dotfiles

My AI-agent setup and Linux workstation, as code.

AI harness config · Global agent rules · Apps · Shell · Sync · Host limits · Development

I run several AI coding agents at once, in Claude Code, OpenCode and DSH (a DeepSeek harness). Their rules, skills, agents and settings are written once, in ai-harnesses/, and deno task ai renders them into the format each harness reads. deno task ai --check writes nothing: it compares what every harness on this machine reads with what is committed, and exits 1 if they differ.

The rest of the repository is the workstation those agents run on: the apps, the shell, the config files synced into my home directory, and the kernel and systemd limits a dozen parallel agent sessions need. It is this machine's live config: a merged change is not done until it is applied here.

The AI-agent setup

• One rules file, every harness. ai-harnesses/AGENTS.md holds the global rules: autonomy, Git flow, secrets, cleanup, subagent orchestration. It becomes Claude Code's CLAUDE.md and OpenCode's and DSH's AGENTS.md, byte for byte.
• Agents and skills, written once. The agents and skills in one harness-neutral format. Validated frontmatter picks a model tier and effort per agent; each adapter renders its harness's format, covered by golden tests.
• A reviewer gate. A separate, read-only reviewer runs the checks itself, breaks the code to prove each test goes red, and counts every claim in the PR body. Its verdict is what authorises a merge.
• Nothing left running. tools/sweep-orphans.sh lists the processes and stale systemd-run scopes an agent session left behind, and the anonymous Docker volumes and networks no container uses, and stops exactly those on request. The rules cap the processes and memory of anything that spawns processes, and give every wait a deadline.
• Costs you can see. tools/session-cost.ts reports each session's and subagent's cost, peak context and compactions from Claude Code's transcripts.
• Secrets stay local. Committed env files are age-encrypted one value per line, and tools/env-key-copy.ts gives a worktree its key without the key ever being printed.

How the rendering works, the file layout per harness and how to write a skill or an agent: ai-harnesses/README.md.

The workstation

• Apps. install-apps.ts installs everything in apps.jsonc with dnf, apt or zypper, and falls back to Flatpak.
• Claude Desktop. tools/claude-desktop-update.sh installs or updates the app from Anthropic's Debian package, which Fedora has no updater for. A nightly timer runs it and says when to restart.
• Secrets backup. tools/secrets-backup.sh backs up the age keys and plaintext env files that Syncthing keeps on this machine, with restic, every night.
• Shell. install-shell.ts sets up Zsh, Oh My Zsh, Powerlevel10k and the aliases in aliases.sh.
• Config in home. tmux, Neovim, Zsh and the prompt are symlinked from this repository.
• Limits for many agents. system/ raises inotify instances and zram swap, cleans /tmp sooner, and caps the tasks each app can start.
• VPN only while it works. tools/vpn-guard/ connects a full-tunnel VPN at boot and every 30 minutes, and drops it when the internet does not work through it.
• Synced, not cloned. The repository lives in a Syncthing folder, and agent worktrees are ignored so they never replicate.

Use it if you want a working example of one rules source driving several AI coding agents, or a Linux workstation set up by script. Skip it if you want a framework: these are my own settings, not a configurable product.

Quick start

curl -fsSL https://deno.land/install.sh | sh   # install Deno
git clone https://github.com/spy4x/dotfiles && cd dotfiles
deno task ai --check       # compare your harness homes with ai-harnesses/, write nothing
deno task install-all      # installs my apps and replaces your shell setup

Only the last line installs my setup: it adds my apps and replaces your shell configuration. Read docs/apps.md and docs/shell.md before you run it.

deno task ai without --check replaces the global rules, skills and agents of every installed harness with mine, and merges my settings into theirs. Read ai-harnesses/README.md first.

Development

deno task test             # adapter golden files, engine, tools
deno task ai --check       # exit 1 if any harness differs from ai-harnesses/

File layout, adding apps and the encrypted env file: development.md.

Licence

MIT.

Built by

I'm Anton Shubin, a senior full-stack engineer and tech lead. This is how I run AI agents on real work, on my own machine. Need something like it built for your product? That's my day job →

---

Made by Anton Shubin · antonshubin.com/tools