fr3on · Jul 12, 2026 · Jul 12, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,6 +1,25 @@
 name: CI
 on: [push, pull_request]
 jobs:
+  version-consistency:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check VERSION matches all embedded copies
+        run: |
+          VERSION=$(cat VERSION)
+          THEME_VERSION=$(grep -oP '(?<=^export APORIA_VERSION=")[^"]*' aporia.zsh-theme)
+          INSTALL_VERSION=$(grep -oP '(?<=^APORIA_VERSION=")[^"]*' install.sh)
+
+          fail=0
+          [ "$VERSION" = "$THEME_VERSION" ] || { echo "::error file=aporia.zsh-theme::APORIA_VERSION ($THEME_VERSION) does not match VERSION ($VERSION)"; fail=1; }
+          [ "$VERSION" = "$INSTALL_VERSION" ] || { echo "::error file=install.sh::APORIA_VERSION ($INSTALL_VERSION) does not match VERSION ($VERSION)"; fail=1; }
+
+          if [ "$fail" -eq 1 ]; then
+            echo "Run: scripts/bump-version.sh  (to re-sync from ./VERSION)"
+            exit 1
+          fi
+          echo "All version strings match: $VERSION"
   lint:
     runs-on: ubuntu-latest
     steps:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -9,8 +9,34 @@ permissions:
   contents: write
 
 jobs:
+  verify-version:
+    name: Verify tag matches VERSION
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Check tag matches VERSION and embedded copies
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          VERSION=$(cat VERSION)
+          THEME_VERSION=$(grep -oP '(?<=^export APORIA_VERSION=")[^"]*' aporia.zsh-theme)
+          INSTALL_VERSION=$(grep -oP '(?<=^APORIA_VERSION=")[^"]*' install.sh)
+
+          fail=0
+          [ "$TAG" = "$VERSION" ] || { echo "::error::Tag ($TAG) does not match VERSION file ($VERSION)"; fail=1; }
+          [ "$TAG" = "$THEME_VERSION" ] || { echo "::error::Tag ($TAG) does not match aporia.zsh-theme APORIA_VERSION ($THEME_VERSION)"; fail=1; }
+          [ "$TAG" = "$INSTALL_VERSION" ] || { echo "::error::Tag ($TAG) does not match install.sh APORIA_VERSION ($INSTALL_VERSION)"; fail=1; }
+
+          if [ "$fail" -eq 1 ]; then
+            echo "Run scripts/bump-version.sh $TAG, commit, then re-tag."
+            exit 1
+          fi
+          echo "Tag $TAG matches VERSION and all embedded copies."
+
   release:
     name: Create GitHub Release
+    needs: verify-version
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code

diff --git a/VERSION b/VERSION
@@ -0,0 +1 @@
+1.1.4
diff --git a/aporia.zsh-theme b/aporia.zsh-theme
@@ -234,12 +234,18 @@ _ap_is_utf8() {
 AP_SHOW_SSH=${AP_SHOW_SSH:-1}         # user@host (SSH sessions only)
 AP_SHOW_GIT=${AP_SHOW_GIT:-1}         # git branch + dirty/ahead/behind
 AP_SHOW_LANGS=${AP_SHOW_LANGS:-1}     # python / node / rust versions
-AP_SHOW_EXEC_TIME=${AP_SHOW_EXEC_TIME:-1}   # execution time (> threshold)
+AP_SHOW_EXEC_TIME=${AP_SHOW_EXEC_TIME:-0}   # execution time (> threshold)
 AP_EXEC_TIME_THRESHOLD=${AP_EXEC_TIME_THRESHOLD:-0}   # seconds (0 = show for all commands)
 AP_SHOW_EXIT_CODE=${AP_SHOW_EXIT_CODE:-1}   # non-zero exit codes
 AP_SHOW_TIME=${AP_SHOW_TIME:-1}       # clock on right
 AP_DIR_DEPTH=${AP_DIR_DEPTH:-3}       # how many path segments to show
 
