@sebastienrousseau/dotfiles 0.2.501 → 0.2.503

package/scripts/diagnostics/mcp-doctor.sh

@@ -31,9 +31,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 # Parse arguments
 STRICT_MODE=0
@@ -93,14 +93,17 @@ log_warn() {
 }
 
 MCP_CONFIG="${MCP_CONFIG:-$HOME/.config/claude/mcp_servers.json}"
-if [[ ! -f "$MCP_CONFIG" && -f "$HOME/.dotfiles/dot_config/claude/mcp_servers.json" ]]; then
-  MCP_CONFIG="$HOME/.dotfiles/dot_config/claude/mcp_servers.json"
+if [[ ! -f "$MCP_CONFIG" ]]; then
+  for cand in "$HOME/.dotfiles/defaults/dot_config/claude/mcp_servers.json" \
+    "$HOME/.dotfiles/dot_config/claude/mcp_servers.json"; do
+    [[ -f "$cand" ]] && MCP_CONFIG="$cand" && break
+  done
 fi
 
 REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-MCP_POLICY_CONFIG="${MCP_POLICY_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-policy.json}"
-MCP_LOCK_CONFIG="${MCP_LOCK_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-lock.json}"
-MCP_REGISTRY_CONFIG="${MCP_REGISTRY_CONFIG:-$REPO_ROOT/dot_config/dotfiles/mcp-registry.json}"
+MCP_POLICY_CONFIG="${MCP_POLICY_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-policy.json}"
+MCP_LOCK_CONFIG="${MCP_LOCK_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-lock.json}"
+MCP_REGISTRY_CONFIG="${MCP_REGISTRY_CONFIG:-$REPO_ROOT/defaults/dot_config/dotfiles/mcp-registry.json}"
 
 if [[ "$JSON_MODE" -ne 1 ]]; then
   ui_init

package/scripts/diagnostics/perf.sh

@@ -9,12 +9,12 @@ _cleanup_files=()
 trap 'rm -f "${_cleanup_files[@]}"' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="perf"
 
 ui_init

package/scripts/diagnostics/scorecard.sh

@@ -6,12 +6,12 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="scorecard"
 
 ui_init

package/scripts/diagnostics/security-score.sh

@@ -30,9 +30,9 @@ set -euo pipefail
 set +o xtrace 2>/dev/null || true
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 # Parse arguments
 VERBOSE=true

package/scripts/diagnostics/smoke-test.sh

@@ -5,9 +5,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 ui_header "Dotfiles Smoke Tests"

package/scripts/diagnostics/snapshot.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/diagnostics/verify.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_dot_banner "Diagnostics"
@@ -43,8 +43,8 @@ resolve_dot_bin() {
   elif [[ -d "$HOME/.local/share/chezmoi" ]]; then
     src_dir="$HOME/.local/share/chezmoi"
   fi
-  if [[ -n "$src_dir" && -x "$src_dir/dot_local/bin/executable_dot" ]]; then
-    printf "%s\n" "$src_dir/dot_local/bin/executable_dot"
+  if [[ -n "$src_dir" && -x "$src_dir/bin/dot" ]]; then
+    printf "%s\n" "$src_dir/bin/dot"
     return
   fi
   return 1

package/scripts/diagnostics/version-locks.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/diagnostics/workstation-attestation.sh

@@ -13,12 +13,12 @@ REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 # without the env-prefix dance that confuses shellcheck (SC2097/SC2098).
 export REPO_ROOT
 
-# shellcheck source=../dot/lib/ui.sh
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/platform.sh
-source "$SCRIPT_DIR/../dot/lib/platform.sh"
-# shellcheck source=../dot/lib/utils.sh
-source "$SCRIPT_DIR/../dot/lib/utils.sh"
+# shellcheck source=../../lib/dot/ui.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/platform.sh
+source "$SCRIPT_DIR/../../lib/dot/platform.sh"
+# shellcheck source=../../lib/dot/utils.sh
+source "$SCRIPT_DIR/../../lib/dot/utils.sh"
 
