Install fixes, skill dedupe, and CI

.agents/skills/dotfiles/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 
 ## Repository Structure
 
-- `packages/` - Source configs organized by tool (nvim, git, zsh, Codex, etc.)
+- `packages/` - Source configs organized by tool (nvim, git, zsh, claude, codex, etc.)
 - `packages-dist/` - Generated outputs (shell configs)
 - `local-packages/` - Separate private repo for work-specific overrides (symlinked)
 - `mise/config.toml` and `mise/tasks/` - Mise taskrunner automation
@@ -37,7 +37,7 @@ Work-specific or private config goes in `local-packages/` (separate repo), not h
 ## Common Commands
 
 - `./install` - Full system setup
-- `FORCE=true ./install` - Reinstall, clobbering existing files
+- `FORCE=true ./install` - Reinstall, replacing existing links and backing up existing files to `<path>.bak.<timestamp>`
 - `mise tasks` - List available tasks
 - `mise run dot:install` - Apply dotfile symlinks/copies
 - `mise run nvim:restore` - Restore Neovim plugins from lock file

.claude/skills/dotfiles

@@ -0,0 +1 @@
+../../.agents/skills/dotfiles

.claude/skills/dotfiles-tasks

@@ -0,0 +1 @@
+../../.agents/skills/dotfiles-tasks

.claude/skills/nvim

@@ -0,0 +1 @@
+../../.agents/skills/nvim

.github/workflows/ci.yml

@@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  MISE_TRUSTED_CONFIG_PATHS: ${{ github.workspace }}
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: shellcheck --severity=warning install scripts/* mise/tasks/install mise/tasks/*/*
+
+  skills:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v2
+        with:
+          install: false
+      - run: mise run skills:check
+
+  binutils:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/binutils
+    steps:
+      - uses: actions/checkout@v4
+      # Cargo path dependencies expect shared_binutils as a sibling org checkout.
+      - run: git clone --depth 1 https://github.com/malleatus/shared_binutils.git "$GITHUB_WORKSPACE/../../malleatus/shared_binutils"
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: packages/binutils
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo test
+
+  agent-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: rhysd/action-setup-vim@v1
+        with:
+          neovim: true
+          version: stable
+      - uses: jdx/mise-action@v2
+        with:
+          install: false
+      - run: mise run agent-review:test

.gitignore

@@ -31,6 +31,7 @@ packages/codex/skills/.system
 /.claude/*
 !/.claude/skills/
 /.claude/skills/*
+!/.claude/skills/*
 !/.claude/skills/*/
 !/.claude/skills/*/**
 

AGENTS.md

@@ -9,12 +9,13 @@
 - `mise/config.toml` and `mise/tasks/` define mise taskrunner automation (e.g., `brew:*`, `nvim:*`, `system:*`).
 - `Brewfile` captures Homebrew packages managed by tasks.
 - `packages/` contains versioned tooling and editor configs (Neovim, Hammerspoon, binutils).
-- `packages-dist/` holds generated config outputs.
-- `~/src/github/malleatus/shared_binutils` provides shared task utilities (setup-local-dotfiles, symlink generation).
+- `packages-dist/` holds generated shell config outputs. It is gitignored and rebuilt by `binutils:cache-shell-startup` (run via `shell:update`); edit the sources in `packages/` instead.
+- `~/src/github/malleatus/shared_binutils` provides shared task utilities (setup-local-dotfiles, symlink generation). Tasks read its location from `SHARED_BINUTILS_PATH`, set in `mise/config.toml`.
+- Agent skills live in `packages/agents/skills/` (shared by all tools). `packages/codex/skills/` is only for Codex-specific skills; `mise run skills:check` enforces no duplicates.
 
 ## Build, Test, and Development Commands
 - `./install`: System setup (tools, dotfiles, Neovim). Use on a new machine.
-- `FORCE=true ./install`: Reinstall and clobber existing files.
+- `FORCE=true ./install`: Reinstall, replacing existing links and moving existing files to `<path>.bak.<timestamp>`.
 - `mise tasks`: List available tasks.
 - `mise run install`: Run full multi-step setup.
 - `mise run brew:install`: Install Homebrew and packages from `Brewfile`.
@@ -28,12 +29,13 @@
 - Keep local-only or work-specific files out of this repo; put them in the local dotfiles repo.
 
 ## Coding Style & Naming Conventions
-- Shell scripts target `zsh`; keep scripts in `scripts/` and name them descriptively (e.g., `commit_changed_file.sh`).
+- Mise tasks and `scripts/` are bash (`#!/usr/bin/env bash`, `set -euo pipefail`); name scripts descriptively (e.g., `commit_changed_file.sh`). Interactive shell config targets `zsh`.
 - Indentation is 2 spaces in YAML, Lua, and shell scripts; follow existing file style before introducing new rules.
 - Task names use a `namespace:verb` pattern (e.g., `nvim:update`); defined by directory structure under `mise/tasks/`.
 
