Add work-specific configs and enhance git/shell setup

- Add modular zsh configs: zshrc-dev for dev tools, zshrc-natera for work
- Add .gitignore to exclude private Natera config from version control
- Configure git commit signing and delta diff viewer in gitconfig
- Regenerate p10k.zsh with rainbow theme and improved visual settings
- Add HIST_IGNORE_SPACE option to prevent saving sensitive commands
- Document Natera machine setup with private config template in README

.gitignore

@@ -0,0 +1,2 @@
+# Local Natera config with account IDs, IPs, and internal paths (never commit)
+zshrc-natera.private

README.md

@@ -119,7 +119,19 @@ The Brewfile installs **MesloLGS NF** (Nerd Font). Set this as your terminal fon
 - **iTerm2**: Preferences > Profiles > Text > Font > MesloLGS NF
 - **Terminal.app**: Preferences > Profiles > Font > Change > MesloLGS NF
 
-## 13. Set up work git identity
+## 13. Optional: Natera / work machine setup
+
+On Natera machines, the main `zshrc` automatically sources `~/dotfiles/zshrc-natera` if that file exists. That file adds work-specific aliases, Claude/Bedrock and OTEL env vars, and a `refresh` command for SSO + tunnel.
+
+To enable the parts that use sensitive values (AWS profile, OTEL endpoint, Netskope cert paths, tunnel details), create a **private** config file that is gitignored and never committed:
+
+```bash
+cp ~/dotfiles/zshrc-natera.private.example ~/dotfiles/zshrc-natera.private
+```
+
+Edit `zshrc-natera.private` and replace the placeholders with your real values. `zshrc-natera` sources this file when present.
+
+## 14. Set up work git identity
 
 The `.gitconfig` uses your personal email by default. For work repos, create `~/.gitconfig-work`:
 
@@ -132,7 +144,7 @@ EOF
 
 Any repos cloned under `~/work/` will automatically use your work email. Clone personal projects elsewhere.
 
-## 14. Language version managers
+## 15. Language version managers
 
 The dotfiles configure these version managers — install runtimes as needed:
 
@@ -163,7 +175,10 @@ The `bin/` directory contains custom git subcommands that are symlinked into `~/
 
 | File | Purpose |
 |------|---------|
-| `zshrc` | Main zsh config: plugins, aliases, key bindings, functions |
+| `zshrc` | Main zsh config: plugins, aliases, key bindings; sources `zshrc-dev` and `zshrc-natera` when present |
+| `zshrc-dev` | Developer enhancements (optional): rg wrapper, git helpers, project helpers |
+| `zshrc-natera` | Natera-specific config (optional): work aliases, Claude/Bedrock, OTEL; sources `zshrc-natera.private` when present |
+| `zshrc-natera.private.example` | Template for sensitive Natera values; copy to `zshrc-natera.private` and fill in (gitignored) |
 | `zshenv` | PATH and version manager init (runs for all shell types) |
 | `p10k.zsh` | Powerlevel10k prompt theme config |
 | `bashrc` | Bash config (NVM, Docker, fzf) |

gitconfig

@@ -1,6 +1,7 @@
 [user]
 	name = Eric Wagoner
 	email = ewagoner@gmail.com
+	signingkey = F43B105D9B88A97F
 [credential]
 	helper = osxkeychain
 [mergetool]
@@ -15,6 +16,7 @@
 	required = true
 [core]
 	excludesfile = ~/.gitignore_global
+	pager = delta
 [alias]
 	co = checkout
 	ci = commit
@@ -49,3 +51,18 @@
 # Use work email for repos under ~/work/
 [includeIf "gitdir:~/work/"]
 	path = ~/.gitconfig-work
+[commit]
+	gpgsign = true
+
+[interactive]
+	diffFilter = delta --color-only
+
+[delta]
+	navigate = true
+	light = false
+	side-by-side = true
+	line-numbers = true
+	syntax-theme = Dracula
+
+[merge]
+	conflictstyle = diff3

zshrc

@@ -36,6 +36,7 @@ setopt HIST_FIND_NO_DUPS      # Don't display duplicates when searching
 setopt HIST_REDUCE_BLANKS     # Remove unnecessary blanks
 setopt INC_APPEND_HISTORY     # Add commands to history immediately
 setopt EXTENDED_HISTORY       # Record command start time and duration
+setopt HIST_IGNORE_SPACE      # Don't save commands starting with space (for sensitive commands)
 
