From a7548dc35671b4aba4c7f4ba8efad733d7ca482c Mon Sep 17 00:00:00 2001
From: Ray Andrew <rs@rs.ht>
Date: Wed, 18 Feb 2026 20:50:20 -0600
Subject: [PATCH] feat(cli): add source directory support to config loading and
 decryption functions

---
 crates/doot-cli/src/commands/apply.rs |  7 ++++++-
 crates/doot-cli/src/commands/edit.rs  |  9 +++++++--
 crates/doot-cli/src/commands/mod.rs   | 10 ----------
 crates/doot-cli/src/commands/tui.rs   |  4 ++--
 crates/doot-lang/src/evaluator.rs     |  4 +++-
 5 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/crates/doot-cli/src/commands/apply.rs b/crates/doot-cli/src/commands/apply.rs
index 1a11dda..c62368e 100644
--- a/crates/doot-cli/src/commands/apply.rs
+++ b/crates/doot-cli/src/commands/apply.rs
@@ -436,7 +436,12 @@ pub fn run(config_path: Option<PathBuf>, dry_run: bool, prune: bool) -> anyhow::
             .collect();
 
         let mut template_vars = evaluator.get_template_variables();
-        super::decrypt_encrypted_vars(&result, &config, &mut template_vars)?;
+        super::decrypt_encrypted_vars_with_source_dir(
+            &result,
+            &config,
+            &mut template_vars,
+            Some(&source_dir),
+        )?;
         let deployer = Deployer::new(config, result.sandbox, Some(&template_vars));
 
         let progress = if !dry_run {
diff --git a/crates/doot-cli/src/commands/edit.rs b/crates/doot-cli/src/commands/edit.rs
index 8d58cfc..be4c27e 100644
--- a/crates/doot-cli/src/commands/edit.rs
+++ b/crates/doot-cli/src/commands/edit.rs
@@ -28,9 +28,14 @@ pub fn run(
     let mut evaluator = Evaluator::new().with_source_dir(source_dir.clone());
     let result = evaluator.eval_sync(&program)?;
     let mut template_vars = evaluator.get_template_variables();
-    let config = Config::default();
+    let config = Config::new(source_dir.clone());
 
-    super::decrypt_encrypted_vars(&result, &config, &mut template_vars)?;
+    super::decrypt_encrypted_vars_with_source_dir(
+        &result,
+        &config,
+        &mut template_vars,
+        Some(&source_dir),
+    )?;
     let state = StateStore::new(&config.state_file);
 
     let target_path = expand_tilde(&target);
diff --git a/crates/doot-cli/src/commands/mod.rs b/crates/doot-cli/src/commands/mod.rs
index c481d0a..0ca0eb6 100644
--- a/crates/doot-cli/src/commands/mod.rs
+++ b/crates/doot-cli/src/commands/mod.rs
@@ -108,16 +108,6 @@ pub fn type_check(
     Ok(())
 }
 
-/// Decrypts encrypted vars and files from `EvalResult` and inserts them into template variables
-/// as `Value::Struct("encrypted", { KEY: "plaintext", ... })`.
-pub fn decrypt_encrypted_vars(
-    result: &EvalResult,
-    config: &Config,
-    template_vars: &mut HashMap<String, Value>,
-) -> anyhow::Result<()> {
-    decrypt_encrypted_vars_with_source_dir(result, config, template_vars, None)
-}
-
 /// Decrypts encrypted vars and files, resolving file paths relative to `source_dir`.
 pub fn decrypt_encrypted_vars_with_source_dir(
     result: &EvalResult,
diff --git a/crates/doot-cli/src/commands/tui.rs b/crates/doot-cli/src/commands/tui.rs
index 8ed9a73..88d788b 100644
--- a/crates/doot-cli/src/commands/tui.rs
+++ b/crates/doot-cli/src/commands/tui.rs
@@ -122,7 +122,7 @@ impl App {
         let mut evaluator = Evaluator::new().with_source_dir(source_dir.clone());
         let result = evaluator.eval_sync(&program)?;
 
-        let config = Config::default();
+        let config = Config::new(source_dir.clone());
         let state = StateStore::new(&config.state_file);
 
         let dotfiles: Vec<DotfileItem> = result
@@ -440,7 +440,7 @@ impl App {
         self.apply_progress = 0;
 
         // Apply dotfiles
-        let config = Config::default();
+        let config = Config::new(self.source_dir.clone());
         let linker = Linker::new(config.clone());
         let mut state = StateStore::new(&config.state_file);
 
diff --git a/crates/doot-lang/src/evaluator.rs b/crates/doot-lang/src/evaluator.rs
index 78949f8..9550a4a 100644
--- a/crates/doot-lang/src/evaluator.rs
+++ b/crates/doot-lang/src/evaluator.rs
@@ -1067,7 +1067,9 @@ impl Evaluator {
                 // available, so patterns like "config" / "*" expand relative to the
                 // config file rather than the current working directory.
                 let resolve_glob_base = |p: &std::path::Path| -> std::path::PathBuf {
-                    if p.is_relative() && let Some(ref sd) = self.source_dir {
+                    if p.is_relative()
+                        && let Some(ref sd) = self.source_dir
+                    {
                         return sd.join(p);
                     }
                     p.to_path_buf()