@delorenj/pjangler 1.3.7 → 1.4.2

package/templates/commonproject/template/mise.toml.jinja

@@ -12,20 +12,26 @@ _.file = [".env"]
 # i.e. All linked agent files MUST be siblings at
 # any given level of nesting.
 #
+# NOTE: every managed script is handed config_root EXPLICITLY. A mise enter
+# hook runs with cwd set to the directory you cd'd into -- including a PARENT
+# config's hook -- so a script that reads its subject from cwd reshapes
+# whichever nested repo you entered. config_root locates the file; the
+# argument locates the subject. The scripts refuse to run without it.
+#
 # NOTE: hooks are an array of [[hooks.enter]] tables (NOT enter = [ ... ]) and
 # every {{config_root}} path is single-quoted so it survives a space in the
 # project path — mise runs each `script` via `sh -c`.
 [[hooks.enter]]
-script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
+script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh' '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
 # Atomic (PJAN-24/PJAN-57): shell complexity lives in the managed script so
 # mise never interpolates temporary variables. The script uses mktemp, traps
 # cleanup, and replaces .env only after op inject succeeds.
 script = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/materialize-env.sh'"
 [[hooks.enter]]
-script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
+script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py' --root '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
-script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
+script = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project --root '{% raw %}{{config_root}}{% endraw %}'"
 [[hooks.enter]]
 script = "[ -f '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' ] && '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh' || true"
 {%- if agent_hooks_layer %}
@@ -51,16 +57,16 @@ task = "hooks:sync"
 {% endif %}
 [tasks."link:agentfiles"]
 description = "Symlink all agent files to AGENTS.md"
-run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh'"
+run = "'{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh' '{% raw %}{{config_root}}{% endraw %}'"
 
 [tasks."skills:sync"]
 description = "Sync skills from manifest to local CLI dirs"
 depends = ["skills:provision:packs"]
-run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project"
+run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/sync-skills.py' --scope project --root '{% raw %}{{config_root}}{% endraw %}'"
 
 [tasks."skills:provision:packs"]
 description = "Provision every Skillex pack declared in .agents/skills.json"
-run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py'"
+run = "python3 '{% raw %}{{config_root}}{% endraw %}/.mise/scripts/provision-packs.py' --root '{% raw %}{{config_root}}{% endraw %}'"
 {% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 

package/templates/hermes-agent/template/.gitignore.jinja

@@ -8,3 +8,4 @@ runtime/
 .scripts/.provision.log
 .scripts/.last-run
 .scripts/.done-*
+.scripts/.plane-project-id

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -46,6 +46,10 @@ systemd_value() {
   "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-value "$1" \
     || die "systemd value validation failed"
 }
+systemd_scalar() {
+  "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-scalar "$1" \
+    || die "systemd scalar validation failed"
+}
 systemd_environment() {
   "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-environment "$1" "$2" \
     || die "systemd environment validation failed"
@@ -54,17 +58,17 @@ systemd_exec_value() {
   "$PYTHON_BIN" -I "$FLEET_ENV_PARSER" --systemd-exec-value "$1" \
     || die "systemd ExecStart value validation failed"
 }
-GW_DESCRIPTION="$(systemd_value "Hermes Gateway — $DISPLAY_NAME")"
-HB_DESCRIPTION="$(systemd_value "Hermes Heartbeat (reconcile + checkpoint) — $DISPLAY_NAME")"
-TIMER_DESCRIPTION="$(systemd_value "Heartbeat (reconcile + checkpoint) for $AGENT_ID")"
+GW_DESCRIPTION="$(systemd_scalar "Hermes Gateway — $DISPLAY_NAME")"
+HB_DESCRIPTION="$(systemd_scalar "Hermes Heartbeat (reconcile + checkpoint) — $DISPLAY_NAME")"
+TIMER_DESCRIPTION="$(systemd_scalar "Heartbeat (reconcile + checkpoint) for $AGENT_ID")"
 ENV_HERMES_HOME="$(systemd_environment HERMES_HOME "$PROFILE_HOME")"
 ENV_HERMES_BIN="$(systemd_environment HERMES_BIN "$HERMES_BIN")"
 ENV_CODEX_HOME="$(systemd_environment CODEX_HOME "$CODEX_HOME")"
 ENV_TERMINAL_CWD="$(systemd_environment TERMINAL_CWD "$REPO_ROOT")"
-WORKING_DIRECTORY="$(systemd_value "$REPO_ROOT")"
-RUNTIME_ENV_FILE="$(systemd_value "-$RUNTIME/.env")"
-GW_LOG_OUTPUT="$(systemd_value "append:$RUNTIME/logs/gateway.systemd.log")"
-HB_LOG_OUTPUT="$(systemd_value "append:$RUNTIME/logs/heartbeat.log")"
+WORKING_DIRECTORY="$(systemd_scalar "$REPO_ROOT")"
+RUNTIME_ENV_FILE="$(systemd_scalar "-$RUNTIME/.env")"
+GW_LOG_OUTPUT="$(systemd_scalar "append:$RUNTIME/logs/gateway.systemd.log")"
+HB_LOG_OUTPUT="$(systemd_scalar "append:$RUNTIME/logs/heartbeat.log")"
 GW_EXEC_START="$(systemd_exec_value "$ROLE_DIR/.scripts/credential-launch.sh")"
 HB_EXEC_START="$GW_EXEC_START"
 