 # Directory Navigation
 setopt AUTO_CD                # Change directories without typing cd
@@ -154,7 +155,6 @@ alias h='history'
 alias path='echo -e ${PATH//:/\\n}'  # Pretty print PATH
 alias now='date +"%T"'
 alias nowdate='date +"%d-%m-%Y"'
-
 [ -f ~/.fzf.zsh ] && source ~/.fzf.zsh
 
 # Docker CLI completions
@@ -163,3 +163,9 @@ if [[ -d "$HOME/.docker/completions" ]]; then
 fi
 autoload -Uz compinit
 compinit
+
+# Developer enhancements
+[[ -f ~/dotfiles/zshrc-dev ]] && source ~/dotfiles/zshrc-dev
+
+# Natera-specific config (loaded last; only on Natera machines when this file exists)
+[[ -f ~/dotfiles/zshrc-natera ]] && source ~/dotfiles/zshrc-natera

zshrc-dev

@@ -0,0 +1,592 @@
+# Developer Quality-of-Life Enhancements
+# Sourced from main .zshrc
+
+# ============================================================================
+# Modern CLI Tool Replacements & Configuration
+# ============================================================================
+
+# Use ripgrep for faster grep
+alias grep='rg'
+rg() {
+  command rg --smart-case --pretty "$@"
+}
+
+# Better cat with syntax highlighting
+alias cat='bat --style=auto'
+alias catt='/bin/cat'  # Original cat if needed
+
+# eza as ls alternative (more features than lsd)
+if command -v eza &> /dev/null; then
+    alias ls='eza --icons --group-directories-first'
+    alias ll='eza -lah --icons --group-directories-first --git'
+    alias la='eza -a --icons --group-directories-first'
+    alias lt='eza --tree --level=2 --icons'
+    alias ltree='eza --tree --icons'
+fi
+
+# ============================================================================
+# Git Enhancements (GitLab-focused)
+# ============================================================================
+
+# Quick status aliases
+alias gs='git status -sb'
+alias gst='git status'
+alias gd='git diff'
+alias gdc='git diff --cached'
+alias gds='git diff --stat'
+
+# Branch management
+alias gb='git branch -vv'
+alias gba='git branch -a -vv'
+alias gbd='git branch -d'
+alias gbD='git branch -D'
+alias gcb='git checkout -b'
+alias gco='git checkout'
+alias gcp='git cherry-pick'
+
+# Log aliases with beautiful formatting
+alias glog='git log --oneline --decorate --graph --all'
+alias gloga='git log --oneline --decorate --graph --all --author'
+alias glogg='git log --graph --pretty=format:"%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset" --abbrev-commit'
+alias glast='git log -1 HEAD --stat'
+alias gwhat='git show'
+
+# Commit shortcuts
+alias gc='git commit -v'
+alias gca='git commit -v -a'
+alias gcm='git commit -m'
+alias gcam='git commit -a -m'
+alias gcan='git commit --amend --no-edit'
+alias gcaa='git commit -a --amend --no-edit'
+
+# Push/Pull
+alias gp='git push'
+alias gpl='git pull'
+alias gpf='git push --force-with-lease'  # Safer force push
+alias gpr='git pull --rebase'
+
+# Stash operations
+alias gsta='git stash push'
+alias gstaa='git stash apply'
+alias gstap='git stash pop'
+alias gstl='git stash list'
+alias gsts='git stash show --text'
+
+# GitLab CLI shortcuts
+alias gl='glab'
+alias glmr='glab mr'
+alias glmrc='glab mr create'
+alias glmrv='glab mr view'
+alias glmrl='glab mr list'
+alias gli='glab issue'
+alias glic='glab issue create'
+alias gliv='glab issue view'
+alias glil='glab issue list'
+alias glp='glab pipeline'
+alias glr='glab repo'
+
+# ============================================================================
+# Smart Git Functions
+# ============================================================================
+
+# Unalias any conflicting aliases before defining functions
+unalias gsw 2>/dev/null
+unalias gfind 2>/dev/null