 JSON_MODE=0
 WRITE_PATH=""
@@ -72,14 +72,14 @@ platform_id="$(dot_platform_id)"
 host_os="$(dot_host_os)"
 arch="$(uname -m)"
 hostname_value="$(hostname 2>/dev/null || true)"
-agent_profile_file="$REPO_ROOT/dot_config/dotfiles/agent-profiles.json"
-agent_card_file="$REPO_ROOT/dot_config/dotfiles/agent-card.json"
+agent_profile_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-profiles.json"
+agent_card_file="$REPO_ROOT/defaults/dot_config/dotfiles/agent-card.json"
 agent_state_file="${AGENT_STATE_FILE:-$HOME/.config/dotfiles/agent-mode.env}"
-policy_bundles_file="$REPO_ROOT/dot_config/dotfiles/policy-bundles.json"
-model_registry_file="$REPO_ROOT/dot_config/dotfiles/model-registry.json"
-prompt_registry_file="$REPO_ROOT/dot_config/dotfiles/prompt-registry.json"
-mcp_policy_file="$REPO_ROOT/dot_config/dotfiles/mcp-policy.json"
-mcp_registry_file="$REPO_ROOT/dot_config/dotfiles/mcp-registry.json"
+policy_bundles_file="$REPO_ROOT/defaults/dot_config/dotfiles/policy-bundles.json"
+model_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/model-registry.json"
+prompt_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/prompt-registry.json"
+mcp_policy_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-policy.json"
+mcp_registry_file="$REPO_ROOT/defaults/dot_config/dotfiles/mcp-registry.json"
 signing_format="$(git config --global gpg.format 2>/dev/null || echo ssh)"
 signing_key="$(git config --global user.signingkey 2>/dev/null || true)"
 allowed_signers="$(git config --global gpg.ssh.allowedSignersFile 2>/dev/null || echo "$HOME/.config/git/allowed_signers")"
@@ -94,7 +94,7 @@ if [[ -z "$current_profile" ]] && [[ -f "$agent_profile_file" ]]; then
   current_profile="$(jq -r '.defaultProfile // "ask"' "$agent_profile_file")"
 fi
 
-MCP_CONFIG="$REPO_ROOT/dot_config/claude/mcp_servers.json"
+MCP_CONFIG="$REPO_ROOT/defaults/dot_config/claude/mcp_servers.json"
 export MCP_CONFIG
 mcp_summary="$(bash "$REPO_ROOT/scripts/diagnostics/mcp-doctor.sh" --strict --json)"
 

package/scripts/dot/commands/agent.sh

@@ -9,6 +9,14 @@ set -euo pipefail
 # These functions are sourced by meta.sh for dispatch.
 
 _agent_repo_root() {
+  # Post-Phase-4b: agent profile/card JSON ships under defaults/dot_config/.
+  # Prefer the chezmoi source dir so callers can append dot_config/... directly.
+  local dir
+  dir="$(resolve_chezmoi_source_dir)"
+  [[ -n "$dir" ]] && {
+    printf '%s\n' "$dir"
+    return
+  }
   require_source_dir
 }
 