+# Icon-tier defaults. Without these, unset vars evaluate to 0 in the -eq
+# checks below and silently downgrade fresh installs from Nerd Font to
+# the Unicode tier.
+AP_USE_NERD_FONT=${AP_USE_NERD_FONT:-1}
+AP_ASCII_FALLBACK=${AP_ASCII_FALLBACK:-0}
+
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 # ─── ICONOGRAPHY ─────────────────────────────────────────────────────────────
 typeset -gA AP_ICONS
@@ -265,7 +271,11 @@ if [[ $AP_ASCII_FALLBACK -eq 1 ]] || ! _ap_is_utf8; then
     KUBE      "k8s"     AWS       "aws"
     GCP       "gcp"     AZURE     "az"
     VPN       "vpn"     NIX       "nix"
-    PVE       "pve"
+    PVE       "pve"     CPANEL    "cp"
+    GH        "gh"      TARGET    "tgt"
+    VPN_ON    "vpn+"    VPN_OFF   "vpn-"
+    TAILSCALE "ts"      CPU       "cpu"
+    RAM       "ram"
   )
 elif [[ $AP_USE_NERD_FONT -eq 0 ]]; then
   # Tier 2: Standard Unicode (Compatibility Mode)
@@ -287,51 +297,63 @@ elif [[ $AP_USE_NERD_FONT -eq 0 ]]; then
     KUBE      "⎈"       AWS       "aws"
     GCP       "gcp"     AZURE     "az"
     VPN       "vpn"     NIX       "nix"
-    PVE       "pve"
+    PVE       "pve"     CPANEL    "▤"
+    GH        "gh"      TARGET    "◎"
+    VPN_ON    "⇄"       VPN_OFF   "⊘"
+    TAILSCALE "ts"      CPU       "▤"
+    RAM       "▥"
   )
 elif [[ $AP_ICON_STYLE == "font_awesome" ]]; then
   # Tier 1.5: Font Awesome
   AP_ICONS=(
     SEP_L     ""       SEP_R     ""
-    GIT       ""       SSH       ""
+    GIT       ""       SSH       ""
     DIR       ""       OK        ""
     ERR       ""       TIME      ""
     EXEC      ""       PROMPT    ""
     PY        ""       NODE      ""
-    RUST      ""       GO        ""
-    RUBY      ""       PHP       ""
+    RUST      ""       GO        ""
+    RUBY      ""       PHP       ""
     JAVA      ""       CPP       ""
-    DENO      ""       DIRTY     ""
+    DENO      ""       DIRTY     ""
     STAGED    ""       MODIFIED  ""
     UNTRACKED ""       AHEAD     ""
     BEHIND    ""       STASH     ""
     DOCKER    ""       KUBE      ""
     AWS       ""       GCP       ""
     AZURE     ""       VPN       ""
     NIX       ""       PVE       ""
+    CPANEL    ""       GH        ""
+    TARGET    ""       VPN_ON    ""
+    VPN_OFF   ""       TAILSCALE ""
+    CPU       ""       RAM       ""
   )
   # OS Logic
   if _ap_is_macos; then AP_ICONS[OS]=""; elif [[ -n $WSL_DISTRO_NAME ]]; then AP_ICONS[OS]=""; else AP_ICONS[OS]=""; fi
 else
   # Tier 1: Nerd Font (Classic Elegant Mono Mode)
   AP_ICONS=(
     SEP_L     ""       SEP_R     ""
-    GIT       ""       SSH       "󰭎"
+    GIT       ""       SSH       ""
     DIR       ""       OK        ""
     ERR       ""       TIME      ""
     EXEC      ""       PROMPT    "❯"
     PY        ""       NODE      ""
-    RUST      ""       GO        "󰟓"
-    RUBY      ""       PHP       "󰌟"
+    RUST      ""       GO        ""
+    RUBY      ""       PHP       ""
     JAVA      ""       CPP       ""
-    DENO      "󰄙"       DIRTY     ""
+    DENO      ""       DIRTY     ""
     STAGED    ""       MODIFIED  ""
     UNTRACKED ""       AHEAD     ""
     BEHIND    ""       STASH     ""
     DOCKER    ""       KUBE      ""
     AWS       ""       GCP       ""
     AZURE     ""       VPN       ""
     NIX       ""       PVE       ""
+    CPANEL    ""       GH        ""
+    TARGET    ""       VPN_ON    ""
+    VPN_OFF   ""       TAILSCALE ""
+    CPU       ""       RAM       ""
     OS        "$(_ap_get_os_icon)"
   )
   # Override OS icon for classic look
@@ -477,35 +499,44 @@ fi
 #  GIT STATUS
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 _ap_segment_git() {
-  command git rev-parse --is-inside-work-tree &>/dev/null || { echo "NONE"; return 1; }
-
-  local branch dirty ahead=0 behind=0
+  # Single fork covers: work-tree check, branch/SHA, ahead/behind, and all
+  # file states — replaces the old rev-parse + symbolic-ref + status +
+  # rev-list combo (4-5 forks) with one `git status` call.
+  local raw
+  raw=$(command git status --porcelain=v2 --branch 2>/dev/null)
+  (( $? )) && { echo "NONE"; return 1; }
+
+  local branch="" oid="" dirty ahead=0 behind=0
   local staged=0 modified=0 untracked=0
+  local line
+
+  while IFS= read -r line; do
+    case $line in
+      "# branch.head "*) branch=${line#\# branch.head } ;;
+      "# branch.oid "*)  oid=${line#\# branch.oid } ;;
+      "# branch.ab "*)
+        local ab=${line#\# branch.ab }
+        ahead=${ab%% *}; ahead=${ahead#+}
+        behind=${ab##* }; behind=${behind#-}
+        ;;
+      "1 "*|"2 "*)
+        local -a f=(${(s: :)line})
+        local xy=${f[2]}
+        [[ ${xy[1]} != "." ]] && (( staged++ ))
+        [[ ${xy[2]} == "M" || ${xy[2]} == "D" ]] && (( modified++ ))
+        ;;
+      "u "*) (( staged++ )); (( modified++ )) ;;
+      "? "*) (( untracked++ )) ;;
+    esac
+  done <<< "$raw"
 