+unalias gdiff 2>/dev/null
+unalias gclean 2>/dev/null
+
+# Quick commit with branch name prefix
+qc() {
+    local branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+    if [[ -z "$branch" ]]; then
+        echo "Not in a git repository"
+        return 1
+    fi
+
+    if [[ "$branch" == "main" ]] || [[ "$branch" == "master" ]]; then
+        git commit -m "$*"
+    else
+        git commit -m "[$branch] $*"
+    fi
+}
+
+# Quick add and commit
+qac() {
+    git add -A && qc "$*"
+}
+
+# Show files changed in last commit
+changed() {
+    git show --stat --oneline HEAD
+}
+
+# Interactive branch switcher with fzf
+gsw() {
+    local branch
+    branch=$(git branch -a | fzf | sed 's/^[ *]*//' | sed 's/remotes\/origin\///')
+    if [[ -n "$branch" ]]; then
+        git checkout "$branch"
+    fi
+}
+
+# Find commits by message
+gfind() {
+    if [[ -z "$1" ]]; then
+        echo "Usage: gfind <search-term>"
+        return 1
+    fi
+    git log --all --grep="$1" --oneline --decorate
+}
+
+# Show git diff with delta if available
+gdiff() {
+    if command -v delta &> /dev/null; then
+        git diff "$@" | delta
+    else
+        git diff "$@"
+    fi
+}
+
+# Clean up merged branches
+gclean() {
+    echo "Fetching and pruning..."
+    git fetch -p
+    printf '\nBranches merged into current branch:\n'
+    git branch --merged | command grep -v '^ *\*' | command grep -v -E '^  (main|master|develop)$'
+    printf '\nDelete these branches? (y/n)\n'
+    read -r response
+    if [[ "$response" =~ ^[Yy]$ ]]; then
+        git branch --merged | command grep -v '^ *\*' | command grep -v -E '^  (main|master|develop)$' | xargs -n 1 git branch -d
+        echo "Cleaned up merged branches!"
+    fi
+}
+
+# ============================================================================
+# Work Directory Navigation & Project Management
+# ============================================================================
+
+# Quick jump to work directory
+alias work='cd ~/work'
+alias w='cd ~/work'
+
+# Project quick-jump function
+p() {
+    if [[ -z "$1" ]]; then
+        cd ~/work && ls -la
+        return
+    fi
+
+    local project_dir=$(find ~/work -maxdepth 1 -type d -iname "*$1*" -print -quit 2>/dev/null)
+
+    if [[ -n "$project_dir" ]]; then
+        if cd "$project_dir"; then
+            echo "📂 Switched to: $(basename "$project_dir")"
+            # Show quick project info
+            [[ -f "package.json" ]] && echo "📦 Node.js project"
+            [[ -f "requirements.txt" ]] && echo "🐍 Python project"
+            [[ -f "Cargo.toml" ]] && echo "🦀 Rust project"
+            [[ -f "go.mod" ]] && echo "🐹 Go project"
+            [[ -d ".git" ]] && echo "🔀 Git: $(git rev-parse --abbrev-ref HEAD 2>/dev/null)"
+        else
+            echo "❌ Failed to change to: $project_dir"
+        fi
+    else
+        echo "❌ Project not found: $1"
+        echo "Available projects:"
+        ls -1 ~/work
+    fi
+}
+
+# Enhanced project jump with fzf selection
+pf() {
+    local project
+    project=$(find ~/work -mindepth 1 -maxdepth 1 -type d | xargs -n 1 basename | fzf --height 40% --reverse --prompt="Select project: ")
+
+    if [[ -n "$project" ]]; then
+        p "$project"
+    fi
+}
+
+# Show status of all work projects
+pstatus() {
+    printf '📊 Project Status Overview\n\n'
+    for dir in ~/work/*/; do
+        dir="${dir%/}"
+        if [[ -d "$dir/.git" ]]; then
+            if cd "$dir"; then
+                local project=$(basename "$dir")
+                local branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+                local changes=$(git status --porcelain 2>/dev/null | wc -l | tr -d ' ')
