feat(dotfiles): add dotfile groups

docs/bootstrap.md

@@ -318,27 +318,28 @@ want to check one part without installing anything.
 
 ## What goes where
 
-| Config                                                                  | Use for                                                                     |
-| ----------------------------------------------------------------------- | --------------------------------------------------------------------------- |
-| [`[bootstrap.secrets]`](/bootstrap/secrets.html)                        | Names of secret inputs consumed by managed file templates                   |
-| [`[bootstrap.users]`, `[bootstrap.groups]`](/bootstrap/accounts.html)   | Linux service accounts and groups                                           |
-| [`[bootstrap.files]`, `[bootstrap.directories]`](/bootstrap/files.html) | Managed system paths, content, ownership, and permissions                   |
-| [`[bootstrap.services]`](/bootstrap/services.html)                      | User services on Linux, macOS, and Windows; existing Linux system services  |
-| [`[bootstrap.compose]`](/bootstrap/compose.html)                        | Docker Compose project lifecycle                                            |
-| [`[bootstrap.plugins]`](/bootstrap/packages/plugins.html)               | Package manager plugins                                                     |
-| [`[bootstrap.packages]`](/bootstrap/packages/)                          | OS packages from apk, apt, dnf, pacman, brew, flatpak, mas, scoop, winget   |
-| [`[bootstrap.repos]`](/bootstrap/repos.html)                            | Git repos cloned before dotfiles are applied                                |
-| [`[dotfiles]`](/dotfiles.html)                                          | Tracking dotfiles, creating files from sources, and editing blocks or lines |
-| [`[bootstrap.mise_shell_activate]`](/bootstrap/shell.html)              | mise activation snippets in shell startup files                             |
-| [`[bootstrap.macos.*]`](/bootstrap/macos-defaults.html)                 | Curated macOS preferences for Dock/Finder/keyboard/trackpad                 |
-| [`[bootstrap.macos.defaults]`](/bootstrap/macos-defaults.html)          | macOS user preferences written through `defaults write`                     |
-| [`[bootstrap.macos.launchd.agents]`](/bootstrap/launchd.html)           | macOS user LaunchAgents written and loaded with `launchctl`                 |
-| [`[bootstrap.linux.systemd.units]`](/bootstrap/systemd.html)            | Linux systemd user services managed with `systemctl --user`                 |
-| [`[bootstrap.linux.firewall]`](/bootstrap/firewall.html)                | Linux host firewall policy and managed rules                                |
-| [`[bootstrap.user]`](/bootstrap/user.html)                              | Current-user settings such as `login_shell`                                 |
-| `[bootstrap.hooks]`                                                     | Commands that run at named bootstrap phases                                 |
-| `[tools]`                                                               | Versioned dev tools managed by mise                                         |
-| `[tasks.bootstrap]`                                                     | Anything custom that should run after tools are installed                   |
+| Config                                                                    | Use for                                                                     |
+| ------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| [`[bootstrap.secrets]`](/bootstrap/secrets.html)                          | Names of secret inputs consumed by managed file templates                   |
+| [`[bootstrap.users]`, `[bootstrap.groups]`](/bootstrap/accounts.html)     | Linux service accounts and groups                                           |
+| [`[bootstrap.files]`, `[bootstrap.directories]`](/bootstrap/files.html)   | Managed system paths, content, ownership, and permissions                   |
+| [`[bootstrap.services]`](/bootstrap/services.html)                        | User services on Linux, macOS, and Windows; existing Linux system services  |
+| [`[bootstrap.compose]`](/bootstrap/compose.html)                          | Docker Compose project lifecycle                                            |
+| [`[bootstrap.plugins]`](/bootstrap/packages/plugins.html)                 | Package manager plugins                                                     |
+| [`[bootstrap.packages]`](/bootstrap/packages/)                            | OS packages from apk, apt, dnf, pacman, brew, flatpak, mas, scoop, winget   |
+| [`[bootstrap.repos]`](/bootstrap/repos.html)                              | Git repos cloned before dotfiles are applied                                |
+| [`[dotfiles]`](/dotfiles.html)                                            | Tracking dotfiles, creating files from sources, and editing blocks or lines |
+| [`[dotfile_groups]`, `[bootstrap] dotfile_groups`](/dotfiles.html#groups) | Directory trees of dotfiles and which of them a machine applies             |
+| [`[bootstrap.mise_shell_activate]`](/bootstrap/shell.html)                | mise activation snippets in shell startup files                             |
+| [`[bootstrap.macos.*]`](/bootstrap/macos-defaults.html)                   | Curated macOS preferences for Dock/Finder/keyboard/trackpad                 |
+| [`[bootstrap.macos.defaults]`](/bootstrap/macos-defaults.html)            | macOS user preferences written through `defaults write`                     |
+| [`[bootstrap.macos.launchd.agents]`](/bootstrap/launchd.html)             | macOS user LaunchAgents written and loaded with `launchctl`                 |
+| [`[bootstrap.linux.systemd.units]`](/bootstrap/systemd.html)              | Linux systemd user services managed with `systemctl --user`                 |
+| [`[bootstrap.linux.firewall]`](/bootstrap/firewall.html)                  | Linux host firewall policy and managed rules                                |
+| [`[bootstrap.user]`](/bootstrap/user.html)                                | Current-user settings such as `login_shell`                                 |
+| `[bootstrap.hooks]`                                                       | Commands that run at named bootstrap phases                                 |
+| `[tools]`                                                                 | Versioned dev tools managed by mise                                         |
+| `[tasks.bootstrap]`                                                       | Anything custom that should run after tools are installed                   |
 
