What gets backed up

dothaven knows over 200 config locations. This list, the registry, is compiled into the binary and is the single source of truth: backup, restore, scan, check, collect, chezmoi-export and the dashboard all read it. If a path below exists on your machine, it is in your backups. Anything else can be added with dothaven include.

Only your user-level (global) setup is listed here. Project-level config, such as a repository’s own .claude/, .mcp.json or .vscode/, lives in the project and travels with its git repository. Run dothaven ready to make sure those repositories are pushed.

How to read the tables

“🔑 never pushed to GitHub” marks age keys: included in an encrypted file backup, left out of every github push, even an encrypted one (see GitHub).

The list below is generated from the registry itself (a test fails if they disagree), so it is exactly what a backup looks for.

On restore, 🔒 and 🔑 files are written owner-only (0600). In a GitHub split push, they go into the encrypted bundle. .npmrc and ~/.ssh/config are credential-adjacent files with a dedicated redactor, so they stay in plain backups with just the token, HostName and IdentityFile masked.

Paths ending in / are folders: everything inside is carried, minus clutter each entry names (caches, logs, plugin downloads, shell history and compiled files). Symbolic links are followed. Where macOS and Linux differ, the macOS path is shown first. Entries marked (macOS) exist only there.

AI tooling

Your global AI setup is often the hardest thing to rebuild by hand: skills and agents you wrote, slash commands, hooks, plugins and marketplaces, and MCP servers configured with API keys. The ai category covers:

• Claude Code: settings.json (permissions, plugins, marketplaces, hooks, status line, model), ~/.claude.json (user-scope MCP servers, from claude mcp add --scope user), skills, agents (subagents), commands, hooks, output styles, plugins with their marketplaces, keybindings, the status line script, and CLAUDE.md. The whole of ~/.claude.json is carried, including Claude Code’s per-project state. On Linux its login file is carried too; on macOS the login is in the Keychain, which dothaven does not copy, so you sign in again.
• Claude Desktop: its MCP config.
• Codex: config.toml (including MCP servers), AGENTS.md, prompts, skills, command rules, and its login (auth.json).
• Gemini CLI: settings, skills, commands, extensions, GEMINI.md, its login, and its .env with the API key.
• Cursor: mcp.json, skills, commands, rules and agents; its editor settings, keybindings and snippets are in editor.
• Windsurf: MCP config, skills, global rules; editor settings and keybindings in editor.
• Cline (MCP servers in VS Code and Cursor, global rules and workflows), Roo Code (MCP servers, global rules), VS Code MCP servers (mcp.json), opencode, GitHub Copilot CLI, Continue, aider, Goose, Kiro, Amp, Qwen Code and LM Studio.

Local model files (Ollama weights and the like) are not copied. collect records which Ollama models you have so you can pull them again.

The full list

ai

shell

git

editor

terminal

ssh

npm

bun

cloud

devops

build

db

schedule

net

dev

apps

vm

secrets

lang

mobile

fonts

dothaven

Your own paths

Files your git config points at come along by themselves. A .gitconfig often names files that have to travel with it: core.hooksPath, core.excludesFile, commit.template, init.templateDir, and the files [include] and [includeIf] pull in (a work identity, a signing key’s config). Whatever those point at inside your home folder is carried like an include, without you listing it, and restored to the same place.

The registry will never know every tool you use. dothaven include adds anything in your home folder to every backup:

dothaven include ~/.config/raycast ~/bin
dothaven include --list      # what you added, and what looks like config but nothing covers
dothaven include --review    # pick from those interactively

• Your paths are kept in ~/.config/dothaven/include (one per line; a line starting with ! is a path you declined, so dothaven stops asking). That file is itself in the registry, so it travels with your backups.
• In a backup they live under extra/, and restore puts them back in the same place under your home folder, even on a new machine that has no include list yet.
• They are treated as 🔒: scanned and redacted in plain backups, written owner-only on restore.
• A credential folder stays protected however it is reached. Including ~/.aws does not put ~/.aws/credentials into a plain backup.

To find candidates, dothaven looks at the dot-files in your home folder, the entries in ~/.config, ~/.claude, ~/.codex and ~/.gemini (skipping their sessions, history and caches), and ~/bin, and lists what no entry or include covers. On a terminal, backup offers these once.

Missing a tool?

If a config or CLI you use should be in the registry, request it with the tool’s name and config path. In the meantime, dothaven include <path> carries it today.

For contributors: the entry model

Each entry is one Go struct in internal/registry/registry.go:

type Entry struct {
	ID          string            // stable section key, e.g. "shell.zshrc"
	Name        string            // human-readable label
	Paths       map[string]string // keyed by GOOS: "darwin", "linux", "windows"
	Category    string            // what --only / --skip select
	Kind        Kind              // File, FileMetadata, Dir, JSONExtract
	Fields      []string          // JSONExtract only: keys to pull into a snapshot
	BackupDest  string            // path inside a backup
	Sensitivity Sensitivity       // low, medium, high
	Redact      func(string) string // optional structure-preserving scrubber
	Exclude     []string          // Dir only: clutter to skip (caches, logs…)
}

• Paths use ~ for your home folder. An entry with no path for the current OS is skipped.
• Kind decides what a collect snapshot records: the file’s text (File), just whether it exists and its line count (FileMetadata, used for the large generated .p10k.zsh), a folder listing (Dir), or selected JSON keys (JSONExtract). Backups always carry the whole file or folder.
• Sensitivity: high with no Redact is what keeps an entry out of plain backups. Two entries have a redactor: ssh.config (HostName, IdentityFile) and npm.config (_authToken and the legacy _auth/_password).
• Exclude patterns without a / match any path segment (logs, *.log); with a / they match from the entry’s root.

registry.BackupTargets projects the entries onto source and destination paths. Backup uses it to copy and restore uses it to map each file back, so a file always returns to the path it came from.