@@ -218,14 +226,15 @@ EOF
       checkpoint_id="$(basename "$checkpoint_file" .json)"
       ui_info "Agent mode" "$name"
       dot_agent_session_log "run_start" "$name" "running" "argv=$*" "checkpoint_id=$checkpoint_id"
-      set +e
-      "$@"
-      local exit_code=$?
-      set -e
-      if [[ "$exit_code" -eq 0 ]]; then
-        dot_agent_session_log "run_finish" "$name" "ok" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
-      else
+      # `if !` instead of `set +e / "$@" / set -e` — bash's errexit
+      # is automatically suspended inside a conditional, so we capture
+      # the exit code cleanly without toggling shell options.
+      local exit_code=0
+      if ! "$@"; then
+        exit_code=$?
         dot_agent_session_log "run_finish" "$name" "failed" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
+      else
+        dot_agent_session_log "run_finish" "$name" "ok" "exit_code=$exit_code" "checkpoint_id=$checkpoint_id"
       fi
       return "$exit_code"
       ;;
@@ -335,14 +344,12 @@ EOF
           [[ "${#replay_argv[@]}" -gt 0 ]] || die "Checkpoint has no replayable command: $checkpoint_id"
           _agent_apply_profile_env "$replay_profile"
           dot_agent_session_log "checkpoint_replay" "$replay_profile" "running" "checkpoint_id=$checkpoint_id"
-          set +e
-          "${replay_argv[@]}"
-          local exit_code=$?
-          set -e
-          if [[ "$exit_code" -eq 0 ]]; then
-            dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "ok" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
-          else
+          local exit_code=0
+          if ! "${replay_argv[@]}"; then
+            exit_code=$?
             dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "failed" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
+          else
+            dot_agent_session_log "checkpoint_replay_finish" "$replay_profile" "ok" "checkpoint_id=$checkpoint_id" "exit_code=$exit_code"
           fi
           return "$exit_code"
           ;;
@@ -382,16 +389,14 @@ EOF
       export DOT_AGENT_PARENT_PROFILE="$current_profile"
       dot_agent_session_log "delegate_start" "$delegate_profile" "running" "delegate=$delegate_name" "parent=$current_profile" "timeout=$delegate_timeout"
       ui_info "Delegating" "$delegate_name (profile: $delegate_profile, timeout: ${delegate_timeout}s)"
-      set +e
-      timeout "$delegate_timeout" "$@"
-      local exit_code=$?
-      set -e
-      if [[ "$exit_code" -eq 0 ]]; then
-        dot_agent_session_log "delegate_finish" "$delegate_profile" "ok" "delegate=$delegate_name" "exit_code=$exit_code"
-        ui_ok "Delegate" "$delegate_name completed"
-      else
+      local exit_code=0
+      if ! timeout "$delegate_timeout" "$@"; then
+        exit_code=$?
         dot_agent_session_log "delegate_finish" "$delegate_profile" "failed" "delegate=$delegate_name" "exit_code=$exit_code"
         ui_err "Delegate" "$delegate_name failed (exit $exit_code)"
+      else
+        dot_agent_session_log "delegate_finish" "$delegate_profile" "ok" "delegate=$delegate_name" "exit_code=$exit_code"
+        ui_ok "Delegate" "$delegate_name completed"
       fi
       return "$exit_code"
       ;;

