feat: sync shell config (theme and plugins) from remote config

openboot sync now detects and applies Oh-My-Zsh theme and plugin
differences when the remote config specifies a shell section.

- Add snapshot.CaptureShell() to read local .zshrc theme and plugins
- Add ShellDiff to SyncDiff with HasChanges/TotalChanged support
- Add shell fields to SyncPlan; execute via shell.RestoreFromSnapshot
- Show Shell Changes section in sync TUI with confirm prompt
- Add VM E2E tests: CaptureShell and no-panic with shell config

Author: fullstackjam

internal/cli/sync.go

@@ -213,6 +213,26 @@ func printSyncDiff(d *syncpkg.SyncDiff) {
 		fmt.Println()
 	}
 
+	// Shell changes
+	if d.Shell != nil {
+		fmt.Printf("  %s\n", ui.Green("Shell Changes"))
+		if d.Shell.ThemeChanged {
+			localTheme := d.Shell.LocalTheme
+			if localTheme == "" {
+				localTheme = "(none)"
+			}
+			fmt.Printf("    Theme: %s %s %s\n", localTheme, ui.Yellow("→"), d.Shell.RemoteTheme)
+		}
+		if d.Shell.PluginsChanged {
+			localPlugins := strings.Join(d.Shell.LocalPlugins, ", ")
+			if localPlugins == "" {
+				localPlugins = "(none)"
+			}
+			fmt.Printf("    Plugins: %s %s %s\n", localPlugins, ui.Yellow("→"), strings.Join(d.Shell.RemotePlugins, ", "))
+		}
+		fmt.Println()
+	}
+
 	// Dotfiles changes
 	if d.DotfilesChanged {
 		fmt.Printf("  %s\n", ui.Green("Dotfiles"))
@@ -294,6 +314,20 @@ func buildSyncPlan(d *syncpkg.SyncDiff, rc *config.RemoteConfig, dryRun bool, in
 		}
 	}
 
+	// Shell config
+	if d.Shell != nil {
+		apply, err := ui.Confirm("Update shell config (theme and plugins)?", true)
+		if err != nil {
+			return nil, fmt.Errorf("confirm shell: %w", err)
+		}
+		if apply {
+			plan.UpdateShell = true
+			plan.ShellOhMyZsh = true
+			plan.ShellTheme = d.Shell.RemoteTheme
+			plan.ShellPlugins = d.Shell.RemotePlugins
+		}
+	}
+
 	// Dotfiles
 	if d.DotfilesChanged {
 		apply, err := ui.Confirm(
@@ -318,6 +352,13 @@ func buildDryRunPlan(d *syncpkg.SyncDiff) *syncpkg.SyncPlan {
 		InstallTaps:     d.MissingTaps,
 	}
 
+	if d.Shell != nil {
+		plan.UpdateShell = true
+		plan.ShellOhMyZsh = true
+		plan.ShellTheme = d.Shell.RemoteTheme
+		plan.ShellPlugins = d.Shell.RemotePlugins
+	}
+
 	if d.DotfilesChanged {
 		plan.UpdateDotfiles = d.RemoteDotfiles
 	}

internal/snapshot/capture.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
 
@@ -387,6 +388,42 @@ func CaptureDotfiles() (*DotfilesSnapshot, error) {
 	}, nil
 }
 
+var (
+	zshThemeRe   = regexp.MustCompile(`(?m)^ZSH_THEME="([^"]*)"`)
+	zshPluginsRe = regexp.MustCompile(`(?m)^plugins=\((?s:(.*?))\)`)
+)
+
+// CaptureShell reads the current Oh-My-Zsh state and .zshrc theme/plugins.
+// Returns a zero-value ShellSnapshot (not an error) when .zshrc is absent.
+func CaptureShell() (*ShellSnapshot, error) {
+	snap := &ShellSnapshot{}
+
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return snap, nil
+	}
+
+	if _, err := os.Stat(filepath.Join(home, ".oh-my-zsh")); err == nil {
+		snap.OhMyZsh = true
+	}
+
+	raw, err := os.ReadFile(filepath.Join(home, ".zshrc"))
+	if err != nil {
+		return snap, nil // no .zshrc is fine
+	}
+	content := string(raw)
+
+	if m := zshThemeRe.FindStringSubmatch(content); len(m) > 1 {
+		snap.Theme = m[1]
+	}
+
+	if m := zshPluginsRe.FindStringSubmatch(content); len(m) > 1 {
+		snap.Plugins = strings.Fields(m[1])
+	}
+
+	return snap, nil
+}
+
 func sanitizePath(path string) string {
 	home, err := os.UserHomeDir()
 	if err != nil {

internal/snapshot/snapshot.go

@@ -153,6 +153,12 @@ type DevTool struct {
 	Version string `json:"version"`
 }
 
+type ShellSnapshot struct {
+	OhMyZsh bool     `json:"oh_my_zsh"`
+	Theme   string   `json:"theme"`
+	Plugins []string `json:"plugins"`
+}
+
 type CatalogMatch struct {
 	Matched   []string `json:"matched"`
 	Unmatched []string `json:"unmatched"`

