Registry

The registry is dothaven’s single declarative source of truth for the config files and directories it knows about. Every entry is one Go struct in internal/registry/registry.go. There is no config file to edit and no plugin system — the registry is compiled into the binary, and both collect and backup are driven by the same list. Add or change an entry once, and discovery, auditing, and copying all follow.

The entry model

Each registered source is an Entry:

type Entry struct {
	ID          string
	Name        string
	Paths       map[string]string // keyed by GOOS: "darwin", "linux", "windows"
	Category    string
	Kind        Kind
	Fields      []string          // JSONExtract only (empty = all keys)
	BackupDest  string
	Sensitivity Sensitivity
	Redact      func(string) string
}

• ID — stable section key in snapshots (e.g. shell.zshrc).
• Name — human-readable label.
• Paths — per-OS path templates (see Paths and ~ expansion).
• Category — grouping used by --only / --skip and in summaries.
• Kind — how the source is read (see Entry kinds).
• Fields — for JSONExtract, which top-level keys to pull (empty = all).
• BackupDest — relative destination path inside a backup tree.
• Sensitivity — low, medium, or high (see Sensitivity levels).
• Redact — optional content scrubber applied when redaction is on.

Entry kinds

Kind decides how Collect turns a path into a snapshot section. There are four:

The mapping to snapshot shapes (Content, Pairs, Items) comes straight from Collect in registry.go:

• File reads the file, optionally runs the Redact function when redaction is enabled, trims surrounding whitespace, and stores the result as the section’s Content.
• FileMetadata reads the file only to count lines. It never stores the content — the section is just {exists: "true", lines: "<n>"}. This is how a large generated file like .p10k.zsh is recorded without dragging its body into the snapshot.
• Dir lists the directory, sorts the names, and emits one Item per name. An empty or unreadable directory is skipped entirely.
• JSONExtract parses the file as JSON and pulls the keys named in Fields. If a selected field is itself an object, its inner keys are flattened into the pair set; otherwise the field’s scalar value is stored. An empty Fields means “extract every top-level key.”

Any source that does not exist on disk (or fails to read/parse) is silently skipped, so the registry can list more than any one machine has.

Sensitivity levels

Every entry carries a Sensitivity of low, medium, or high. This is a classification of how dangerous the file’s contents are if they leak — it documents intent and drives how you should treat each entry, especially when exporting to chezmoi for age-encryption.

Paths and ~ expansion

Paths is a map keyed by Go’s runtime.GOOS — "darwin", "linux", or "windows". ResolvePath picks the template for the current OS and expands it:

func ResolvePath(e Entry, home string) string {
	tmpl, ok := e.Paths[runtime.GOOS]
	if !ok {
		return "" // entry not applicable on this platform
	}
	return strings.Replace(tmpl, "~", home, 1)
}

Two rules follow from this:

• Leading ~ is replaced by the home directory (first occurrence only).
• No entry for the current OS means an empty path, and the entry is skipped by both Collect and BackupTargets. That is why some entries (shell rc files, .p10k.zsh, GnuPG, gcloud) define only darwin and linux — they are simply absent on Windows.

Windows templates use %USERPROFILE% and %APPDATA% literally; these are not shell-expanded by ResolvePath (it only substitutes ~).

The Redact rule

Redact is an optional func(string) string that scrubs a File entry’s content before it is stored. It runs only for Kind: File, and only when redaction is enabled (the default; disabled with --no-redact). Two registry entries set one today, both from internal/scan:

• ssh.config uses RedactSSHConfig, which replaces HostName and IdentityFile values with [REDACTED] while keeping the file’s structure.
• npm.config uses RedactNpmTokens, which replaces the value after _authToken= with [REDACTED].

These are structure-preserving: the keys and layout survive so the redacted file still reads as a valid config, only the secret value is masked.

