Dotfiles

This repository is managed with chezmoi. The local chezmoi source directory is expected to be:

~/.local/share/chezmoi

Bootstrap

Use install.sh on a fresh machine before chezmoi is available:

sh install.sh

The script installs Homebrew and chezmoi, then prints the next commands. It does not run chezmoi init or chezmoi apply.

After cloning or initializing this repo:

chezmoi init <repo-url>
chezmoi apply

Profiles

Machine-specific behavior is selected with brewProfile:

• common: baseline setup
• personal: common plus personal tools
• work: common plus work tools

Common setup always applies. A machine should normally use only one optional profile.

Managed Areas

Homebrew packages are split by profile and OS. Bootstrap always installs the common packages first, then the selected profile, using brew bundle --no-upgrade. Cask app bundles default to ~/Applications through Homebrew's user environment file and Brewfile cask_args, with explicit /Applications exceptions for apps that expect system-wide placement. Casks that use privileged package installers may still require admin credentials. Work profile bootstrap also trusts the Heroku Homebrew tap before installing work packages; Homebrew trust state remains external local state rather than a checked-in dotfile.

Shell startup files keep Homebrew login setup before interactive tool activation. Fish owns its profile buckets, Fisher plugin lists, and a small set of reusable functions/completions; zsh and bash own minimal startup files that source shared toolchain helpers. Zsh also loads a one-shot mise environment for non-interactive IDE run configs. Common shell setup puts ~/.local/bin on the path for managed user commands. Generated Fisher plugin output is intentionally not checked in.

Common fish setup supplies the 1Password SSH agent to Herdr on macOS when the inherited agent is unset or is the default launchd agent. The override is local to the command and preserves custom or SSH-forwarded agents. It does not restart an existing Herdr server or replace that server's selected upstream agent.

Editor behavior is managed at two levels: portable text rules live in .editorconfig, while macOS-only application defaults are written with small idempotent scripts. Source-controlled Terminal and iTerm2 themes are imported during macOS setup, with FishTank and the Homebrew-managed FiraCode Nerd Font Mono configured as the defaults for both apps.

Agent tooling is shared through ~/.agents/skills, with Codex and OpenCode pointing at that shared skill bucket. External skills are selected by the same common/personal/work profile model and installed for Codex and OpenCode with npx skills; applying a profile adds or refreshes cataloged skills but never removes manually installed ones. Tool integrations are installed with idempotent scripts that check for the relevant binary and no-op with a clear skip message when absent.

This repo also configures a repo-local Git hook path. The pre-commit hook scans staged content with gitleaks and runs the language formatters we rely on for fish and shell files. Git uses its XDG layout: personal global exclusions are managed through ~/.config/git/ignore, while ~/.config/git/config remains local to each machine.

Not Managed

These are deliberately outside chezmoi ownership:

• Secrets, private keys, resolved tokens, and secret-bearing env files
• Local Git identity, signing, credential-helper, and generated configuration in ~/.config/git/config
• Local Codex config, auth, trust, cache, session, and database state
• Generated plugin output and other reproducible tool-generated files
• Whole macOS preference plists
• Project-specific configuration that belongs in each project

Use 1Password, op run, or command-scoped wrappers for secrets rather than committing them to this repository.