harness: devin + copilot CLIs share the repo's skills, agents, and rules

Devin CLI and GitHub Copilot CLI were the two harnesses still configured by
hand. Both now link out-of-store into the repo, the same way ~/.claude-* and
~/.pi do.

One skills link serves both: `~/.agents/skills` is the personal-skills path
each CLI reads, so their per-tool skills dirs stay unlinked — a second link
would register every skill twice. Every packages/claude/agents/*.md links in
per-file under the name each tool expects: `<name>.md` for Devin (it takes
the Claude agent format as-is) and `<name>.agent.md` for Copilot. Global
always-on rules come from the new, harness-neutral packages/agents/AGENTS.md;
packages/claude/CLAUDE.md stays Claude-only because of its $CLAUDE_CONFIG_DIR
paths.

Of each CLI's own config only the user-editable file is managed
(packages/devin/config.json, packages/copilot/settings.json), with the herdr
hook paths parametrized to $HOME. ~/.copilot/config.json holds login state and
the two herdr-agent-state.sh scripts are herdr-installed, so all three stay
local files; doctor now fails if the Copilot login file becomes a symlink and
checks each new link.

Verified live: `devin skills list` reads the repo tree, `devin doctor` loads
all six subagent profiles, `devin rules list` shows AGENTS always-on, and
Copilot runs `--agent bulk-mechanic` and answers from copilot-instructions.md.
Copilot's own skills dir is gated behind the account feature flag
SKILLS_INSTRUCTIONS, false today — the link is in place but idle on that side.

Author: sanketsudake

CLAUDE.md

@@ -8,6 +8,7 @@ One repo for the whole machine:
 
 - **macOS system** — a nix-darwin + home-manager flake (`flake.nix`, `nix/`): `nix/darwin/` declares macOS defaults and every Homebrew formula/cask/mas/vscode entry, `nix/home/` declares dotfile links and CLI packages. Dotfile sources live under `packages/` (stow-style `dot-` names, linked per-file by home-manager); tool manifests under `manifests/`; `bootstrap.sh` for new Macs; `macos/defaults.sh` is Helium-browser-only.
 - **pi** (the `pi-mono` coding agent) — config lives under `packages/pi/` and is linked into `~/.pi` by home-manager (`nix/home/harness.nix`).
+- **Devin CLI and GitHub Copilot CLI** — each CLI's user-editable config lives under `packages/devin/` and `packages/copilot/`, its global rules in the shared `packages/agents/AGENTS.md`, and both read the repo's `skills/` tree through one `~/.agents/skills` link (`nix/home/harness.nix`).
 - **Claude Code** — a shared global `CLAUDE.md`, `skills/`, `commands/`, `rules/`, `scripts/`, and `agents/` are symlinked into `~/.claude-personal/` and `~/.claude-work/`.
 
 There is no application to build/test/lint.
@@ -158,10 +159,19 @@ Why not let the `skills` CLI own installation directly (its `add`/`update`/`expe
   Entry names come from the package dirs at eval time, so a vendored addition is picked up by the next `make nix-switch`.
   That means `packages/pi/agent/settings.json`, `packages/pi/extensions/*.ts`, and `packages/pi/prompts/` are the live files the agent reads — edits here take effect immediately in `~/.pi/...`.
 