-  # Branch name or short SHA (detached HEAD)
-  branch=$(command git symbolic-ref --short HEAD 2>/dev/null)
-  [[ -z $branch ]] && branch=$(command git rev-parse --short HEAD 2>/dev/null)
+  # Detached HEAD or unborn branch: fall back to short SHA
+  [[ -z $branch || $branch == "(detached)" ]] && branch=${oid:0:7}
   [[ -z $branch ]] && { echo "NONE"; return 1; }
 
-  # Parse porcelain status for counts
-  local git_status
-  git_status=$(command git status --porcelain 2>/dev/null)
-  if [[ -n $git_status ]]; then
-    dirty=1
-    staged=$(echo "$git_status" | grep -c "^[MADRC]")
-    modified=$(echo "$git_status" | grep -c "^.[MD]")
-    untracked=$(echo "$git_status" | grep -c "??")
-  fi
-
-  # Ahead / behind upstream
-  local ab
-  ab=$(command git rev-list --count --left-right "@{upstream}...HEAD" 2>/dev/null)
-  if [[ -n $ab ]]; then
-    behind=${ab%%$'\t'*}
-    ahead=${ab##*$'\t'}
-  fi
+  (( staged + modified + untracked > 0 )) && dirty=1
 
-  # Stash count
+  # Stash count (not reported by `git status`, needs its own call)
   local stash=0
   stash=$(command git stash list 2>/dev/null | wc -l | tr -d ' ')
 
@@ -1380,7 +1411,7 @@ _aporia_help() {
 }
 
 _aporia_dashboard() {
-  print -P "\n %F{$AP_C_ORANGE}APORIA%f %F{$AP_C_GRAY}— %f%B%F{$AP_C_BLUE}v${APORIA_VERSION:-1.1.4}%f%b"
+  print -P "\n %F{$AP_C_ORANGE}APORIA%f %F{$AP_C_GRAY}— %f%B%F{$AP_C_BLUE}v${APORIA_VERSION}%f%b"
   print -P " %F{$AP_C_GRAY}──────────────────────────────────────────────────%f"
 
   print -P " %F{$AP_C_BLUE}System Info%f"
@@ -1405,7 +1436,7 @@ _aporia_dashboard() {
   _ap_print_flag "SSH Segment" ${AP_SHOW_SSH:-1}
   _ap_print_flag "Git Segment" ${AP_SHOW_GIT:-1}
   _ap_print_flag "Lang Stats"  ${AP_SHOW_LANGS:-1}
-  _ap_print_flag "Exec Time"   ${AP_SHOW_EXEC_TIME:-1}
+  _ap_print_flag "Exec Time"   ${AP_SHOW_EXEC_TIME:-0}
   _ap_print_flag "Exit Code"   ${AP_SHOW_EXIT_CODE:-1}
   _ap_print_flag "Clock"       ${AP_SHOW_TIME:-1}
 