package/scripts/dot/commands/agents.sh

@@ -0,0 +1,335 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck shell=bash
+#
+# scripts/dot/commands/agents.sh
+#
+# `dot agents` — multi-harness AI agent configuration manager.
+#
+# Closes the #1 competitive gap identified in HARD_AUDIT_2026:
+# every other dotfiles framework either targets one AI tool or
+# requires hand-maintenance of N parallel config files. This command
+# keeps CLAUDE.md (canonical) and AGENTS.md (cross-harness standard)
+# in sync, plus stubs the Cursor/Codex tool-specific formats.
+#
+# Subcommands:
+#   render   Regenerate AGENTS.md and tool-specific stubs from CLAUDE.md.
+#   check    Verify AGENTS.md tracks CLAUDE.md (exit 0 in sync, 1 drifted).
+#   list     Show which harnesses are recognised + their target paths.
+#
+# Reads:  CLAUDE.md (repo root) — the canonical agent context.
+# Writes: AGENTS.md, .cursor/rules/dotfiles.mdc, .codex/config.toml
+#         (only when invoked with `render`).
+
+set -euo pipefail
+
+# shellcheck disable=SC1091
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../../lib/dot/ui.sh"
+source "$SCRIPT_DIR/../../../lib/dot/utils.sh"
+
+_agents_repo_root() {
+  # Resolve the chezmoi source dir (where CLAUDE.md/AGENTS.md live).
+  # We REQUIRE the resolved dir to contain `.chezmoidata.toml` so a
+  # user running `dot agents render` from inside some other git
+  # checkout doesn't accidentally write CLAUDE.md/AGENTS.md/.cursor/
+  # /.codex/ into that repo. Round-2 audit C-finding.
+  #
+  # On a CI runner `chezmoi source-path` may return a default path
+  # like `$HOME/.local/share/chezmoi` that doesn't exist on disk —
+  # we treat that as "not a match" and fall through to git, rather
+  # than accepting the wrong candidate.
+  local candidate=""
+  # Sanity probe: post-Phase-4b the data file lives at
+  # defaults/.chezmoidata.toml; older deployments kept it at the root.
+  _has_chezmoidata() {
+    [[ -f "$1/.chezmoidata.toml" || -f "$1/defaults/.chezmoidata.toml" ]]
+  }
+  if command -v chezmoi >/dev/null 2>&1; then
+    candidate="$(chezmoi source-path 2>/dev/null || true)"
+    # chezmoi source-path returns defaults/ when .chezmoiroot is set;
+    # peel back one level so callers receive the actual repo root.
+    if [[ -n "$candidate" && -f "$candidate/.chezmoidata.toml" && "$(basename "$candidate")" == "defaults" ]]; then
+      candidate="$(dirname "$candidate")"
+    fi
+    if [[ -n "$candidate" ]] && ! _has_chezmoidata "$candidate"; then
+      candidate=""
+    fi
+  fi
+  if [[ -z "$candidate" ]]; then
+    candidate="$(git -C "$PWD" rev-parse --show-toplevel 2>/dev/null || true)"
+  fi
+  if [[ -z "$candidate" ]] || ! _has_chezmoidata "$candidate"; then
+    return 1
+  fi
+  printf '%s\n' "$candidate"
+}
+
+_agents_canonical() {
+  printf "%s/CLAUDE.md" "$(_agents_repo_root)"
+}
+
+_agents_targets() {
+  # printed one-per-line: <harness>\t<path-relative-to-repo-root>
+  # Closes the round-2 audit gap #3 — harness parity with
+  # TonyCasey/ai-dotfiles-manager (who covers 9 surfaces; we now
+  # cover 12 to maintain a margin).
+  local root
+  root="$(_agents_repo_root)"
+  cat <<EOF
+agents-md	$root/AGENTS.md
+cursor	$root/.cursor/rules/dotfiles.mdc
+codex	$root/.codex/config.toml
+windsurf	$root/.windsurf/rules.md
+zed	$root/.zed/agent-config.toml
+roo	$root/.roo/rules.md
+cline	$root/.clinerules
+aider	$root/.aider.conf.yml
+continue	$root/.continuerc.json
+jules	$root/.jules/system.md
+gemini	$root/.gemini/GEMINI.md
+EOF
+}
+
+# Strip the leading HTML comment header (everything up to the first blank
+# line after the `-->`), the H1 title line (which differs by design
+# between CLAUDE.md / AGENTS.md), and the trailing cross-reference
+# block. Leaves the comparable content body.
+_agents_body() {
+  local file="$1"
+  awk '
+    BEGIN { in_header = 0; saw_close = 0; emit = 0 }
+    /^<!--/ && NR <= 5 { in_header = 1; next }
+    in_header && /-->/ { in_header = 0; saw_close = 1; next }
+    in_header { next }
+    saw_close && /^$/ && !emit { emit = 1; next }
+    saw_close && emit { print }
+    !saw_close { emit = 1; print }
+  ' "$file" |
+    # Drop the H1 (`# CLAUDE.md ...` or `# AGENTS.md ...`) and the
+    # trailing "Need richer context?" footer if present.