+- **Devin CLI and Copilot CLI share the repo's skills and agents** (`nix/home/harness.nix`).
+  `~/.agents/skills` is the one personal-skills path both CLIs read, so it links to `skills/` and their per-tool skills dirs are deliberately left unlinked (a second link would make every skill discovered twice).
+  Every `packages/claude/agents/*.md` links into `~/.config/devin/agents/<name>.md` (Devin takes the Claude agent format as-is) and `~/.copilot/agents/<name>.agent.md` (Copilot needs that suffix) — one source file, two names, derived from the dir at eval time like the pi links.
+  Of each CLI's own config only the user-editable file is managed: `~/.config/devin/config.json` and `~/.copilot/settings.json`.
+  Both are live out-of-store links, so a write by the tool (Devin records `shell.setup_complete`; herdr rewrites its hook block on reinstall) lands in the repo as a visible `git diff`, or replaces the link with a real file if the tool writes by temp+rename (`make doctor` flags that) — review either rather than reverting blindly.
+  **Never manage** `~/.copilot/config.json` (login state) or either `herdr-agent-state.sh` (herdr-installed, its header says a reinstall overwrites it).
+  To check what each CLI really loaded (not just that the link exists), see README.md § "Verifying what each CLI actually loaded": `devin doctor` / `devin skills list` / `devin rules list`, and for Copilot a `--log-level debug` run.
+  Copilot's skills dir is gated by the account feature flag `SKILLS_INSTRUCTIONS`, `false` today — the `~/.agents/skills` link is in place but idle on that side; Devin reads it now.
+  `packages/agents/AGENTS.md` is the shared global rules file for these two CLIs (linked as `~/.config/devin/AGENTS.md` and `~/.copilot/copilot-instructions.md`); keep it harness-neutral — `packages/claude/CLAUDE.md` stays Claude-only because it uses `$CLAUDE_CONFIG_DIR` paths.
 - **`packages/pi/extensions/subagent/` is a directory extension** (listed without `.ts` suffix in `PI_EXTENSIONS`); the rest are single-file TS extensions.
   Adding a new upstream extension requires editing `PI_EXTENSIONS` in the Makefile.
-- **`skills/` is the single source of truth** for skills across pi and both Claude profiles.
-  The `claude` and `pi` packages each carry a committed `skills -> ../../skills` symlink, so the harness links expose the tree at `~/.pi/skills`, `~/.claude-personal/skills`, `~/.claude-work/skills`.
+- **`skills/` is the single source of truth** for skills across pi, both Claude profiles, Devin CLI, and Copilot CLI.
+  The `claude` and `pi` packages each carry a committed `skills -> ../../skills` symlink, so the harness links expose the tree at `~/.pi/skills`, `~/.claude-personal/skills`, `~/.claude-work/skills`; `~/.agents/skills` links straight to `skills/` and serves Devin and Copilot.
   What's *committed* under it, though, is only the authored skill dirs (their source records live in `sources.toml`); vendored skill dirs are gitignored and materialized into place (see the manifest model above), so the symlinked tree the tools read is authored-committed + vendored-materialized.
 - **`packages/claude/commands/`, `packages/claude/rules/`, `packages/claude/scripts/`, and `packages/claude/agents/`** are the single source of truth for user-scoped slash commands, rules, helper scripts, and subagents across both Claude profiles.
 `commands-link` / `rules-link` / `scripts-link` / `agents-link` symlink them into `~/.claude-personal/` and `~/.claude-work/` (not into `~/.pi/` — pi doesn't consume these; pi has its own vendored `packages/pi/extensions/subagent/agents/`).
@@ -208,9 +218,9 @@ Agents are single `.md` files fetched and tracked by `resource-manager.sh` (see
 ## Dotfiles conventions
 
 - `$HOME` dotfiles are linked per-file by home-manager (`nix/home/*.nix` pointing at `packages/` sources) — the per-file discipline is a security invariant, explained in README.md § "The nix model"; never point `home.file` at a whole directory.
-  The harness links (`~/.claude-*`, `~/.pi`) are home-manager out-of-store symlinks (`nix/home/harness.nix`) so the linked content stays mutable; `~/.pi/agent` and `~/.pi/extensions` link per-file because pi writes state beside them.
+  The harness links (`~/.claude-*`, `~/.pi`, `~/.agents`, `~/.config/devin`, `~/.copilot`) are home-manager out-of-store symlinks (`nix/home/harness.nix`) so the linked content stays mutable; `~/.pi/agent`, `~/.pi/extensions`, and the Devin/Copilot agent dirs link per-file because those tools write state beside them.
 - File names in `packages/` use the `dot-` prefix (`dot-zshrc` → `~/.zshrc`), mapped by the `home.file` entries in `nix/home/`.
-- Never add packages for credential-bearing dirs: `gh/hosts.yml`, `gcloud`, `1Password`, `op`, `github-copilot`.
+- Never add packages for credential-bearing dirs or files: `gh/hosts.yml`, `gcloud`, `1Password`, `op`, `github-copilot`, `~/.copilot/config.json`.
 - `nix/darwin/homebrew.nix` is the curated brew list (`cleanup = "uninstall"`: an undeclared install is removed on the next switch — promote keepers first); `Brewfile.dump` (gitignored) is regenerated via `make brew-dump` for re-curation diffs only. CLI packages come from nixpkgs via `nix/home/packages.nix`.
 - `bootstrap.sh` is the new-Mac entry point; keep it idempotent, check-then-act.
 - To add a new tool config, follow the numbered recipe in README.md § "Adding a new tool config"; it is the canonical version.