+                local stashes=$(git stash list 2>/dev/null | wc -l | tr -d ' ')
+
+                echo "📁 $project"
+                echo "   Branch: $branch"
+
+                if [[ "$changes" -gt 0 ]]; then
+                    echo "   ⚠️  Changes: $changes files modified"
+                else
+                    echo "   ✅ Clean working directory"
+                fi
+
+                [[ "$stashes" -gt 0 ]] && echo "   💾 Stashes: $stashes"
+                echo ""
+            fi
+        fi
+    done
+    cd ~/work
+}
+
+# Pull latest for all projects
+pup() {
+    printf '🔄 Updating all projects in ~/work\n\n'
+    for dir in ~/work/*/; do
+        dir="${dir%/}"
+        if [[ -d "$dir/.git" ]]; then
+            if cd "$dir"; then
+                local project=$(basename "$dir")
+                echo "📁 $project"
+                git pull --rebase || echo "   ⚠️  Failed to update"
+                echo ""
+            fi
+        fi
+    done
+    cd ~/work
+}
+
+# Show uncommitted changes across all projects
+puncommitted() {
+    printf '🔍 Checking for uncommitted changes...\n\n'
+    local found=false
+    for dir in ~/work/*/; do
+        dir="${dir%/}"
+        if [[ -d "$dir/.git" ]]; then
+            if cd "$dir"; then
+                if [[ -n $(git status --porcelain 2>/dev/null) ]]; then
+                    found=true
+                    local project=$(basename "$dir")
+                    echo "📁 $project"
+                    git status -sb
+                    echo ""
+                fi
+            fi
+        fi
+    done
+
+    if [[ "$found" == "false" ]]; then
+        echo "✅ All projects have clean working directories"
+    fi
+    cd ~/work
+}
+
+# Create new project with git initialization
+pnew() {
+    if [[ -z "$1" ]]; then
+        echo "Usage: pnew <project-name>"
+        return 1
+    fi
+
+    local project_path="$HOME/work/$1"
+    if [[ -d "$project_path" ]]; then
+        echo "❌ Project already exists: $1"
+        return 1
+    fi
+
+    mkdir -p "$project_path"
+    cd "$project_path"
+    git init
+    echo "# $1" > README.md
+    echo "✅ Created new project: $1"
+    echo "📂 Location: $project_path"
+}
+
+# ============================================================================
+# Development Utilities
+# ============================================================================
+
+# Quick HTTP server for current directory
+serve() {
+    local port="${1:-8000}"
+    echo "🌐 Starting server on http://localhost:$port"
+    python3 -m http.server "$port"
+}
+
+# Find file by name in work directory
+fw() {
+    if [[ -z "$1" ]]; then
+        echo "Usage: fw <filename-pattern>"
+        return 1
+    fi
+    fd "$1" ~/work
+}
+
+# Find in files (content search) in work directory
+fiw() {
+    if [[ -z "$1" ]]; then
+        echo "Usage: fiw <search-pattern>"
+        return 1
+    fi
+    rg "$1" ~/work
+}
+
+# Quick look at package.json scripts
+scripts() {
+    if [[ -f "package.json" ]]; then
+        jq -r '.scripts | to_entries[] | "\(.key): \(.value)"' package.json
+    else
+        echo "No package.json found in current directory"
+    fi
+}
+
+# Show recently modified files
+recent() {
+    local count="${1:-10}"
+    fd --type f --changed-within 24h . | head -n "$count"
+}
+
+# Disk usage of current directory
+duu() {
+    du -sh * | sort -hr | head -20
+}
+
+# Find large files
+large() {
+    local size="${1:-100M}"
+    echo "Finding files larger than $size..."
+    fd --type f --size "+$size" --exec ls -lh {} \; | awk '{print $5, $9}'
+}
+
+# Kill process by port
+killport() {
+    if [[ -z "$1" ]]; then