+    awk '
+      /^# (CLAUDE|AGENTS)\.md/ { next }
+      /^---$/ { trailer = 1; next }
+      trailer && /^\*\*Need richer context\?\*\*/ { next }
+      trailer && NF == 0 { next }
+      { trailer = 0; print }
+    '
+}
+
+cmd_agents() {
+  local subcommand="${1:-list}"
+  shift || true
+
+  case "$subcommand" in
+    list)
+      ui_header "Agent harness targets"
+      echo ""
+      ui_table_begin "Harness" "Target Path" "Status"
+      while IFS=$'\t' read -r harness path; do
+        if [[ -f "$path" ]]; then
+          ui_table_add "$harness" "$path" "rendered"
+        else
+          ui_table_add "$harness" "$path" "not yet rendered"
+        fi
+      done < <(_agents_targets)
+      ui_table_end
+      ;;
+    check)
+      local claude_md agents_md
+      claude_md="$(_agents_canonical)"
+      agents_md="$(_agents_repo_root)/AGENTS.md"
+      if [[ ! -f "$claude_md" ]]; then
+        ui_err "CLAUDE.md" "not found at $claude_md"
+        return 2
+      fi
+      if [[ ! -f "$agents_md" ]]; then
+        ui_warn "AGENTS.md" "missing — run 'dot agents render'"
+        return 1
+      fi
+      # Diff the bodies (header comments differ by design).
+      # `--ignore-blank-lines` so the trailing newline from the footer
+      # block doesn't false-positive as drift.
+      if diff -q --ignore-blank-lines <(_agents_body "$claude_md") <(_agents_body "$agents_md") >/dev/null 2>&1; then
+        ui_ok "AGENTS.md" "in sync with CLAUDE.md"
+        return 0
+      fi
+      ui_warn "AGENTS.md" "drifted from CLAUDE.md — run 'dot agents render'"
+      return 1
+      ;;
+    render)
+      local claude_md root
+      claude_md="$(_agents_canonical)"
+      root="$(_agents_repo_root)"
+      [[ -f "$claude_md" ]] || {
+        ui_err "CLAUDE.md" "not found at $claude_md"
+        return 2
+      }
+
+      # 1. AGENTS.md — body of CLAUDE.md + AGENTS.md cross-reference header.
+      local agents_md="$root/AGENTS.md"
+      {
+        cat <<'HEADER'
+<!--
+  AGENTS.md — Cross-harness AI agent guidelines for this repository.
+
+  This file follows the AGENTS.md standard (originated by OpenAI in
+  August 2025, stewarded since December 2025 by the Linux Foundation
+  Agentic AI Foundation). Native readers: Codex CLI, GitHub Copilot,
+  Cursor, Windsurf, Amp, Devin, and a growing list of other agents.
+
+  Canonical source: CLAUDE.md (Claude Code uses CLAUDE.md natively).
+  This file is kept in sync via `dot agents render`. Edit CLAUDE.md
+  first; do not hand-edit AGENTS.md.
+-->
+
+HEADER
+        # Replace the title line so the rendered file declares its
+        # purpose, but pass everything else through unchanged.
+        _agents_body "$claude_md" | sed '1s/^# CLAUDE\.md.*/# AGENTS.md — AI Assistant Guidelines/'
+        cat <<'FOOTER'
+
+---
+
+**Need richer context?** This file is the cross-harness summary. Claude Code reads the full canonical version from [`CLAUDE.md`](./CLAUDE.md). Both files are kept in sync via `dot agents render`.
+FOOTER
+      } >"$agents_md"
+      chmod 0644 "$agents_md" 2>/dev/null || true
+      ui_ok "AGENTS.md" "rendered → $agents_md"
+
+      # 2. Cursor rules — MDC format, points at CLAUDE.md/AGENTS.md.
+      local cursor_dir="$root/.cursor/rules"
+      mkdir -p "$cursor_dir"
+      cat >"$cursor_dir/dotfiles.mdc" <<'MDC'
+---
+description: Repo conventions for the dotfiles project (sourced from CLAUDE.md/AGENTS.md)
+globs:
+  - "**/*"
+alwaysApply: true
+---
+
+See `AGENTS.md` and `CLAUDE.md` in the repository root for the full
+project conventions, repository layout, testing, and CI policy. This
+Cursor rule file exists so Cursor's rule engine picks up the same
+context; do not duplicate content here — keep CLAUDE.md canonical.
+MDC
+      chmod 0644 "$cursor_dir/dotfiles.mdc" 2>/dev/null || true
+      ui_ok "Cursor" "rendered → $cursor_dir/dotfiles.mdc"
+
+      # 3. Codex CLI config stub — declares the AGENTS.md path.
+      local codex_dir="$root/.codex"
+      mkdir -p "$codex_dir"
+      cat >"$codex_dir/config.toml" <<'TOML'
+# Codex CLI config — points at the AGENTS.md cross-harness context.
+# Codex reads AGENTS.md natively; this file is a project-scoped pin so
+# the CLI prefers the in-repo guidance over any global default.
