dotfiles-sync

Optional argument: target paths. Without one, use the targets this session changed.

A user request to commit or push dotfiles is the consent to commit and push the
current branch of the chezmoi source repo, for this run only. It gives no standing
consent. Force-push stays forbidden.

Resolve the repo once: git -C "$(chezmoi source-path)" rev-parse --show-toplevel.
Use the literal path for <src>.

Run each Git command below as git -C <src> ...: one Git command per call,
with no pipes, ;, or variable assignments.

1. Scope. Use the named targets, or the targets this session changed.
   Never include *credentials*, *.pem, *.key, token files, or paths in
   .chezmoiignore. Never include any ~/.ssh path except ~/.ssh/config.
   Include that file only when the user names it exactly; ~/.ssh, a glob, or
   "ssh stuff" does not name it. After step 3 shows its diff, stop until the user
   says yes; show it again if it changes before staging. Step 4 misses hosts
   and users, and the repo is public.
   Report each excluded path by name only. Never print its contents. Never
   restore a path that a source commit removed.
2. Status. Run chezmoi-drift <targets> first (~/.local/bin). It lists plain and .tmpl targets edited live since the last apply (it skips modify_ targets, which apps rewrite; apply keeps only their pass-through keys,
   so check chezmoi diff <target> for live changes to managed keys),
   so an apply would overwrite them. Copy to source (step 3) only the rows it lists,
   before step 7; never apply over one. --mtime-only rows are hints to inspect,
   never to copy over .tmpl or modify_ sources.
   Edit the source, never the live file, for later changes.
   Then run chezmoi status <targets>. Report listed targets that this
   session did not edit. Do not include them unless the user names them.
   Agent config directories are exact: applying removes files absent from their sources.
   For requested deletions, remove the source entry; deleting only the target restores it.
   Keep synced/ ignored.
3. Copy. For each managed target, show diff -u "$(chezmoi source-path <target>)" <target>.
   For a new target, show diff -u /dev/null <target>. Skip the copy for a target
   whose source this session edited directly; step 7 applies it.
   • Plain source: copy the target to that source path.
   • Source name starts with symlink_, modify_, run_, create_, or
     encrypted_, or ends in .tmpl: do not copy. Edit the source by hand
     and show the diff. Edit any .chezmoitemplates/ partial it renders. For symlink_, sync the link target instead.
   • New file: run chezmoi source-path <parent-directory>. Add the file with
     the prefixes its siblings use, such as private_ or executable_.
     Prefix every new owned skill source directory with exact_, including nested directories.
   • Never run chezmoi add, re-add, edit, merge, or update. With
     autoCommit or autoPush on, they commit or push on their own; both are off now.
4. Scan. Stage only those source paths: git add <paths>.
   Run the repo's secret scanner when it has one. Always run this scan too:
   git grep --cached -nEi 'token|secret|passw|api[_-]?key|PRIVATE KEY|glpat-|ghp_|github_pat_|xox[bp]-|AKIA' -- <paths>
   Judge each match. Ignore plain prose, such as token counts.
   On a real secret, stop. Print the file, line, and match with the value
   replaced by <redacted>. Unstage the path and remove the secret from the source.
5. Commit. Load commit. Make one commit per concern.
6. Pull and push. Run git pull --autostash, with no strategy flag, so the
   repo's configured strategy applies and unstaged edits survive. Check the
   pull's exit code. Resolve clear conflicts. Stop and ask
   when the intended result is not clear. Then run git push.
7. Apply. Run chezmoi apply <targets>, so the pushed sources take effect.
   Apply only the scoped targets; a wider apply overwrites unsynced target edits.
   When the sandbox reports operation not permitted, rerun it outside the sandbox.
   When the harness blocks a settings or rule file, do not retry the edit.
   Write one apply script to the scratch directory, print its path and what it
   changes, and hand it over once.
8. Check. chezmoi status <targets> must print nothing, and
   git status -sb must show no ahead count.
   Report the pushed SHAs, the targets you left out, and why.