AI安全研究开发配置

1. Install dependencies (zsh, tmux, CLI tools, AI assistants)

./install.sh

Step 1: Install dependencies

Install dependencies (e.g. oh-my-zsh and related plugins). The installer auto-detects your OS and applies sensible defaults.

```bash

2. Deploy configurations (symlinks, shell config, secrets, automation)

./deploy.sh

Installation

Install with defaults (recommended)

./install.sh

Install only specific components

./install.sh --minimal --tmux --zsh # --minimal disables all defaults ```

Defaults by platform:

Installation on macOS requires Homebrew - install from brew.sh first if needed.

Step 2: Deploy configurations

Deploy configurations (sources aliases for .zshrc, applies oh-my-zsh settings, etc.). All settings live in config.sh — edit once, deploy everywhere.

```bash

Deploy with defaults (recommended)

./deploy.sh

Deploy only specific components

./deploy.sh --only vim claude # Only vim and claude, nothing else

Automatically enabled when you deploy ZSH config

./deploy.sh # (default: includes ZSH)

**How it works:**

- Checks for `~/.ssh/id_ed25519` (customizable via `SSH_KEY_PATH` env var)
- **Prompts to generate** if key doesn't exist (never overwrites existing keys)
- Adds to macOS Keychain (`--apple-use-keychain`) or Linux ssh-agent
- Only runs in interactive shells
- Skips if key already loaded in agent

**First-time setup flow:**

1. Shell starts → detects no key → prompts "Generate a new ed25519 SSH key now? [y/N]"
2. If yes → generates key → shows command to copy public key
3. Automatically adds to agent on this and future shell sessions

**Custom key path:**

Configuration: config/ssh_setup.sh

Uninstall

./scripts/cleanup/setup_claude_cleanup.sh --uninstall ```

Uninstall automation

./scripts/cleanup/setup_gist_sync.sh --uninstall ```

Note: Secret gists are unlisted, not encrypted. Only non-secret config (SSH config, authorized_keys, git identity) should be synced via gist.

Installing packages works normally — quarantine is transparent

npm install express # Works (express is >7 days old) bun add zod # Works uv add httpx # Works

Override for a specific install (after checking it's safe)

npm install --min-release-age=0 some-brand-new-pkg # npm bun add --minimumReleaseAge=0 some-brand-new-pkg # bun UV_EXCLUDE_NEWER= uv pip install some-brand-new-pkg # uv

**Credential isolation:**

API keys stay in `$DOTFILES_SECRETS_DIR/secrets.env.enc` and are NOT globally exported. Each project gets only the keys it needs:

Cloud Setup (RunPod, Hetzner, etc.)

One-command setup for cloud VMs and containers:

```bash

Quickstart

This project offers two quickstart paths: Local and Cloud.

---

Local Quickstart

For setting up on your personal machine (macOS, Linux, desktop/laptop):

```bash git clone https://github.com/yulonglin/dotfiles.git && cd dotfiles

Cloud Quickstart

For cloud environments (RunPod, Hetzner, Lambda Labs, etc):

1. SSH into your new remote machine as root. 2. Run the one-liner:

   # RunPod (fresh pod)
   curl -fsSL https://raw.githubusercontent.com/yulonglin/dotfiles/main/scripts/cloud/setup.sh | bash

   # Hetzner / standard VPS (persistent /home)
   curl -fsSL https://raw.githubusercontent.com/yulonglin/dotfiles/main/scripts/cloud/setup.sh | USER_HOME=/home bash
   

   ssh yulong@<ip>
   

   curl -fsSL https://raw.githubusercontent.com/yulonglin/dotfiles/main/scripts/cloud/restart.sh | bash
   

Tip: The setup auto-detects cloud providers and adjusts accordingly (persistent storage paths, SSH config, no macOS-only features). See scripts/cloud/README.md for details.

→ Creates .envrc with eval-based exports, direnv auto-loads on cd

Map a namespaced secret into the env var your app expects

setup-envrc ANTHROPIC_API_KEY TELEGRAM_BOT_TOKEN=NUDGE_TELEGRAM_BOT_TOKEN

and generate .claude/channels/telegram/.env only at launch time

setup-envrc --telegram-secret AMBASSADOR_TELEGRAM_BOT_TOKEN

Check what's configured

setup-envrc --list # Show keys in current .envrc setup-envrc --clean # Remove .envrc

One-off command with selected keys (no .envrc needed)

with-secrets ANTHROPIC_API_KEY OPENAI_API_KEY -- python my_script.py

**Manual audit:**

Rust CLI Tools

These modern alternatives are installed by default and significantly faster than their traditional counterparts:

Extras (--extras flag):

• hyperfine — statistical benchmarking with warmup and multiple runs
• gitui — TUI for git
• code2prompt — generate LLM prompts from codebases

Codex CLI (OpenAI)

Codex CLI configuration that reuses Claude Code's skills:

./deploy.sh --codex  # Symlinks codex/ → ~/.codex

What's included:

• AGENTS.md — Global instructions (references CLAUDE.md as source of truth)
• config.toml — Model settings, status line config, and per-project trust levels
• rules/ — Behavioral rule files synced from Claude Code's rules/
• skills/ → symlink to claude/skills/ so both CLIs share the same skill set

The configuration follows the same research discipline as Claude Code but adapted for Codex's execution model.

Gemini CLI (Google)

Gemini CLI can sync with Claude Code configurations:

./scripts/sync_claude_to_gemini.sh  # Syncs skills/agents/permissions

What it does:

• Symlinks Claude Code skills to ~/.gemini/skills/
• Converts Claude agents to Gemini skill format
• Syncs permissions from .claude/settings.json to Gemini policies
• Creates GEMINI.md pointer to CLAUDE.md

Note: Gemini CLI uses a different skills format. The sync script adapts Claude's configuration but some features may not translate directly.

Package Auto-Update (both platforms)

Weekly package upgrade + cleanup on Sundays at 05:00:

./deploy.sh --brew-update  # Part of defaults

Supports Homebrew (macOS), apt, dnf, and pacman (Linux). Includes cleanup of stale caches.

New packages published <7 days ago are blocked (intentional)

npm install some-brand-new-pkg

Error: min-release-age — package was published 2 days ago

Claude Telegram plugin: keep the token canonical in dotfiles-secrets,