+project_context = "AGENTS.md"
+TOML
+      chmod 0644 "$codex_dir/config.toml" 2>/dev/null || true
+      ui_ok "Codex" "rendered → $codex_dir/config.toml"
+
+      # 4-11. Per-harness rules files. All eight emitters reuse the
+      # same body extracted from CLAUDE.md so a single edit propagates
+      # consistently. The header differs per harness so each tool sees
+      # syntax it expects (front-matter style, comment block, etc.).
+      _agents_render_markdown_with_header() {
+        local _path="$1" _harness="$2" _header="$3"
+        mkdir -p "$(dirname "$_path")"
+        {
+          printf '%s\n\n' "$_header"
+          _agents_body "$claude_md"
+          # Heredoc instead of printf — Codacy/shellcheck flags
+          # printf-with-backticks-in-single-quotes (SC2016) as
+          # ambiguous even when the backticks are literal Markdown.
+          cat <<'FOOTER'
+
+---
+
+**Canonical source:** [`CLAUDE.md`](./CLAUDE.md) — keep in sync via `dot agents render`.
+FOOTER
+        } >"$_path"
+        chmod 0644 "$_path" 2>/dev/null || true
+        ui_ok "$_harness" "rendered → $_path"
+      }
+
+      # 4. Windsurf — looks for `.windsurf/rules.md`.
+      _agents_render_markdown_with_header "$root/.windsurf/rules.md" \
+        "Windsurf" "# Windsurf project rules
+
+These rules govern Cascade and the Windsurf agent inside this repository."
+
+      # 5. Roo — looks for `.roo/rules.md`.
+      _agents_render_markdown_with_header "$root/.roo/rules.md" \
+        "Roo" "# Roo project rules"
+
+      # 6. Cline — looks for `.clinerules` (no extension).
+      _agents_render_markdown_with_header "$root/.clinerules" \
+        "Cline" "# Cline workspace rules"
+
+      # 7. Jules — looks for `.jules/system.md`.
+      _agents_render_markdown_with_header "$root/.jules/system.md" \
+        "Jules" "# Jules system prompt"
+
+      # 8. Gemini — looks for `.gemini/GEMINI.md`.
+      _agents_render_markdown_with_header "$root/.gemini/GEMINI.md" \
+        "Gemini" "# Gemini agent rules"
+
+      # 9. Zed — config pointer (TOML).
+      local zed_dir="$root/.zed"
+      mkdir -p "$zed_dir"
+      cat >"$zed_dir/agent-config.toml" <<'TOML'
+# Zed agent config — points at AGENTS.md for the cross-harness body.
+# Zed reads this file when its agent mode is enabled; the actual rule
+# body lives in AGENTS.md (which `dot agents render` keeps current).
+agent_context = "AGENTS.md"
+TOML
+      chmod 0644 "$zed_dir/agent-config.toml" 2>/dev/null || true
+      ui_ok "Zed" "rendered → $zed_dir/agent-config.toml"
+
+      # 10. Aider — YAML pointer to AGENTS.md / CLAUDE.md.
+      cat >"$root/.aider.conf.yml" <<'YML'
+# Aider config — surfaces the cross-harness context bundle.
+# Aider's `--read` flag pulls in AGENTS.md / CLAUDE.md per session.
+read:
+  - AGENTS.md
+  - CLAUDE.md
+YML
+      chmod 0644 "$root/.aider.conf.yml" 2>/dev/null || true
+      ui_ok "Aider" "rendered → $root/.aider.conf.yml"
+
+      # 11. Continue — JSON pointer used by VS Code / JetBrains plugin.
+      cat >"$root/.continuerc.json" <<'JSON'
+{
+  "_comment": "Continue config pointer — see AGENTS.md for the full body.",
+  "systemMessage": "Apply the rules in AGENTS.md (canonical source: CLAUDE.md). Run `dot agents render` if the two drift."
+}
+JSON
+      chmod 0644 "$root/.continuerc.json" 2>/dev/null || true
+      ui_ok "Continue" "rendered → $root/.continuerc.json"
+
+      ui_info "Hint" "commit AGENTS.md alongside CLAUDE.md changes (or add to your pre-commit hook)"
+      ;;
+    --help | -h | help)
+      cat <<EOF
+Usage: dot agents <subcommand>
+
+Subcommands:
+  list     Show which agent harnesses are recognised and their target paths
+  check    Verify AGENTS.md tracks CLAUDE.md (exit 0 in sync, 1 drifted)
+  render   Regenerate AGENTS.md + 10 harness-specific files from CLAUDE.md
+
+CLAUDE.md is the canonical source. AGENTS.md follows the cross-harness
+standard read by Codex, Copilot, Cursor, Windsurf, Amp, and Devin.
+
+Harnesses covered by 'render':
+  agents-md, cursor, codex, windsurf, zed, roo, cline,
+  aider, continue, jules, gemini.
+EOF
+      ;;
+    *)
+      ui_err "Unknown subcommand" "$subcommand"
+      echo "Run 'dot agents --help' for usage." >&2
+      return 1
+      ;;
+  esac
+}