internal/sync/diff.go

@@ -31,6 +31,20 @@ type SyncDiff struct {
 
 	// macOS Preferences
 	MacOSChanged []MacOSPrefDiff
+
+	// Shell (non-nil when theme or plugins differ from remote)
+	Shell *ShellDiff
+}
+
+// ShellDiff records a shell config difference between remote and local.
+// RemoteTheme/RemotePlugins always reflect the remote config values.
+type ShellDiff struct {
+	ThemeChanged   bool
+	RemoteTheme    string
+	LocalTheme     string
+	PluginsChanged bool
+	RemotePlugins  []string
+	LocalPlugins   []string
 }
 
 // MacOSPrefDiff records a single macOS preference that differs.
@@ -54,7 +68,8 @@ func (d *SyncDiff) HasChanges() bool {
 		len(d.ExtraNpm) > 0 ||
 		len(d.ExtraTaps) > 0 ||
 		d.DotfilesChanged ||
-		len(d.MacOSChanged) > 0
+		len(d.MacOSChanged) > 0 ||
+		d.Shell != nil
 }
 
 // TotalMissing returns the count of items in remote but not on the local system.
@@ -67,12 +82,15 @@ func (d *SyncDiff) TotalExtra() int {
 	return len(d.ExtraFormulae) + len(d.ExtraCasks) + len(d.ExtraNpm) + len(d.ExtraTaps)
 }
 
-// TotalChanged returns the count of values that differ (theme, dotfiles, macOS prefs).
+// TotalChanged returns the count of values that differ (theme, dotfiles, macOS prefs, shell).
 func (d *SyncDiff) TotalChanged() int {
 	n := len(d.MacOSChanged)
 	if d.DotfilesChanged {
 		n++
 	}
+	if d.Shell != nil {
+		n++
+	}
 	return n
 }
 
@@ -122,6 +140,28 @@ func ComputeDiff(rc *config.RemoteConfig) (*SyncDiff, error) {
 		}
 	}
 
+	// Shell diff — only when remote config specifies oh-my-zsh
+	if rc.Shell != nil && rc.Shell.OhMyZsh {
+		localShell, err := snapshot.CaptureShell()
+		if err != nil {
+			return nil, fmt.Errorf("capture local shell: %w", err)
+		}
+		var sd *ShellDiff
+		if rc.Shell.Theme != "" && rc.Shell.Theme != localShell.Theme {
+			if sd == nil {
+				sd = &ShellDiff{RemoteTheme: rc.Shell.Theme, LocalTheme: localShell.Theme, RemotePlugins: rc.Shell.Plugins, LocalPlugins: localShell.Plugins}
+			}
+			sd.ThemeChanged = true
+		}
+		if len(rc.Shell.Plugins) > 0 && !pluginsEqual(rc.Shell.Plugins, localShell.Plugins) {
+			if sd == nil {
+				sd = &ShellDiff{RemoteTheme: rc.Shell.Theme, LocalTheme: localShell.Theme, RemotePlugins: rc.Shell.Plugins, LocalPlugins: localShell.Plugins}
+			}
+			sd.PluginsChanged = true
+		}
+		d.Shell = sd
+	}
+
 	// macOS prefs diff
 	if len(rc.MacOSPrefs) > 0 {
 		localPrefs, prefsErr := snapshot.CaptureMacOSPrefs()
@@ -156,6 +196,24 @@ func ComputeDiff(rc *config.RemoteConfig) (*SyncDiff, error) {
 	return d, nil
 }
 
+// pluginsEqual reports whether two plugin lists contain the same elements
+// regardless of order.
+func pluginsEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	set := make(map[string]bool, len(a))
+	for _, p := range a {
+		set[p] = true
+	}
+	for _, p := range b {
+		if !set[p] {
+			return false
+		}
+	}
+	return true
+}
+
 // diffLists returns (missing, extra) where missing = in remote but not local,
 // extra = in local but not remote.
 func diffLists(remote, local []string) (missing, extra []string) {

internal/sync/plan.go

@@ -9,6 +9,7 @@ import (
 	"github.com/openbootdotdev/openboot/internal/dotfiles"
 	"github.com/openbootdotdev/openboot/internal/macos"
 	"github.com/openbootdotdev/openboot/internal/npm"
+	"github.com/openbootdotdev/openboot/internal/shell"
 )
 
 // SyncPlan describes the concrete actions to apply after the user selects
@@ -31,6 +32,12 @@ type SyncPlan struct {
 
 	// macOS
 	UpdateMacOSPrefs []config.RemoteMacOSPref
+
+	// Shell
+	UpdateShell  bool
+	ShellOhMyZsh bool
+	ShellTheme   string
+	ShellPlugins []string
 }
 