README.md

@@ -1,6 +1,6 @@
 # dotfiles
 
-One repo for the whole machine: a Nix-declared macOS setup (nix-darwin + home-manager flake, Homebrew for casks, a one-shot bootstrap) **and** portable AI coding-harness configs — shared skills, commands, rules, agents, and settings — provisioned from **one source of truth** across multiple [Claude Code](https://claude.com/claude-code) and [pi](https://github.com/badlogic/pi-mono) profiles.
+One repo for the whole machine: a Nix-declared macOS setup (nix-darwin + home-manager flake, Homebrew for casks, a one-shot bootstrap) **and** portable AI coding-harness configs — shared skills, commands, rules, agents, and settings — provisioned from **one source of truth** across multiple [Claude Code](https://claude.com/claude-code) profiles, [pi](https://github.com/badlogic/pi-mono), [Devin CLI](https://docs.devin.ai/cli/), and [GitHub Copilot CLI](https://docs.github.com/en/copilot/concepts/agents/about-copilot-cli).
 
 A personal repo, published so others can borrow the architecture.
 Paths are hardcoded to one machine — adapt before adopting (see [Adopt it](#adopt-it)).
@@ -19,7 +19,8 @@ On an existing machine, clone the repo and run `make install`.
 ## Ideas worth stealing
 