 Use declarative sections when mise can inspect and converge the state. Use
 `[tasks.bootstrap]` for imperative setup that does not fit those sections,

docs/cli/bootstrap/dotfiles/add.md

@@ -17,6 +17,10 @@ under `dotfiles.root` unless `--source` is provided. Captured entries are
 applied unless `--no-apply` is passed. Use `--dry-run` to preview both the
 source capture and config write without making those changes.
 
+A target inside the tree of a dotfile group is captured into that group's
+source instead, without a new `[dotfiles]` entry: the deepest group whose
+target contains it, or the one named with `--group`.
+
 ## Arguments
 - **`[TARGET]…`** — Targets to add or update
 
@@ -32,6 +36,7 @@ source capture and config write without making those changes.
 - **`-s --source <PATH>`** — Source path to use for a single target
 - **`-y --yes`** — Skip the confirmation prompt
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
+- **`--group <NAME>`** — Capture into the tree of this dotfile group
 - **`-h --help`** — Print help
 
 ## Examples
@@ -40,6 +45,7 @@ source capture and config write without making those changes.
 mise dot add ~/.zshrc
 mise dot add --mode copy ~/.config/starship.toml
 mise dot add --source dotfiles/gitconfig ~/.gitconfig
+mise dot add --group home ~/.config/starship.toml
 mise dot add --changed
 ```
 

docs/cli/bootstrap/dotfiles/apply.md

@@ -16,13 +16,17 @@ desired state. Whole-file entries may symlink, copy, or render templates.
 Edit entries manage a marker-delimited block or a single line in a file
 mise doesn't otherwise own.
 
+With `--prune`, files deployed by dotfile groups that are no longer
+selected or declared are removed too.
+
 ## Arguments
 - **`[TARGET]…`** — Only apply these targets
 
 ## Flags
 - **`-f --force`** — Overwrite existing files that conflict with whole-file dotfile entries
 - **`-n --dry-run`** — Print the actions that would run without writing anything
 - **`-y --yes`** — Skip the confirmation prompt
+- **`--prune`** — Also remove files deployed by dotfile groups that are no longer selected or declared
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
 - **`-h --help`** — Print help
 
@@ -31,6 +35,7 @@ mise doesn't otherwise own.
 ```
 mise dot apply
 mise dot apply --dry-run
+mise dot apply --prune
 mise dot apply --force --yes
 ```
 

docs/cli/bootstrap/dotfiles/status.md

@@ -16,6 +16,9 @@ Template entries are rendered to compare their output; trusted template
 functions may execute. JSON includes each entry's origin and uses the states
 `applied`, `missing`, `differs`, `source_missing`, and `tracked`.
 
+Files deployed by a dotfile group that is no longer selected or declared
+are listed as `orphaned`; `mise dot apply --prune` removes them.
+
 The management state of every declaration (applied, missing, differs,
 tracked) followed by the history state: what is tracked, the latest
 checkpoint, unfinished operations, and whether edits are saved

docs/cli/bootstrap/dotfiles/unapply.md

@@ -16,13 +16,18 @@ mise cannot identify as managed. Modified copies, templates, and plain-line
 edits require `--force`. Source files and configuration entries are retained.
 Run this before deleting a declaration so mise can still identify its targets.
 
+With `--group`, only that dotfile group's files are removed, using what
+mise recorded when it applied them, so this works even after the group
+is deselected or deleted from the config.
+
 ## Arguments
 - **`[TARGET]…`** — Only unapply these targets
 
 ## Flags
 - **`-f --force`** — Remove modified or otherwise ambiguous managed files and lines
 - **`-n --dry-run`** — Print the actions that would run without writing anything
 - **`-y --yes`** — Skip the confirmation prompt
+- **`--group <NAME>`** — Only unapply the files of this dotfile group, even one that is no longer selected or declared
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
 - **`-h --help`** — Print help
 
@@ -31,6 +36,7 @@ Run this before deleting a declaration so mise can still identify its targets.
 ```
 mise dot unapply
 mise dot unapply ~/.zshrc
+mise dot unapply --group work
 mise dot unapply --dry-run
 mise dot unapply --force --yes
 ```

docs/cli/dotfiles/add.md

@@ -17,6 +17,10 @@ under `dotfiles.root` unless `--source` is provided. Captured entries are
 applied unless `--no-apply` is passed. Use `--dry-run` to preview both the
 source capture and config write without making those changes.
 
+A target inside the tree of a dotfile group is captured into that group's
+source instead, without a new `[dotfiles]` entry: the deepest group whose
+target contains it, or the one named with `--group`.
+
 ## Arguments
 - **`[TARGET]…`** — Targets to add or update
 
@@ -32,6 +36,7 @@ source capture and config write without making those changes.
 - **`-s --source <PATH>`** — Source path to use for a single target
 - **`-y --yes`** — Skip the confirmation prompt
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
+- **`--group <NAME>`** — Capture into the tree of this dotfile group
 - **`-h --help`** — Print help
 
 ## Examples
@@ -40,6 +45,7 @@ source capture and config write without making those changes.
 mise dot add ~/.zshrc
 mise dot add --mode copy ~/.config/starship.toml
 mise dot add --source dotfiles/gitconfig ~/.gitconfig
+mise dot add --group home ~/.config/starship.toml
 mise dot add --changed
 ```
 

