Kai
07dd648b5f
Scenarios - memo-inbox: mirrored by copying; the live directory was not moved or modified and the service was not restarted. All four tracked files match byte for byte (pi-diff.sh reports SAME). Marked deploy = "mirror" so deploy-scenario.sh refuses --apply: applying a mirror would invert the direction of truth and could change a service in daily use. - curator: target configuration, not yet deployed. .pi/SYSTEM.md replaces pi's coding-assistant prompt; durable role text is in .pi/APPEND_SYSTEM.md; profile.toml is the single source of truth for the launch contract. - pi-grok: registered only. It is genuinely a coding agent, so the isolation baseline does not apply in full. Corrections to the documentation, found by testing rather than by reading - AGENTS.override.md does NOT block parent-directory context files; it only shadows its own directory. Verified: with an override file in the workspace, a marker in /tmp/AGENTS.md still reached the system prompt. The only effective switch is --no-context-files, so durable role text must live in .pi/APPEND_SYSTEM.md, which is a system-prompt file and unaffected by -nc. Verified end state: no coding-assistant framing, no pi-docs block, own identity and role text present, no parent pollution, only own skills/tools. - PI_CODING_AGENT_DIR isolates settings/models/auth/trust/extensions/skills/ prompts/themes under the agent directory -- stronger than the --no-* flags because it also repoints credentials -- but does NOT cover ~/.agents/skills. Measured: find-skills, modsearch and summarize still leak. So it complements --no-skills rather than replacing it. - --append-system-prompt accepts a file path, which pi-grok relies on. - cwd is what anchors .pi discovery: a probe that forgot cwd silently lost .pi/SYSTEM.md and kept the coding-assistant persona. Tooling (all dry-run by default; none of them restarts a service) - pi-diff.sh: compares tracked config against the live install in both directions, with a key-redacted comparison for models.json - deploy-scenario.sh: installs a workspace and renders profile.toml into .pi/launch.json, then checks that every referenced path exists - deploy-runtime.sh: renders models.json from its template, refusing placeholder or missing keys. Verified byte-identical to the live file - pi-backup.sh / pi-restore.sh: archives outside the repo, sha256 manifest verified before any restore, live paths preserved rather than overwritten Fixed while testing: pi-backup.sh compared the destination against the repo root literally, so a relative --dest ./backups wrote credential archives into the work tree. Now canonicalised with realpath; ./backups, an absolute in-repo path and ./docs/../backups are all refused.
38 lines
1.0 KiB
Bash
Executable File
38 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ "$#" -ne 1 ]]; then
|
|
echo "usage: journal-sync.sh journals/YYYY_MM_DD.md" >&2
|
|
exit 64
|
|
fi
|
|
|
|
rel="$1"
|
|
if [[ ! "$rel" =~ ^journals/[0-9]{4}_[0-9]{2}_[0-9]{2}\.md$ ]]; then
|
|
echo "refusing non-journal path: $rel" >&2
|
|
exit 65
|
|
fi
|
|
|
|
vault="${PI_MEMO_VAULT:-$HOME/obsidian-vault}"
|
|
lock="$HOME/.local/state/obsidian-sync/git-sync.lock"
|
|
mkdir -p "$(dirname "$lock")"
|
|
exec 9>"$lock"
|
|
flock -w 30 9
|
|
|
|
cd "$vault"
|
|
git add -- "$rel"
|
|
if git diff --cached --quiet -- "$rel"; then
|
|
echo "no journal changes to commit"
|
|
exit 0
|
|
fi
|
|
|
|
git commit -m "journal: Pi Memo $(date +%Y-%m-%d-%H%M)" -- "$rel"
|
|
|
|
# The host's system SSH config may be managed outside this service. Keep the
|
|
# memo sync self-contained so unrelated ownership errors cannot block pushes.
|
|
export GIT_SSH_COMMAND="ssh -F $HOME/.ssh/config -i $HOME/.ssh/id_ed25519_gitea -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
|
|
if ! git push origin main; then
|
|
git pull --rebase origin main
|
|
git push origin main
|
|
fi
|
|
echo "pushed $(git rev-parse --short HEAD)"
|