 - **One source of truth, many harnesses.**
-  A single `skills/` tree feeds Claude Code *and* pi; edit once, every harness sees it immediately.
+  A single `skills/` tree feeds Claude Code, pi, Devin CLI, and Copilot CLI; edit once, every harness sees it immediately.
+  Devin and Copilot both read `~/.agents/skills`, so one link covers both; the same `agents/*.md` files link into each CLI under the name it expects.
 - **Two Claude profiles via `CLAUDE_CONFIG_DIR`.**
   `pclaude` / `wclaude` wrappers keep personal and work accounts isolated while sharing the same skills and rules.
 - **Per-resource source tracking.**
@@ -48,6 +49,9 @@ dotfiles/
 ├── manifests/      # non-brew tools: go-tools.txt, npm-globals.txt, pipx-tools.txt
 ├── macos/          # deliberately-changed macOS defaults (make macos-apply)
 ├── packages/       # dotfile sources for $HOME (zsh, git, atuin, btop, gh, bin), linked by home-manager
+│   ├── agents/     #   AGENTS.md — global rules shared by Devin CLI + Copilot CLI
+│   ├── devin/      #   Devin CLI config.json
+│   └── copilot/    #   Copilot CLI settings.json
 ├── claude/         # Claude Code config, symlinked into both profiles
 │   ├── CLAUDE.md   #   shared global user instructions
 │   ├── commands/   #   slash commands
@@ -63,7 +67,7 @@ dotfiles/
 └── scripts/        # repo tooling (doctor, drift, resource manager — not symlinked)
 ```
 
-`make install` links `skills/` and `claude/*` into both Claude profiles and `pi/` into `~/.pi` (home-manager out-of-store symlinks) — safe to re-run.
+`make install` links `skills/` and `claude/*` into both Claude profiles, `pi/` into `~/.pi`, and the shared skills, agents, and configs into Devin CLI and Copilot CLI (home-manager out-of-store symlinks) — safe to re-run.
 Because everything is symlinked, one edit here applies to every profile and both harnesses at once.
 
 ## What's inside
@@ -161,7 +165,7 @@ Dotfile sources stay in `packages/` with their `dot-` names;
 home-manager links each file individually into `$HOME`,
 so `~/.config/<tool>` stays a real directory and credential files written beside managed configs
 (e.g. `gh`'s `hosts.yml`) can never land in the repo — the old `--no-folding` invariant, kept.
-Never declare files from credential-bearing dirs (`gcloud`, `1Password`, `op`, `github-copilot`).
+Never declare files from credential-bearing dirs (`gcloud`, `1Password`, `op`, `github-copilot`) or credential-bearing files (`gh/hosts.yml`, `~/.copilot/config.json`).
 Every switch is a numbered generation; `make nix-rollback` returns to the previous one.
 Homebrew remains for casks/taps/mas (declared in `nix/darwin/homebrew.nix`, applied by the same switch,
 `cleanup = "uninstall"`: an undeclared install is removed on the next switch — promote keepers first).
@@ -172,11 +176,36 @@ and never let home-manager own a directory that holds mutable files.
 
 ### Harness links
 
-The harness targets (`~/.claude-*`, `~/.pi`) are home-manager **out-of-store** symlinks into the repo working tree (`nix/home/harness.nix`) —
+The harness targets (`~/.claude-*`, `~/.pi`, `~/.agents`, `~/.config/devin`, `~/.copilot`) are home-manager **out-of-store** symlinks into the repo working tree (`nix/home/harness.nix`) —
 the linked content stays mutable, so vendored skills materialize in place and repo edits apply live.
-`~/.pi/agent` and `~/.pi/extensions` link per-file on purpose: pi writes state beside them,
+`~/.pi/agent`, `~/.pi/extensions`, and the Devin/Copilot agent dirs link per-file on purpose: those tools write state beside them,
 and a whole-dir link would let a tool write into the repo.
 
+Devin CLI and Copilot CLI both read personal skills from `~/.agents/skills`, so one link serves both.
+The subagents in `packages/claude/agents/` link into `~/.config/devin/agents/<name>.md` and `~/.copilot/agents/<name>.agent.md` — same file, two names.
+Global always-on rules come from `packages/agents/AGENTS.md`, linked as `~/.config/devin/AGENTS.md` and `~/.copilot/copilot-instructions.md`.
+Of each CLI's own config, only the user-editable file is managed (`~/.config/devin/config.json`, `~/.copilot/settings.json`);
+`~/.copilot/config.json` holds login state and the two `herdr-agent-state.sh` hook scripts are installed by herdr, so all three stay local files.
+
+#### Verifying what each CLI actually loaded
+
+`make doctor` checks that the links resolve into the repo; these commands check that the tools *use* them.
+
+| Check | Devin CLI | Copilot CLI |
+| --- | --- | --- |
+| Subagents | `devin doctor` — lists the loaded profiles and warns on unknown frontmatter keys | `copilot --agent <name> -p 'reply OK'` — the run header names the agent |
+| Skills | `devin skills list` — each skill with its `~/personal/dotfiles/skills/...` path | not yet active on this account (see below) |
+| Global rules | `devin rules list` — `AGENTS [Standard] always-on` | `copilot -s -p '…answer from your instructions only…'` — it answers from `copilot-instructions.md` |
+| Own config | read at `~/.config/devin/config.json` (`--config` overrides it) | `/settings` in an interactive session |
+
+Copilot loads its skills dir behind an account feature flag.
+To read the flag: `copilot --log-level debug --log-dir /tmp/cop -p 'hi'`, then `grep SKILLS_INSTRUCTIONS /tmp/cop/*.log`.
+On this account it is `false` today, so the `~/.agents/skills` link is in place but idle;
+the 0.0.417 binary already carries the path, and Devin reads the same link now.
+The same debug log is the ground truth for the other two:
+it warns per agent file on an unknown frontmatter key (`effort` is Claude-only, and both CLIs ignore it),
+and Copilot maps `model: haiku` to `claude-haiku-4.5`.
+