 // SyncResult summarizes what was applied.
@@ -49,6 +56,9 @@ func (p *SyncPlan) TotalActions() int {
 	if p.UpdateDotfiles != "" {
 		n++
 	}
+	if p.UpdateShell {
+		n++
+	}
 	return n
 }
 
@@ -156,6 +166,16 @@ func Execute(plan *SyncPlan, dryRun bool) (*SyncResult, error) {
 		}
 	}
 
+	// Update shell config
+	if plan.UpdateShell {
+		if err := shell.RestoreFromSnapshot(plan.ShellOhMyZsh, plan.ShellTheme, plan.ShellPlugins, dryRun); err != nil {
+			errs = append(errs, fmt.Errorf("update shell: %w", err))
+			result.Errors = append(result.Errors, fmt.Sprintf("shell: %v", err))
+		} else {
+			result.Updated++
+		}
+	}
+
 	// Apply macOS preferences
 	if len(plan.UpdateMacOSPrefs) > 0 {
 		prefs := make([]macos.Preference, len(plan.UpdateMacOSPrefs))

test/e2e/sync_shell_e2e_test.go

@@ -0,0 +1,64 @@
+//go:build e2e && vm
+
+package e2e
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/openbootdotdev/openboot/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestE2E_Sync_Shell_CaptureShell verifies that CaptureShell works correctly
+// in a real macOS environment: detects Oh-My-Zsh and reads theme/plugins from .zshrc.
+func TestE2E_Sync_Shell_CaptureShell(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping VM test in short mode")
+	}
+
+	vm := testutil.NewTartVM(t)
+	installOhMyZsh(t, vm)
+	bin := vmCopyDevBinary(t, vm)
+
+	// Set a known theme and plugins so we can assert on them
+	_, err := vm.Run(`sed -i '' 's/ZSH_THEME="[^"]*"/ZSH_THEME="agnoster"/' ~/.zshrc`)
+	require.NoError(t, err)
+	_, err = vm.Run(`sed -i '' 's/plugins=(git)/plugins=(git docker)/' ~/.zshrc`)
+	require.NoError(t, err)
+
+	zshrc, err := vm.Run("cat ~/.zshrc")
+	require.NoError(t, err)
+	assert.Contains(t, zshrc, `ZSH_THEME="agnoster"`, ".zshrc should have agnoster theme")
+	assert.Contains(t, zshrc, "docker", ".zshrc should have docker plugin")
+
+	// Run snapshot --json to exercise the full capture path (including CaptureShell indirectly)
+	snapshotOut, err := vmRunDevBinary(t, vm, bin, "snapshot --json")
+	require.NoError(t, err, "snapshot should succeed, output: %s", snapshotOut)
+	assert.NotEmpty(t, snapshotOut)
+
+	_, err = vm.Run("test -d ~/.oh-my-zsh")
+	assert.NoError(t, err, "~/.oh-my-zsh should exist after install")
+}
+
+// TestE2E_Sync_Shell_NoPanic verifies that the binary handles a remote config
+// with shell settings without panicking.
+func TestE2E_Sync_Shell_NoPanic(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping VM test in short mode")
+	}
+
+	vm := testutil.NewTartVM(t)
+	installOhMyZsh(t, vm)
+	bin := vmCopyDevBinary(t, vm)
+
+	cfg := `{"username":"testuser","slug":"default","packages":[],"casks":[],"taps":[],"npm":[],"shell":{"oh_my_zsh":true,"theme":"agnoster","plugins":["git","docker"]}}`
+	escaped := strings.ReplaceAll(cfg, "'", "'\\''")
+	_, err := vm.Run("printf '%s' '" + escaped + "' > /tmp/shell-config.json")
+	require.NoError(t, err)
+
+	out, _ := vmRunDevBinaryWithGit(t, vm, bin, "--from /tmp/shell-config.json --silent --dry-run")
+	t.Logf("dry-run output:\n%s", out)
+	assert.NotContains(t, out, "panic", "binary should not panic with shell config")
+}

test/e2e/vm_helpers_test.go

@@ -105,6 +105,15 @@ func vmRunDevBinaryWithGit(t *testing.T, vm *testutil.TartVM, binaryPath, args s
 	return vm.RunWithEnv(env, binaryPath+" "+args)
 }
 
+// installOhMyZsh installs Oh-My-Zsh non-interactively in the VM.
+func installOhMyZsh(t *testing.T, vm *testutil.TartVM) {
+	t.Helper()
+	script := `sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended`
+	output, err := vm.Run(script)
+	t.Logf("oh-my-zsh install: %s", output)
+	require.NoError(t, err, "should install oh-my-zsh")
+}
+
 // vmBrewList returns the list of installed Homebrew formulae in the VM.
 func vmBrewList(t *testing.T, vm *testutil.TartVM) []string {
 	t.Helper()