Kai
cbba8faabc
Establishes this repository as the authoritative source for Pi agent configuration across scenarios, starting with the documentation layer. Key verified findings (probe harness included, zero model tokens): - The skills section of the system prompt is emitted only when an active tool named 'read' exists (system-prompt.js:59,113). Therefore --no-tools silently makes every SKILL.md unreachable and --skill a no-op. - registerTool accepts a plain JSON Schema object, so tool definitions can be served from a backend instead of duplicated in TypeScript. - An extension can shadow a built-in tool by name, which is how a dedicated agent gets a path-restricted 'read' while still satisfying the rule above. - .pi/SYSTEM.md replaces pi's coding-assistant prompt, but the replacement branch contributes neither the tool list nor the guidelines. - Without --no-skills/--no-extensions, user-global resources leak into every scenario; probed leak was find-skills, modsearch, summarize. Measured effect of the full baseline: system prompt 2619 -> 960 characters, coding-assistant framing and pi-docs paths removed, skill finally reachable. Secrets are guarded by scripts/verify-no-secrets.sh, installed as a pre-commit hook. Backups deliberately live outside the repository.
74 lines
1.8 KiB
Plaintext
74 lines
1.8 KiB
Plaintext
# ===========================================================================
|
|
# Secrets — NEVER commit. Enforced additionally by scripts/verify-no-secrets.sh
|
|
# which is wired in as a pre-commit hook.
|
|
# ===========================================================================
|
|
secrets/*
|
|
!secrets/*.example
|
|
!secrets/*.template
|
|
!secrets/.gitkeep
|
|
|
|
*.env
|
|
!*.env.example
|
|
!*.env.template
|
|
|
|
# Rendered-from-template artefacts always contain real credentials.
|
|
*.rendered
|
|
*.rendered.*
|
|
*.local
|
|
*.local.*
|
|
|
|
# Pi credential and model-store files carry plaintext API keys.
|
|
models.json
|
|
auth.json
|
|
trust.json
|
|
models-store.json
|
|
|
|
*.pem
|
|
*.key
|
|
!*.key.example
|
|
*.p12
|
|
id_ed25519*
|
|
id_rsa*
|
|
|
|
# ===========================================================================
|
|
# Backups — must live OUTSIDE this repository.
|
|
# Precedent to avoid: hermes-agent-config/backups/ committed
|
|
# hermes-secrets-*.tar.gz into the working tree.
|
|
# ===========================================================================
|
|
backups/
|
|
*.tar.gz
|
|
*.tar.zst
|
|
*.tgz
|
|
*.zip
|
|
|
|
# ===========================================================================
|
|
# Runtime state that belongs to the live installation, not to config
|
|
# ===========================================================================
|
|
sessions/
|
|
*.jsonl
|
|
!scenarios/*/eval/golden/*.jsonl
|
|
.ccgram-uploads/
|
|
|
|
# ===========================================================================
|
|
# Language toolchains
|
|
# ===========================================================================
|
|
node_modules/
|
|
.venv/
|
|
venv/
|
|
__pycache__/
|
|
*.py[cod]
|
|
*.egg-info/
|
|
.mypy_cache/
|
|
.ruff_cache/
|
|
.pytest_cache/
|
|
|
|
# ===========================================================================
|
|
# Editor / OS
|
|
# ===========================================================================
|
|
.DS_Store
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
*.orig
|
|
*.rej
|