 zsh keeps its drop-in idea: `~/.zshrc` is a thin loader sourcing `~/.config/zsh/*.zsh` in `NN-` prefix order,
 and machine-local uncommitted overrides go in `~/.config/zsh/90-local.zsh`
 (a plain untracked file; see `90-local.zsh.example`).

nix/home/harness.nix

@@ -1,10 +1,10 @@
-# AI-harness links (was `make harness-link` / stow): the Claude profiles and
-# ~/.pi get out-of-store symlinks into the repo working tree, so vendored
-# skills stay materialized/mutable and repo edits apply live.
-# ~/.pi/agent and ~/.pi/extensions link per-file on purpose: pi writes state
-# beside them, and a whole-dir link would let a tool write into the repo
-# (same invariant as the $HOME dotfiles). prompts/skills are whole-dir links,
-# matching the old stow folding.
+# AI-harness links (was `make harness-link` / stow): the Claude profiles, ~/.pi,
+# Devin CLI and Copilot CLI get out-of-store symlinks into the repo working
+# tree, so vendored skills stay materialized/mutable and repo edits apply live.
+# ~/.pi/agent, ~/.pi/extensions and the Devin/Copilot agent dirs link per-file
+# on purpose: those tools write state beside them, and a whole-dir link would
+# let a tool write into the repo (same invariant as the $HOME dotfiles).
+# prompts/skills are whole-dir links, matching the old stow folding.
 { config, lib, ... }:
 let
   repo = "${config.home.homeDirectory}/personal/dotfiles";
@@ -47,7 +47,39 @@ let
       ".pi/skills".source = link "packages/pi/skills";
       ".pi/README.md".source = link "packages/pi/README.md";
     };
+
+  # Devin CLI and Copilot CLI both read personal skills from ~/.agents/skills,
+  # so one link serves both — never link their per-tool skills dirs too, or a
+  # skill is discovered twice.
+  agentNames = map (lib.removeSuffix ".md") (
+    builtins.attrNames (lib.filterAttrs (n: _: lib.hasSuffix ".md" n) (
+      builtins.readDir ../../packages/claude/agents
+    ))
+  );
+  # Devin takes Claude's agent format as-is; Copilot wants the same file under
+  # a `<name>.agent.md` name, hence the per-file rename here.
+  devinAgentLinks = lib.listToAttrs (
+    map (n: {
+      name = ".config/devin/agents/${n}.md";
+      value.source = link "packages/claude/agents/${n}.md";
+    }) agentNames
+  );
+  copilotAgentLinks = lib.listToAttrs (
+    map (n: {
+      name = ".copilot/agents/${n}.agent.md";
+      value.source = link "packages/claude/agents/${n}.md";
+    }) agentNames
+  );
+  # Only the user-editable config of each CLI is managed. ~/.copilot/config.json
+  # (login state), and both herdr-installed hook scripts, stay local files.
+  cliLinks = {
+    ".agents/skills".source = link "skills";
+    ".config/devin/config.json".source = link "packages/devin/config.json";
+    ".config/devin/AGENTS.md".source = link "packages/agents/AGENTS.md";
+    ".copilot/settings.json".source = link "packages/copilot/settings.json";
+    ".copilot/copilot-instructions.md".source = link "packages/agents/AGENTS.md";
+  };
 in
 {
-  home.file = claudeLinks // piLinks;
+  home.file = claudeLinks // piLinks // devinAgentLinks // copilotAgentLinks // cliLinks;
 }

packages/agents/AGENTS.md

@@ -0,0 +1,53 @@
+# AGENTS.md
+
+Global, always-on rules for the CLI coding agents that are not Claude Code:
+Devin CLI reads this file at `~/.config/devin/AGENTS.md`,
+GitHub Copilot CLI reads the same content at `~/.copilot/copilot-instructions.md`.
+Both links come from `packages/agents/AGENTS.md` in the dotfiles repo.
+
+Claude Code has its own file (`packages/claude/CLAUDE.md`),
+because it uses `$CLAUDE_CONFIG_DIR` paths and profile-specific tooling that do not apply here.
+Keep this file harness-neutral: no tool-specific paths, no slash commands.
+
+## Skills first
+
+Shared skills live in `~/.agents/skills/`, which both CLIs read.
+Each skill is a directory with a `SKILL.md` file.
+Before you start a task, check for a skill that covers it, and follow the skill instead of improvising.
+Keep this file short — a rule that only applies to one kind of task belongs in a skill.
+
+## Never publish sensitive data
+
+These rules are absolute:
+
+- Never commit or publish passwords, API keys, or tokens.
+- Never commit a `.env` file.
+- Before each commit, examine the staged files and make sure that no secret is included.
+
+## Git hygiene
+
+- Never run `git add -A` or `git add .`; stage each path explicitly,
+so that unrelated or generated files do not go in with the change.
+- Keep each commit small and limited to one logical change.
+- Do not add AI attribution lines to commit messages or pull request descriptions.
+- Do not force-push or rewrite published history unless the user asks for it.
+- Push the branch and let the user open the pull request,
+unless the project instructions permit you to open it.
+
+## Communication
+
+- Write in ASD-STE100 Simplified Technical English.
+- Lead with the result, and keep the answer short.
+- Report outcomes correctly:
+if a test fails, show the output;
+if you skipped a step, say so.
+
+## Markdown style
+
+Write all markdown with semantic line breaks (<https://sembr.org/>).
+Break the line after each sentence,
+and after an independent clause when this makes the structure more clear.
+CommonMark renders a single newline as a space,
+thus the rendered output does not change,
+but each `git diff` shows one thought per line.
+Do not rewrap a full paragraph only to change one sentence.

packages/copilot/settings.json

@@ -0,0 +1,13 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "bash": "bash \"$HOME/.copilot/hooks/herdr-agent-state.sh\"",
+        "timeoutSec": 10,
+        "type": "command"
+      }
+    ]
+  },
+  "renderMarkdown": true,
+  "theme": "auto"
+}