docs/cli/dotfiles/apply.md

@@ -16,13 +16,17 @@ desired state. Whole-file entries may symlink, copy, or render templates.
 Edit entries manage a marker-delimited block or a single line in a file
 mise doesn't otherwise own.
 
+With `--prune`, files deployed by dotfile groups that are no longer
+selected or declared are removed too.
+
 ## Arguments
 - **`[TARGET]…`** — Only apply these targets
 
 ## Flags
 - **`-f --force`** — Overwrite existing files that conflict with whole-file dotfile entries
 - **`-n --dry-run`** — Print the actions that would run without writing anything
 - **`-y --yes`** — Skip the confirmation prompt
+- **`--prune`** — Also remove files deployed by dotfile groups that are no longer selected or declared
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
 - **`-h --help`** — Print help
 
@@ -31,6 +35,7 @@ mise doesn't otherwise own.
 ```
 mise dot apply
 mise dot apply --dry-run
+mise dot apply --prune
 mise dot apply --force --yes
 ```
 

docs/cli/dotfiles/status.md

@@ -16,6 +16,9 @@ Template entries are rendered to compare their output; trusted template
 functions may execute. JSON includes each entry's origin and uses the states
 `applied`, `missing`, `differs`, `source_missing`, and `tracked`.
 
+Files deployed by a dotfile group that is no longer selected or declared
+are listed as `orphaned`; `mise dot apply --prune` removes them.
+
 The management state of every declaration (applied, missing, differs,
 tracked) followed by the history state: what is tracked, the latest
 checkpoint, unfinished operations, and whether edits are saved

docs/cli/dotfiles/unapply.md

@@ -16,13 +16,18 @@ mise cannot identify as managed. Modified copies, templates, and plain-line
 edits require `--force`. Source files and configuration entries are retained.
 Run this before deleting a declaration so mise can still identify its targets.
 
+With `--group`, only that dotfile group's files are removed, using what
+mise recorded when it applied them, so this works even after the group
+is deselected or deleted from the config.
+
 ## Arguments
 - **`[TARGET]…`** — Only unapply these targets
 
 ## Flags
 - **`-f --force`** — Remove modified or otherwise ambiguous managed files and lines
 - **`-n --dry-run`** — Print the actions that would run without writing anything
 - **`-y --yes`** — Skip the confirmation prompt
+- **`--group <NAME>`** — Only unapply the files of this dotfile group, even one that is no longer selected or declared
 - **`--prompt-secrets`** — Prompt securely for missing bootstrap secret inputs
 - **`-h --help`** — Print help
 
@@ -31,6 +36,7 @@ Run this before deleting a declaration so mise can still identify its targets.
 ```
 mise dot unapply
 mise dot unapply ~/.zshrc
+mise dot unapply --group work
 mise dot unapply --dry-run
 mise dot unapply --force --yes
 ```