 ## Testing Guidelines
-- No repo-wide test runner; validate changes by running the relevant task or script.
+- CI (`.github/workflows/ci.yml`) runs shellcheck at warning severity, `skills:check`, cargo fmt/clippy/test for `packages/binutils`, and `agent-review:test`.
+- Beyond that, validate changes by running the relevant task or script.
 
 ## Commit & Pull Request Guidelines
 - This repo uses `jj` for source control; keep commits small and imperative.

README.md

@@ -6,31 +6,26 @@
 ./install
 ```
 
-To force a re-install (clobbering existing files):
+To force a re-install (replacing existing links; existing files and directories are moved to `<path>.bak.<timestamp>`):
 
 ```sh
 FORCE=true ./install
 ```
 
+`shared_binutils` is expected at `../../malleatus/shared_binutils` relative to this repo. Set `SHARED_BINUTILS_PATH` to use a different checkout.
+
 ## Available Tasks
 
+Run `mise tasks` for the current list with descriptions. The main entry points:
+
 ```console
 mise run install              # Complete system setup - installs dependencies, builds utilities, configures dotfiles, and sets up Neovim
-mise run binutils:install     # Build binutils and set up symlinks
-mise run binutils:build       # Build shared_binutils and local binutils
-mise run brew:install         # Install Homebrew and packages
-mise run brew:update          # Update Brewfile with current packages and commit
-mise run brew:upgrade         # Upgrade all Homebrew packages
-mise run brew:cleanup         # Remove unused brew dependencies
 mise run dot:install          # Link/copy dotfiles
-mise run nvim:restore         # Restore Neovim plugins from lazy-lock.json
+mise run tools:update         # Upgrade mise-managed tools (install does not upgrade)
+mise run brew:upgrade         # Upgrade all Homebrew packages
 mise run nvim:update          # Update Neovim plugins and commit lock file
-mise run nvim:commit          # Commit lazy-lock.json if changed
-mise run shell:update         # Refresh shell startup cache and completions
-mise run system:install       # Install all system dependencies
-mise run tools:install        # Install mise-managed tools
-mise run tools:update         # Update mise-managed tools
-mise run tools:outdated       # List outdated tools
+mise run skills:check         # Fail if an agent skill is duplicated across skill directories
+mise run agent-review:test    # Run agent-review.nvim tests headless
 ```
 
 ## Troubleshooting

install

@@ -1,7 +1,8 @@
 #!/bin/bash
+set -euo pipefail
 
 if ! command -v mise &>/dev/null; then
-  curl https://mise.run | sh
+  curl -fsSL https://mise.run | sh
 fi
 
 export PATH="$HOME/.local/bin:$PATH"

mise/config.toml

@@ -1,2 +1,5 @@
 #:schema https://mise.jdx.dev/schema/mise.json
 min_version = "2025.10.0"
+
+[env]
+SHARED_BINUTILS_PATH = "{{ get_env(name='SHARED_BINUTILS_PATH', default=config_root ~ '/../../malleatus/shared_binutils') }}"

mise/tasks/binutils/build

@@ -3,7 +3,5 @@
 set -euo pipefail
 
 DOTFILES_DIR="$MISE_PROJECT_ROOT"
-SHARED_BINUTILS_PATH="$DOTFILES_DIR/../../malleatus/shared_binutils"
-
 (cd "$SHARED_BINUTILS_PATH" && cargo build)
 (cd "$DOTFILES_DIR/packages/binutils" && cargo build)

mise/tasks/binutils/cache-shell-startup

@@ -4,8 +4,6 @@
 set -euo pipefail
 
 DOTFILES_DIR="$MISE_PROJECT_ROOT"
-SHARED_BINUTILS_PATH="$DOTFILES_DIR/../../malleatus/shared_binutils"
-
 for shell in zsh fish starship; do
   "$SHARED_BINUTILS_PATH/target/debug/cache-shell-startup" \
     --config-file="$DOTFILES_DIR/packages/binutils/config/config.lua" \

mise/tasks/binutils/install

@@ -3,8 +3,6 @@
 set -euo pipefail
 
 DOTFILES_DIR="$MISE_PROJECT_ROOT"
-SHARED_BINUTILS_PATH="$DOTFILES_DIR/../../malleatus/shared_binutils"
-
 # Clone shared_binutils if it doesn't exist
 if [ ! -d "$SHARED_BINUTILS_PATH" ]; then
   git clone https://github.com/malleatus/shared_binutils.git "$SHARED_BINUTILS_PATH"