_src.posix/private_dot_config/sz.env/remove_bbb_bash_preexec.env b/_src.posix/private_dot_config/sz.env/remove_bbb_bash_preexec.env
new file mode 100644
index 0000000..e69de29
diff --git a/_src.posix/private_dot_config/sz.env/remove_bbb_ble.sh.env b/_src.posix/private_dot_config/sz.env/remove_bbb_ble.sh.env
new file mode 100644
index 0000000..e69de29
diff --git a/_src.posix/private_dot_config/sz.env/zzz_chezmoi.env.tmpl b/_src.posix/private_dot_config/sz.env/zzz_chezmoi.env.tmpl
index 060c8e0..953652b 100644
--- a/_src.posix/private_dot_config/sz.env/zzz_chezmoi.env.tmpl
+++ b/_src.posix/private_dot_config/sz.env/zzz_chezmoi.env.tmpl
@@ -8,7 +8,7 @@ if is_cmd 'chezmoi'; then
     export CHEZMOI_GITHUB_ACCESS_TOKEN={{- .githubToken | quote }}
 
     czcd() {
-	cd "$(chezmoi source-path "${@}")"
+        cd "$(chezmoi source-path "${@}")"
     }
     czedext() {
         local CZ_EXT="$(find $(chezmoi source-path) -mindepth 1 -maxdepth 1 -name '.chezmoiexternal.*')"
@@ -16,8 +16,16 @@ if is_cmd 'chezmoi'; then
         "${VISUAL:-${EDITOR:-vi}}" "${CZ_EXT}"
     }
     czed() {
-        chezmoi edit "${@}" --apply --interactive
+        local EDITLIST=() f _f
+        for _f in "${@}"; do
+            [[ -e "$_f" ]] || f="$(which "$_f")"
+            [[ -z "$f" ]] && is_cmd tv && f="$(tv "$_f")" || f=$_f
+            EDITLIST=( "${EDITLIST[@]}" "$f" )
+        done
+        EDITLIST=("${@}")
+        chezmoi edit "${EDITLIST[@]}" --apply --interactive
     }
+    alias czx="CZ_EXTR=1 chezmoi "
 fi
 
