My dotfiles, now that an agent edits them

$ chezmoi status
MM .zshrc

That’s what I got on the second Mac last Sunday, and I nearly typed chezmoi apply anyway, out of habit, before I read it.

I’ve managed my dotfiles with chezmoi since 2023, across the same four machines: two Macs, the Windows laptop and the Linux dev box. The setup in that post has mostly held up. What’s changed is who edits it. Most changes in the last year were made by an agent, at my request, and that’s brought out a problem I rarely hit when I was the only one making changes.

chezmoi keeps two copies of every file. The source, in its git repo, is the one you’re supposed to edit. The target, the actual .zshrc in my home directory, is what chezmoi writes from the source when you run apply. The status command shows two columns. The first says whether the target has changed since chezmoi last wrote it. The second says whether running apply would change it. MM means yes to both: someone edited the real file directly, and the source has also moved on.

A week earlier, on this Mac, I’d added a line to .zshrc by hand to try something and forgotten about it. Meanwhile, on the other Mac, an agent had tidied up how the shell loads its completions, properly, in the source, and pushed it. apply would have quietly replaced my hand edit with the agent’s version. The opposite command, re-add, which copies the real file back into the source, would have thrown away the agent’s work. I wanted both, which is what chezmoi merge is for. It opens the real file and the source’s version in a merge tool, and I kept both changes in about two minutes.

chezmoi did exactly what it should. The weak part was my habit, pull and apply, which was fine when every change came from me and I remembered all of them. So now it’s chezmoi status first, every time, and if anything shows M in the first column, I find out why before I do anything else.

The other half of the fix is for the agent. The first time I let one loose on this repo, it went round in circles on a template for twenty minutes. The repo now has a short instructions file that it reads at the start of every session, which says, among other things:

Edit files in this source repo, never the real files in the home directory.
Files ending in .tmpl are templates. Check them with chezmoi execute-template.
Run chezmoi diff before saying you're done, and show me the output.
Never run chezmoi apply or chezmoi re-add. I do that.
No secrets in this repo, ever. If something needs a token, stop and ask.

The fourth line matters most. The agent works on the source and proposes, and I look at the diff and apply. It’s broken that rule once, when I asked it to explain a problem and it decided to fix it instead, which was also the last time I phrased a question that loosely.

For anything bigger than one change, I’ve started asking for a numbered list of proposed changes, each with a line of reasoning, and then picking the ones I want by number before it touches anything. It sounds slow, and it’s faster than reading a diff of eleven changes, three of which I didn’t want.

My setup is in better shape than it’s ever been, mostly because asking for a fix now costs me a sentence and two minutes of reading, where it used to cost me an evening I didn’t want to spend. But I know less about how some of it works than I used to, and the MM was a reminder that knowing less has a cost too.