@@ -1593,22 +1624,37 @@ _aporia_doctor() {
 }
 
 _aporia_upgrade() {
-  print -P "\n %F{$AP_C_BLUE}Upgrading Aporia...%f"
+  local before_version=${APORIA_VERSION:-unknown}
+  print -P "\n %F{$AP_C_BLUE}Upgrading Aporia...%f %F{$AP_C_GRAY}(currently v$before_version)%f"
+
   if command -v brew >/dev/null && brew list aporia >/dev/null 2>&1; then
     print -P "   %F{$AP_C_GRAY}Homebrew installation detected.%f"
     brew upgrade aporia
+    return
+  fi
+
+  local theme_dir=${${(%):-%x}:h}
+  if [[ -d "$theme_dir/.git" ]]; then
+    print -P "   %F{$AP_C_GRAY}Git installation detected.%f"
+    git -C "$theme_dir" pull origin main
   else
-    local theme_dir=${${(%):-%x}:h}
-    if [[ -d "$theme_dir/.git" ]]; then
-      print -P "   %F{$AP_C_GRAY}Git installation detected.%f"
-      git -C "$theme_dir" pull origin main
-    else
-      print -P "   %F{$AP_C_GRAY}Manual installation detected. Fetching latest from GitHub...%f"
-      curl -fsSL https://raw.githubusercontent.com/fr3on/aporia/main/aporia.zsh-theme -o "$HOME/.aporia.zsh-theme"
-      curl -fsSL https://raw.githubusercontent.com/fr3on/aporia/main/aporia.plugin.zsh -o "$HOME/.aporia.plugin.zsh"
-      print -P "   %F{$AP_C_GREEN}✓ Successfully downloaded latest version to $HOME%f"
-    fi
+    print -P "   %F{$AP_C_GRAY}Manual installation detected. Fetching latest from GitHub...%f"
+    curl -fsSL https://raw.githubusercontent.com/fr3on/aporia/main/aporia.zsh-theme -o "$HOME/.aporia.zsh-theme"
+    curl -fsSL https://raw.githubusercontent.com/fr3on/aporia/main/aporia.plugin.zsh -o "$HOME/.aporia.plugin.zsh"
+  fi
+
+  local new_theme_file="$theme_dir/aporia.zsh-theme"
+  [[ -f $new_theme_file ]] || new_theme_file="$HOME/.aporia.zsh-theme"
+  local after_version
+  after_version=$(grep -oE '^export APORIA_VERSION="[^"]*"' "$new_theme_file" 2>/dev/null | cut -d'"' -f2)
+  after_version=${after_version:-unknown}
+
+  if [[ $after_version == $before_version ]]; then
+    print -P "   %F{$AP_C_GREEN}✓ Already up to date (v$before_version).%f"
+  else
+    print -P "   %F{$AP_C_GREEN}✓ Upgraded v$before_version → v$after_version.%f"
   fi
+  print -P "   %F{$AP_C_GRAY}Restart your shell to load the new version.%f"
 }
 