+        echo "Usage: killport <port>"
+        return 1
+    fi
+    local pids
+    pids=$(lsof -ti:"$1" 2>/dev/null)
+    if [[ -n "$pids" ]]; then
+        echo "$pids" | xargs kill -9 2>/dev/null && echo "✅ Killed process on port $1"
+    else
+        echo "❌ No process found on port $1"
+    fi
+}
+
+# Create directory and cd into it
+mkcd() {
+    mkdir -p "$1" && cd "$1"
+}
+
+# Extract various archive formats
+extract() {
+    if [[ -f "$1" ]]; then
+        case "$1" in
+            *.tar.bz2)   tar xjf "$1"     ;;
+            *.tar.gz)    tar xzf "$1"     ;;
+            *.bz2)       bunzip2 "$1"     ;;
+            *.rar)       unrar x "$1"     ;;
+            *.gz)        gunzip "$1"      ;;
+            *.tar)       tar xf "$1"      ;;
+            *.tbz2)      tar xjf "$1"     ;;
+            *.tgz)       tar xzf "$1"     ;;
+            *.zip)       unzip "$1"       ;;
+            *.Z)         uncompress "$1"  ;;
+            *.7z)        7z x "$1"        ;;
+            *)           echo "'$1' cannot be extracted via extract()" ;;
+        esac
+    else
+        echo "'$1' is not a valid file"
+    fi
+}
+
+# Backup a file
+backup() {
+    if [[ -f "$1" ]]; then
+        cp "$1" "$1.backup.$(date +%Y%m%d_%H%M%S)"
+        echo "✅ Backup created: $1.backup.$(date +%Y%m%d_%H%M%S)"
+    else
+        echo "❌ File not found: $1"
+    fi
+}
+
+# ============================================================================
+# Node.js / NPM Shortcuts
+# ============================================================================
+
+alias ni='npm install'
+alias nid='npm install --save-dev'
+alias nr='npm run'
+alias nrd='npm run dev'
+alias nrb='npm run build'
+alias nrt='npm run test'
+alias nrs='npm run start'
+alias nrl='npm run lint'
+alias nrc='npm run clean'
+alias nu='npm update'
+alias nci='rm -rf node_modules package-lock.json && npm install'
+
+# List available npm scripts
+alias npmscripts='command cat package.json | jq .scripts'
+
+# ============================================================================
+# Kubernetes / Docker (if needed)
+# ============================================================================
+
+alias d='docker'
+alias dc='docker-compose'
+alias dps='docker ps'
+alias dpsa='docker ps -a'
+alias di='docker images'
+alias dex='docker exec -it'
+alias dlog='docker logs -f'
+alias dclean='docker system prune -af'
+
+# ============================================================================
+# Enhanced FZF Integration
+# ============================================================================
+
+# Improved FZF default options for developers
+export FZF_DEFAULT_OPTS="
+  --height 50%
+  --layout=reverse
+  --border
+  --preview-window=right:60%
+  --bind ctrl-/:toggle-preview
+  --bind ctrl-u:preview-page-up
+  --bind ctrl-d:preview-page-down
+"
+
+# Better file preview with bat
+export FZF_CTRL_T_OPTS="
+  --preview 'bat --color=always --style=numbers --line-range=:500 {}'
+  --preview-window 'right:60%:wrap'
+"
+
+# Better directory preview
+export FZF_ALT_C_OPTS="
+  --preview 'eza --tree --level=2 --icons {} || tree -C {} | head -200'
+"
+
+# CD to any directory in ~/work with fzf
+cdw() {
+    local dir
+    dir=$(fd --type d --max-depth 5 . ~/work | fzf +m --preview 'eza --tree --level=1 --icons {}')
+    if [[ -n "$dir" ]]; then
+        cd "$dir"
+    fi
+}
+
+# ============================================================================
+# Completion Enhancements
+# ============================================================================
+
+# GitLab CLI completions
+if command -v glab &> /dev/null; then
+    eval "$(glab completion -s zsh)"
