fix(tools-pve/asr-pipeline): mount gitea ssh key for Obsidian vault sync and fix provider source_detail

servers/tools-pve/asr-pipeline/asrpipe/vault.py

@@ -90,8 +90,26 @@ def update_pending(date: str, title: str, path: Path) -> None:
 
 
 def _git(*args, check=False) -> subprocess.CompletedProcess:
-    return subprocess.run(["git", *args], cwd=CFG.vault, capture_output=True,
-                          text=True, timeout=180, check=check)
+    return subprocess.run(
+        ["git", "-c", f"safe.directory={CFG.vault}", *args],
+        cwd=CFG.vault, capture_output=True,
+        text=True, timeout=180, check=check,
+    )
+
+
+def pull() -> str:
+    """Pull latest remote changes into CFG.vault when git_sync is enabled."""
+    if not CFG.git_sync or not (CFG.vault / ".git").exists():
+        return "disabled"
+    try:
+        r = _git("pull", "--rebase", "--autostash", "-q")
+        if r.returncode != 0:
+            log(f"git pull failed: {r.stderr.strip()[:200]}", level="WARN")
+            return "error"
+        return "pulled"
+    except Exception as e:
+        log(f"git pull error: {e}", level="WARN")
+        return "error"
 
 
 def sync(paths: list[Path], message: str) -> str:
@@ -99,9 +117,18 @@ def sync(paths: list[Path], message: str) -> str:
     if not CFG.git_sync:
         return "disabled"
     try:
-        rel = [str(p.relative_to(CFG.vault)) for p in paths if p.exists()]
+        vault_root = CFG.vault.resolve()
+        rel = []
+        for p in paths:
+            if not p.exists():
+                continue
+            try:
+                rel.append(str(p.resolve().relative_to(vault_root)))
+            except ValueError:
+                continue
         if not rel:
             return "noop"
+        _git("pull", "--rebase", "--autostash", "-q")
         _git("add", "--", *rel)
         if _git("diff", "--cached", "--quiet").returncode == 0:
             log("nothing staged (likely already committed by the auto-sync cron)")