Dotfiles
Your dotfiles repository, cloned and installed in the read-write shell of every new session you own.
Get your dotfiles
The caller's dotfiles repository and whether the organisation's policy and egress let a new session apply it.
A person reads their own setting; an agent reads its owner's. repo is null when none is set. effective is the decision dev up would make now for a session of the caller.
Response
credential- a credential for the repository's host is stored; never the token
effective- granted: the read-write shell clones and installs the repository before it reports ready; its outcome is the shell's last ciresk-dotfiles line (ciresk dev logs shell). skipped: reason policy_off, host_not_allowed, vendor, egress_ceiling, egress_denied, or agent_session (a repository with a credential in a session a person did not start), with the step that lets it through. unset: no repository.
effective.detaileffective.nexteffective.reason- One of
policy_off,host_not_allowed,vendor,egress_ceiling,egress_denied,agent_session effective.repoeffective.state- One of
granted,skipped,unset installrepoupdated_at
curl "$CIRESK_API/v1/dev/dotfiles" \
-H "Authorization: Bearer $CIRESK_KEY"Set your dotfiles
Set the caller's dotfiles repository, cloned and installed in the read-write shell of every new session they own.
A person for themselves, or an agent for its owner, through the same capability. Applies to sessions created after it. The clone goes through the session's egress proxy, so the host must also be allowed by the organisation's ceilings and the installation's egress.yaml. Audited dev.dotfiles.set with the repository and the install path. A repository on another host than the stored one removes the stored credential (credential_removed: true in the audit record; amendment of 2026-10-25, decision 2).
Request body
install- the script to run, relative to the repository; default: install.sh, then bootstrap.sh, else every top-level dot-file symlinked into the home
repo- an https url with a host and a path, no user info, query or fragment
Response
credential- a credential for the repository's host is stored; never the token
effective- granted: the read-write shell clones and installs the repository before it reports ready; its outcome is the shell's last ciresk-dotfiles line (ciresk dev logs shell). skipped: reason policy_off, host_not_allowed, vendor, egress_ceiling, egress_denied, or agent_session (a repository with a credential in a session a person did not start), with the step that lets it through. unset: no repository.
effective.detaileffective.nexteffective.reason- One of
policy_off,host_not_allowed,vendor,egress_ceiling,egress_denied,agent_session effective.repoeffective.state- One of
granted,skipped,unset installrepoupdated_at
Errors
- 401an error
- 403dotfiles_off (the organisation's policy turns dotfiles off); dotfiles_host_not_allowed (the host is not in the policy's dotfiles.hosts)
- 422dotfiles_invalid (not an https url with a host and a path, a query, a fragment, an ip literal, a model or tool vendor, over 512 bytes, or an install path off its rule); dotfiles_private_unsupported (an ssh url or one with credentials; next: the https url with ciresk dev dotfiles set --repo <url> --token-stdin, amendment of 2026-10-25)
curl -X PUT "$CIRESK_API/v1/dev/dotfiles" \
-H "Authorization: Bearer $CIRESK_KEY" \
-H "Content-Type: application/json" \
-d '{
"install": "acme/platform",
"repo": "acme/platform"
}'Delete your dotfiles
Remove the caller's dotfiles repository and its credential; sessions created after it start without.
Response
removed
curl -X DELETE "$CIRESK_API/v1/dev/dotfiles" \
-H "Authorization: Bearer $CIRESK_KEY"Set your dotfiles token
Store the token the session's egress proxy attaches when the shell clones the caller's private dotfiles repository.
A person only, never an agent: the token never passes through an agent's context. It is bound to the host of the caller's dotfiles repository, stored through the vault port and never read back by any capability but the worker's fetch; the pod holds a per-session placeholder. Use a read-only token scoped to the repository. Audited dev.dotfiles.credential.set with the host and value_changed, never the token.
Request body
token- a read-only token for the repository's host, no control character; never returned
Response
credential- a credential for the repository's host is stored; never the token
effective- granted: the read-write shell clones and installs the repository before it reports ready; its outcome is the shell's last ciresk-dotfiles line (ciresk dev logs shell). skipped: reason policy_off, host_not_allowed, vendor, egress_ceiling, egress_denied, or agent_session (a repository with a credential in a session a person did not start), with the step that lets it through. unset: no repository.
effective.detaileffective.nexteffective.reason- One of
policy_off,host_not_allowed,vendor,egress_ceiling,egress_denied,agent_session effective.repoeffective.state- One of
granted,skipped,unset installrepoupdated_at
curl -X PUT "$CIRESK_API/v1/dev/dotfiles/credential" \
-H "Authorization: Bearer $CIRESK_KEY" \
-H "Content-Type: application/json" \
-d '{
"token": "eyJ8BmvruZ26jFCCEvEwbA7pXZKEDVe4ws3AZNJGBhxAMyGPGFnOE75jGkGAbeU"
}'