+fi
+
+# Directory navigation autocomplete for 'p' function
+_p_completion() {
+    local projects
+    projects=($(command ls -1 ~/work 2>/dev/null))
+    _describe 'projects' projects
+}
+compdef _p_completion p
+
+# ============================================================================
+# Performance Monitoring
+# ============================================================================
+
+# Show shell startup time
+timezsh() {
+    shell=${1-$SHELL}
+    for i in $(seq 1 10); do /usr/bin/time $shell -i -c exit; done
+}
+
+# Show top 10 most used commands
+alias topcmd="history | awk '{print \$2}' | sort | uniq -c | sort -rn | head -10"
+
+# ============================================================================
+# Helpful Aliases
+# ============================================================================
+
+alias reload='source ~/.zshrc && echo "✅ Shell configuration reloaded"'
+alias editrc='cursor ~/dotfiles/zshrc'
+alias editdev='cursor ~/dotfiles/zshrc-dev'
+alias c='clear'
+alias cls='clear'
+alias ..='cd ..'
+alias ...='cd ../..'
+alias ....='cd ../../..'
+alias ports='lsof -PiTCP -sTCP:LISTEN'
+alias myip='curl -s ifconfig.me'
+alias speedtest='curl -s https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py | python3 -'
+
+# ============================================================================
+# Colorized Man Pages
+# ============================================================================
+
+export LESS_TERMCAP_mb=$'\e[1;32m'
+export LESS_TERMCAP_md=$'\e[1;32m'
+export LESS_TERMCAP_me=$'\e[0m'
+export LESS_TERMCAP_se=$'\e[0m'
+export LESS_TERMCAP_so=$'\e[01;33m'
+export LESS_TERMCAP_ue=$'\e[0m'
+export LESS_TERMCAP_us=$'\e[1;4;31m'
+
+echo "💻 Developer enhancements loaded! Type 'devhelp' for quick reference."
+
+# Show available custom commands
+devhelp() {
+    cat << 'EOF'
+🚀 Developer Shell Enhancements - Quick Reference
+
+📂 PROJECT NAVIGATION:
+  work, w           → cd to ~/work
+  p <name>          → Quick jump to project
+  pf                → Fuzzy find and jump to project
+  pstatus           → Show status of all projects
+  pup               → Pull latest for all projects
+  puncommitted      → Show uncommitted changes across projects
+  pnew <name>       → Create new project with git init
+  cdw               → Fuzzy find any directory in ~/work
+
+🔀 GIT SHORTCUTS:
+  gs, gst           → git status
+  gd                → git diff
+  glog              → Pretty git log graph
+  gc <msg>          → Quick commit
+  qc <msg>          → Commit with branch prefix
+  qac <msg>         → Add all + commit with prefix
+  gsw               → Interactive branch switcher
+  gclean            → Clean up merged branches
+  gfind <term>      → Find commits by message
+
+🔧 GITLAB CLI:
+  gl                → glab command
+  glmr              → Merge requests
+  glmrc             → Create MR
+  gli               → Issues
+  glp               → Pipelines
+
+📦 NPM SHORTCUTS:
+  ni, nid           → npm install
+  nr <script>       → npm run
+  nrd, nrb, nrt     → dev, build, test
+  scripts           → Show package.json scripts
+
+🛠️  UTILITIES:
+  fw <name>         → Find file in ~/work
+  fiw <term>        → Find in files (grep ~/work)
+  killport <port>   → Kill process on port
+  serve [port]      → Start HTTP server
+  recent [n]        → Show recently modified files
+  large [size]      → Find large files
+  backup <file>     → Create timestamped backup
+
+⚡️ SYSTEM:
+  reload            → Reload shell config
+  editrc, editdev   → Edit config files
+  devhelp           → Show this help
+
+For more info on any command, type: which <command>
+EOF
+}