 _aporia_benchmark() {

diff --git a/install.sh b/install.sh
@@ -314,7 +314,7 @@ patch_zshrc() {
     info "Already sourced — no change"
   else
     if ! grep -q "HISTFILE=" "$ZSHRC"; then
-      printf '\n# Aporia: History\nexport HISTFILE=\"$HOME/.zsh_history\"\nexport HISTSIZE=10000\nexport SAVEHIST=10000\n' >> "$ZSHRC"
+      printf '\n# Aporia: History\nexport HISTFILE="$HOME/.zsh_history"\nexport HISTSIZE=10000\nexport SAVEHIST=10000\n' >> "$ZSHRC"
       ok "History defaults added"
     fi
     printf '\n# aporia.zsh-theme\n%s\n' "$SOURCE_LINE" >> "$ZSHRC"
@@ -329,8 +329,20 @@ patch_bashrc() {
   local MARK="# aporia-bash-bridge"
   [ -f "$BASHRC" ] || touch "$BASHRC"
   if ! grep -qF "$MARK" "$BASHRC" 2>/dev/null; then
-    printf '\n%s\nif [[ -z \"$ZSH_VERSION\" ]] && [[ $- == *i* ]] && command -v zsh >/dev/null 2>&1; then\n  exec zsh\nfi\n' "$MARK" >> "$BASHRC"
-    ok "Bash → Zsh bridge added"
+    printf '\n%s\nif [[ -z "$ZSH_VERSION" ]] && [[ $- == *i* ]] && command -v zsh >/dev/null 2>&1; then\n  exec zsh\nfi\n' "$MARK" >> "$BASHRC"
+    ok "Bash → Zsh bridge added (~/.bashrc)"
+  fi
+
+  # A fresh SSH/console login is a *login* shell: bash reads ~/.bash_profile
+  # or ~/.profile there, not ~/.bashrc — and on many minimal distros neither
+  # of those chains into .bashrc. Without this, the bridge above never runs
+  # on a brand-new login, only in shells spawned after one is already active.
+  # POSIX `[ ]`/`case` here since ~/.profile may be read by a plain sh/dash.
+  local PROFILE="$HOME/.profile"
+  [ -f "$PROFILE" ] || touch "$PROFILE"
+  if ! grep -qF "$MARK" "$PROFILE" 2>/dev/null; then
+    printf '\n%s\nif [ -z "$ZSH_VERSION" ] && [ -n "$BASH_VERSION" ] && command -v zsh >/dev/null 2>&1; then\n  case $- in *i*) exec zsh -l ;; esac\nfi\n' "$MARK" >> "$PROFILE"
+    ok "Bash → Zsh bridge added (~/.profile)"
   fi
 }
 

diff --git a/plugins/aws-profile/aws-profile.zsh b/plugins/aws-profile/aws-profile.zsh
@@ -16,7 +16,7 @@ _ap_aws_segment() {
   [[ -n $profile ]] && label+="$profile"
   [[ -n $region  ]] && label+=" ${region}"
 
-  local _ico="${_AP_ICO_AWS:-aws}"
+  local _ico="${AP_ICONS[AWS]:-aws}"
   echo "%F{$color}${_ico} $label%f"
 }
 

diff --git a/plugins/azure-ctx/azure-ctx.zsh b/plugins/azure-ctx/azure-ctx.zsh
@@ -2,7 +2,6 @@
 # Cloud Intelligence: Azure Subscription Context
 
 AP_C_AZURE=${AP_C_AZURE:-33}         # Azure Blue
-_AP_ICO_AZURE="󰠅"                    # Azure Icon
 
 _ap_azure_segment() {
   # [1] Detection: check for az binary and config
@@ -20,7 +19,8 @@ _ap_azure_segment() {
 
   [[ -z $sub_name ]] && return
 
-  echo "%F{$AP_C_AZURE}${_AP_ICO_AZURE} ${sub_name}%f"
+  local _ico="${AP_ICONS[AZURE]:-az}"
+  echo "%F{$AP_C_AZURE}${_ico} ${sub_name}%f"
 }
 
 _ap_azure_precmd() {

diff --git a/plugins/cpanel/cpanel.zsh b/plugins/cpanel/cpanel.zsh
@@ -2,7 +2,6 @@
 # Contextual Intelligence for cPanel Environments
 
 AP_C_CPANEL=${AP_C_CPANEL:-208}   # cPanel Orange (Standard)
-_AP_ICO_CPANEL="󰨿"               # Server/Panel Icon
 
 _ap_cpanel_segment() {
   # [1] Detection: Check for cPanel markers
@@ -27,7 +26,8 @@ _ap_cpanel_segment() {
   fi
 
   # [3] Output: Format the segment
-  local out="%F{$AP_C_CPANEL}${_AP_ICO_CPANEL} ${cp_user}"
+  local _ico="${AP_ICONS[CPANEL]:-cp}"
+  local out="%F{$AP_C_CPANEL}${_ico} ${cp_user}"
   [[ -n $cp_domain && $cp_domain != "unknown" ]] && out+="@${cp_domain}"
 
   echo "${out}%f"

diff --git a/plugins/docker-ctx/docker-ctx.zsh b/plugins/docker-ctx/docker-ctx.zsh
@@ -17,7 +17,7 @@ _ap_docker_ctx_segment() {
     [[ -z $ctx ]] && ctx="default"
   fi
 
-  local _ico="${_AP_ICO_DOCKER:-dkr}"
+  local _ico="${AP_ICONS[DOCKER]:-dkr}"
   echo "%F{$AP_C_DOCKER}${_ico} $ctx%f"
 }