 # vim: set ft=bash sw=4 sts=4 et:
diff --git a/_src.posix/private_dot_config/sz.env/zzz_teleport.env b/_src.posix/private_dot_config/sz.env/zzz_teleport.env
new file mode 100644
index 0000000..28f8a6d
--- /dev/null
+++ b/_src.posix/private_dot_config/sz.env/zzz_teleport.env
@@ -0,0 +1,11 @@
+#!/usr/bin/env -S bash -c 'echo "Not a user script. source(aka .) only"'
+
+BASE_SHELL=${BASE_SHELL:-${SHELL##*/}}
+
+if is_cmd tsh && tsh version | grep -q '^Teleport'; then
+    tsh-login() {
+        command tsh login --proxy=teleport.vastdata.com "${@}"
+    }
+
+    . <(tsh --completion-script-${BASE_SHELL})
+fi
diff --git a/_src.posix/private_dot_config/vim/_init b/_src.posix/private_dot_config/vim/_init
new file mode 120000
index 0000000..0309e32
--- /dev/null
+++ b/_src.posix/private_dot_config/vim/_init
@@ -0,0 +1 @@
+../../../_src.all/private_dot_config/vim/_init
\ No newline at end of file
diff --git a/_src.posix/private_dot_local/bin/.keep b/_src.posix/private_dot_local/bin/.keep
new file mode 120000
index 0000000..b930edf
--- /dev/null
+++ b/_src.posix/private_dot_local/bin/.keep
@@ -0,0 +1 @@
+../../../_src.all/private_dot_local/bin/.keep
\ No newline at end of file
diff --git a/_src.posix/private_dot_local/bin/executable_tsh-get b/_src.posix/private_dot_local/bin/executable_tsh-get
new file mode 100644
index 0000000..1bf3f32
--- /dev/null
+++ b/_src.posix/private_dot_local/bin/executable_tsh-get
@@ -0,0 +1,62 @@
+#! /usr/bin/env bash
+
+set -e
+
+SCRIPT_NAME="${0##/*}"
+usage() {
+    printf '%s\n' \
+        'Search Teleport for an ssh host with an interactive selection' \
+        '' \
+        'Usage:' \
+        "  [SILENT=1] [BATCH=1] [QUERY='query syntax'] ${SCRIPT_NAME} <search string>" \
+        '' \
+        'Arguments:' \
+        '' \
+        'Examples:' \
+        '  $ BATCH=1 tsh-get tesla' \
+        '  cluster_psnt=VAST-TESLA-AUS-1,hostname=aus08p1vstfs01-cn1-DO-NOT-LOGIN' \
+        '  cluster_psnt=VA22374479,hostname=c-0-1' \
+        '  cluster_psnt=VA22465472,hostname=c-0-1' \
+        '' \
+        '  tsh-get tesla ' \
+        ''
+    exit 2
+}
+
+if [[ $# -eq 0 ]]; then
+    usage
+fi
+
+SILENT=${SILENT:-${BATCH:+1}}
+SEARCH="$1"
+QUERY="${QUERY:+--query=${QUERY}}"
+
+${SILENT:+:} printf 'Searching for %s...' "$SEARCH" >&2
+
+OPTIONS="$(
+    tsh ls --search "$SEARCH" ${QUERY} --format json | jq -r ' .[] | (
+        if .metadata.labels.customer_name
+        then "customer_name=" + .metadata.labels.customer_name + ","
+        elif .metadata.labels.Customer
+        then "Customer=" + .metadata.labels.Customer + ","
+        else ""
+        end)
+        + "cluster_psnt=\(.metadata.labels.cluster_psnt),"
+        + "hostname=\(.spec.hostname)"
+    '
+)"
+
+if [[ -z "$BATCH" && "${OPTIONS}" == *$'\n'* ]]; then
+    SELECTED="$( tv --no-preview <<<"$OPTIONS" )"
+else
+    SELECTED="$OPTIONS"
+fi
+
+if [[ -z "$SELECTED" ]]; then
+    ${SILENT:+:} printf 'Aborted (empty response)\n' >&2
+    exit 2
+fi
+
+${SILENT:+:} printf '\n%s selected.\n' "$SELECTED" >&2
+echo "$SELECTED"
+
diff --git a/_src.posix/private_dot_local/bin/executable_tssh b/_src.posix/private_dot_local/bin/executable_tssh
new file mode 100644
index 0000000..c607a90
--- /dev/null
+++ b/_src.posix/private_dot_local/bin/executable_tssh
@@ -0,0 +1,28 @@
+#! /usr/bin/env bash
+
+set -e
+
+SCRIPT_NAME="${0##/*}"
+usage() {
+    printf '%s\n' \
+	'SSH using Teleport with interactive selection and VAST-reasnoble defaults' \
+	'' \
+        "${SCRIPT_NAME} " \
+        '' \
+        'Usage:' \
+        ''
+    exit 2
+}
+
+if [[ $# -eq 0 ]]; then
+    usage
+fi
+
+SEARCH="$1"
+SSHUSER="${SSHUSER:-vastdata}"
+TUNNEL="${TUNNEL:+-L ${TUNNEL}}"
+
+TARGET="${SSHUSER}@$(tsh-get "$SEARCH" "$SSHUSER")"
+
+tsh ssh ${TUNNEL} "${TARGET}" "${@:2}"
+
diff --git a/_src.posix/private_dot_local/bin/executable_tssh-with-tunnel b/_src.posix/private_dot_local/bin/executable_tssh-with-tunnel
new file mode 100644
index 0000000..6da0438
--- /dev/null
+++ b/_src.posix/private_dot_local/bin/executable_tssh-with-tunnel
@@ -0,0 +1,48 @@
+#! /usr/bin/env bash
+
+set -e
+
+SCRIPT_NAME="${0##*/}"
+usage() {
+    printf '%s\n' \
+        'Open a tunnel to the VMS external IP' \
+        '' \
+        'Usage:' \
+        "  ${SCRIPT_NAME} <search> [ssh args...]" \
+        '' \
+        'Env manipulators:' \
+        '  LOCAL_PORT   default is 8443' \
+        '  TARGET_PORT  default is 443' \
+        '  SSHUSER      default is vastdata' \
+        '  VMS          default is auto-detected' \
+        ''
+    exit 2
+}
+
+if [[ $# -eq 0 ]]; then
+    usage
+fi
+
+LOCAL_PORT="${LOCAL_PORT:-8443}"
+TARGET_PORT="${TARGET_PORT:-443}"
+SEARCH="$1"
+SSHUSER="${SSHUSER:-vastdata}"
+
+TARGET="${SSHUSER}@$(tsh-get "$SEARCH" "$SSHUSER")"
+
+VMS="${VMS:-"$(awk '$5 { split($4, cidr, "/"); print cidr[1] }' <(tsh ssh "${TARGET}" bash -l <<SSHEOF
+    VMS="\$(clush -g cnodes 'docker ps | grep vast_vms | grep -v grep' 2>/dev/null | cut -d':' -f1)" \
+    && clush -w "\$VMS" ip -4 -br a
+SSHEOF
+))"}"
+
+TUNNEL="-L ${LOCAL_PORT}:${VMS}:${TARGET_PORT}"
+
+RUN="${RUN:-}"
+if [[ -z "$RUN" && -n "$(command -v zellij)" ]]; then
+    RUN="zellij run --floating --pinned 'true' --name '${SCRIPT_NAME} ${SEARCH}: ${TUNNEL} ${TARGET}' --"
+fi
+
+printf "Executing: %s ...\n" "tsh ssh ${TUNNEL} ${TARGET} ${*:2}" >&2
+eval "${RUN} tsh ssh ${TUNNEL} '${TARGET}' ${*:2}"
+
diff --git a/_src.posix/private_dot_ssh/config.d/.keep b/_src.posix/private_dot_ssh/config.d/.keep
new file mode 120000
index 0000000..54fecee
--- /dev/null
+++ b/_src.posix/private_dot_ssh/config.d/.keep
@@ -0,0 +1 @@
+../../../_src.all/private_dot_ssh/config.d/.keep
\ No newline at end of file
diff --git a/symclone.sh b/symclone.sh
index e25899b..835ae6c 100755
--- a/symclone.sh
+++ b/symclone.sh
@@ -2,26 +2,54 @@
 