zshrc-natera

@@ -0,0 +1,33 @@
+# Natera-specific environment and tooling
+# Sourced last from .zshrc on Natera machines (when this file is present).
+# All Natera config lives here only.
+
+# PATH for Natera/Claude tooling
+export PATH="$HOME/.local/bin:$PATH"
+
+# Claude Code (Bedrock)
+export CLAUDE_CODE_USE_BEDROCK=1
+export AWS_REGION=us-west-2
+export ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION=us-west-2
+export ANTHROPIC_MODEL="us.anthropic.claude-sonnet-4-5-20250929-v1:0"
+export ANTHROPIC_SMALL_FAST_MODEL="us.anthropic.claude-haiku-4-5-20251001-v1:0"
+export CLAUDE_CODE_ENABLE_TELEMETRY=1
+export CLAUDE_CODE_MAX_OUTPUT_TOKENS=4096
+export MAX_THINKING_TOKENS=1024
+
+# OpenTelemetry (Natera staging)
+export OTEL_METRICS_EXPORTER=otlp
+export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
+export OTEL_RESOURCE_ATTRIBUTES="user.email=$USER@natera.com"
+
+# Project-specific aliases
+alias workbench='cd ~/work/rosalis'
+alias core='cd ~/work/yalp-core'
+alias histo='cd ~/work/yalp-histology'
+alias pipeline='cd ~/work/yalp-pipeline-integration'
+alias assayapi='cd ~/work/yalp-assay-qc-api'
+alias assay='cd ~/work/yalp-assay-qc'
+
+# Sensitive values (AWS profile, OTEL endpoint, cert paths, refresh alias) are in zshrc-natera.private
+# Copy zshrc-natera.private.example to zshrc-natera.private and fill in. That file is gitignored.
+[[ -f ~/dotfiles/zshrc-natera.private ]] && source ~/dotfiles/zshrc-natera.private

zshrc-natera.private.example

@@ -0,0 +1,21 @@
+# Natera-sensitive configuration (do not commit the real file)
+# Copy this file to zshrc-natera.private and fill in the placeholders.
+# zshrc-natera.private is gitignored.
+
+# AWS profile (contains account ID)
+export AWS_PROFILE="YOUR_AWS_PROFILE_NAME"
+
+# OpenTelemetry endpoint (internal)
+export OTEL_EXPORTER_OTLP_ENDPOINT="http://YOUR_OTEL_ENDPOINT:4318"
+
+# Netskope TLS cert bundle path (Natera corp)
+export AWS_CA_BUNDLE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export REQUESTS_CA_BUNDLE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export SSL_CERT_FILE=~/.aws/nskp_config/netskope-cert-bundle.pem
+export NODE_EXTRA_CA_CERTS=~/.aws/nskp_config/netskope-cert-bundle.pem
+
+# Refresh: close tunnel if open, then SSO login + jumpbox + boring open (replace placeholders)
+refresh() {
+  boring close YOUR_BORING_TARGET 2>/dev/null
+  aws sso login && ssh -i ~/work/pems/YOUR_JUMPBOX_PEM ec2-user@JUMPBOX_IP exit && boring open YOUR_BORING_TARGET
+}