Registered entries

The registry currently declares around 130 entries across 18 categories — including a lang category for per-language toolchain config (Ruby, Python, Go, Rust, PHP, .NET, JS, Elixir, Julia) and broad cloud/DevOps, git-ecosystem, and database-client coverage. The lists below are grouped by category; large categories show the notable entries and end with “and more.” The path shown is the macOS/Linux (~-relative) template; Windows templates differ where defined and some entries are macOS/Linux-only.

ai

AI assistant configs, skills, and project-memory files for Claude, Cursor, Gemini, and Windsurf.

…and the matching skills directories for Cursor, Gemini, and Windsurf.

The Claude settings entry extracts only the permissions and enabledPlugins fields; the Gemini settings entry extracts all top-level keys.

shell

macOS/Linux only.

…and shell.zshenv, shell.bash_profile, and shell.inputrc.

git

editor

…and editor.vimrc, VS Code keybindings/snippets, Doom Emacs, and Sublime Text.

The Cursor settings path differs by OS: ~/.config/Cursor/User/settings.json on Linux and %APPDATA%/Cursor/User/settings.json on Windows.

terminal

macOS/Linux only.

…and Alacritty, Kitty, and WezTerm.

.p10k.zsh is recorded as metadata only (exists + lines), not content.

ssh

npm

.npmrc is the one high entry with a redactor: its _authToken value is masked in plaintext output, so it is the exception that can be backed up scrubbed.

bun

cloud

Cloud and PaaS CLI configs. The config-style files are medium; anything that stores auth tokens or keys is high (age-encrypted on export, never in a plaintext backup).

…and Azure, OCI, DigitalOcean, Fly.io, Linode, Hetzner, Netlify, Supabase, Railway, Terraform Cloud, Pulumi, and Cloudflared — all high.

gcloud configurations and most token-bearing entries are macOS/Linux only.

devops

macOS/Linux only.

build

Build tools that may hold repository credentials, so both are high.

db

.pgpass and .my.cnf carry DB passwords, so both are high.

net

macOS/Linux only.

dev

macOS/Linux only.

apps

macOS only.

vm

Version-manager declarative config (live installed versions come from collectors). macOS/Linux only.

secrets

Bare credential stores. All high: age-encrypted on chezmoi export and never written to a plaintext backup. macOS/Linux only.

The GnuPG entry is declarative: it is a no-op until ~/.gnupg holds real keys.

How the registry feeds collect and backup

The same Entries slice drives two different projections.

Collect

collect calls registry.Collect(env, home, redact, registry.Entries). For each entry it resolves the path, skips it if empty or missing, and reads it according to its Kind into a snapshot section. Redaction (on by default) applies a File entry’s Redact rule before the content is stored:

dothaven collect

Pass --no-redact to keep raw values:

dothaven collect --no-redact

Backup

backup and restore both consume registry.BackupTargets(home, entries), which is the single projection of the registry into copy operations. For every entry that has a path on the current platform it produces a BackupTarget:

type BackupTarget struct {
	Src      string             // resolved live path
	Dest     string             // entry's BackupDest, relative to the backup tree
	Category string
	IsDir    bool               // true when Kind == Dir
	Redact   func(string) string
}

Src is the resolved live path, Dest is the entry’s BackupDest, IsDir reflects whether the kind is Dir, and Redact carries the same optional scrubber. Because backup and restore read from one projection, a file always maps back to the live path it came from.

dothaven backup

Backups honor the same redaction default and accept category filters that match the entry Category field:

dothaven backup --only shell,git
dothaven backup --skip cloud,secrets
dothaven backup --archive          # write a .tar.gz instead of a directory
dothaven backup --no-redact        # keep raw values

The output directory follows dothaven’s standard resolution: an explicit -o wins; otherwise <cwd>/reports when run inside a git repo, else ~/.local/share/dothaven.

Missing a tool?

dothaven aims to be a superset of what chezmoi covers. If a config or CLI you use isn’t in the registry yet, adding it is usually a one-line entry — open a request with the tool name and its config path:

Related