 set -e
 
-# Source directory (existing structure with files)
-SRC_DIR=_src.posix
-
 # Target directory (new structure with symlinks)
-DEST_DIR="${1}"
+DEST_DIR="${DEST_DIR:-${1}}"
 
 is_cmd() {
     type -p -- "${@}" 2> /dev/null 1> /dev/null
 }
-if is_cmd chezmoi && [ -z "$DEST_DIR" ]; then
+if is_cmd chezmoi && [[ -z "$RESET" && -z "$SRC_DIR" && -z "$DEST_DIR" ]]; then
     DEST_DIR="$(chezmoi data | jq -r '.chezmoi.sourceDir | split("/") | last')"
 fi
-DEST_DIR="${DEST_DIR:?Must supply dest dir name}"
 
+# Source directory (existing structure with files)
+SRC_DIR=${SRC_DIR:-_src.posix}
+
+SCRIPT_NAME="${0##*/}"
+usage() {
+    printf '%s\n' \
+        'Assign symlinks acrosss chezmoi platform home-dirs' \
+        '' \
+        'Usage:' \
+        "  [RESET=reset] [FORCE=-f] [SRC_DIR=<alt src dir>] ${SCRIPT_NAME} [<destination_directory>]" \
+        '' \
+        'Notes: ' \
+        '  SRC_DIR assumes _src.posix if empty' \
+        '  If `chezmoi` state isn'"'"'t broken, the current chezmoihome dir will be used' \
+        '' \
+        '  When RESET env var is "reset", <destination_directory> is mandatory, ' \
+        '    it will remove any symlink in that directory' \
+        '' \
+        'Examples:' \
+        '  # A complete reset' \
+        '  RESET=reset SRC_DIR=_src.all ./symclone.sh _src.posix' \
+        '  RESET=reset ./symclone.sh _home.macos' \
+        '' \
+        '  # Alternative setup' \
+        '  RESET=reset SRC_DIR=_src.all ./symclone.sh _home.macos && ./symclone.sh' \
+        '' \
+        '  # General refresh' \
+        '  ./symclone.sh' \
+        ''
+    exit 1
+}
 # Check if both arguments are provided
 if [[ -z "$SRC_DIR" || -z "$DEST_DIR" ]]; then
-    echo "Usage: $0 <source_directory> <destination_directory>"
-    exit 1
+    usage
 fi
 
+DEST_DIR="${DEST_DIR:?Must supply dest dir name}"
+
 # Ensure source directory exists
 if [[ ! -d "$SRC_DIR" ]]; then
     echo "Error: Source directory '$SRC_DIR' does not exist."
@@ -53,8 +81,17 @@ relpath() {
     echo "${back}${target_abs#$common_part/}"
 }
 
-# Find all files and create symbolic links in the destination
-find "$SRC_DIR" -type f | while read -r file; do
+if [[ -n "$RESET" ]]; then
+    [[ "$RESET" != 'reset' ]] \
+    && printf 'ERROR: RESET was set incorrectly, value %s is illeagal.\n\n' "$RESET" >&2 \
+    && usage
+    printf "Removing all symlinks from %s destination..." "${DEST_DIR}" >&2
+    find "${DEST_DIR}" -type l -delete
+    printf "Done.\n" >&2
+fi
+
+# Find all non-dirs (files and symlinks) and create symbolic links in the destination
+find "$SRC_DIR" -not -type d | while read -r file; do
     # Determine the relative path for the symlink
     target_file="${file#$SRC_DIR/}"
     target_path="$DEST_DIR/${target_file}"
@@ -63,7 +100,7 @@ find "$SRC_DIR" -type f | while read -r file; do
 
     # Create the symlink with relative path
     SKIP=
-    
+
     [ -z "$SKIP" ] && [ -e "${remove_target}" ] && SKIP="remove entry found for: %s" || true
     [ -z "$SKIP" ] && [ -L "$target_path" ] && [ -z "$FORCE" ] && SKIP="can't force replace %s" || true
     [ -z "$SKIP" ] && [ -e "$target_path" ] && SKIP="%s exists" || true
@@ -71,4 +108,5 @@ find "$SRC_DIR" -type f | while read -r file; do
     [ -n "$SKIP" ] || ln ${FORCE} -vs "$src_relative_path" "$target_path" || (set | grep -E '^(?:target|remove|src)_' >&2; false)
 done
 
-echo "Symbolic links created successfully in '$DEST_DIR'."
+echo "${SCRIPT_NAME} for '$DEST_DIR' done." >&2
+