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -46,19 +46,63 @@ PYEOF
 # Apply a sed substitution to role.yaml in-place. Used to record IDs after
 # external provisioning steps return them.
 yaml_set() {
-  # yaml_set KEY VALUE   (only updates the first match; key must already exist)
+  # yaml_set KEY VALUE   (supports flat and one-level nested keys)
   local key="$1" val="$2"
   python3 - "$ROLE_YAML" "$key" "$val" <<'PYEOF'
-import sys, re, pathlib
+import json, pathlib, re, sys
+
 path, key, val = sys.argv[1:4]
-p = pathlib.Path(path); text = p.read_text()
-# Match `<indent><key>:<...>` and rewrite the value (last leaf only).
-leaf = key.split(".")[-1]
-new = re.sub(rf'(?m)^(\s*{re.escape(leaf)}:\s*)("?)[^"\n]*("?)\s*$',
-             lambda m: f'{m.group(1)}"{val}"', text, count=1)
-if new == text:
-    sys.exit(f"yaml_set: leaf '{leaf}' not found in {path}")
-p.write_text(new)
+p = pathlib.Path(path)
+text = p.read_text(encoding="utf-8")
+parts = key.split(".")
+if len(parts) not in (1, 2) or any(
+    not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_-]*", part) for part in parts
+):
+    sys.exit(f"yaml_set: unsupported key '{key}'")
+
+lines = text.splitlines(keepends=True)
+start, end, parent_indent = 0, len(lines), -1
+if len(parts) == 2:
+    parent, leaf = parts
+    parents = []
+    for index, raw in enumerate(lines):
+        line = raw.rstrip("\r\n")
+        match = re.fullmatch(rf"( *){re.escape(parent)}:\s*(?:#.*)?", line)
+        if match and len(match.group(1)) == 0:
+            parents.append(index)
+    if len(parents) != 1:
+        sys.exit(f"yaml_set: parent '{parent}' not found uniquely in {path}")
+    parent_index = parents[0]
+    parent_indent = 0
+    start = parent_index + 1
+    for index in range(start, len(lines)):
+        candidate = lines[index].rstrip("\r\n")
+        if not candidate.strip() or candidate.lstrip().startswith("#"):
+            continue
+        indent = len(candidate) - len(candidate.lstrip(" "))
+        if indent <= parent_indent:
+            end = index
+            break
+else:
+    leaf = parts[0]
+
+targets = []
+for index in range(start, end):
+    raw = lines[index]
+    line = raw.rstrip("\r\n")
+    match = re.match(rf"^( *){re.escape(leaf)}:\s*", line)
+    if not match:
+        continue
+    indent = len(match.group(1))
+    if (parent_indent < 0 and indent == 0) or (parent_indent >= 0 and indent > parent_indent):
+        targets.append((index, match.group(1)))
+if len(targets) != 1:
+    sys.exit(f"yaml_set: key '{key}' not found uniquely in {path}")
+
+index, indent = targets[0]
+ending = "\r\n" if lines[index].endswith("\r\n") else "\n" if lines[index].endswith("\n") else ""
+lines[index] = f"{indent}{leaf}: {json.dumps(val, ensure_ascii=False)}{ending}"
+p.write_text("".join(lines), encoding="utf-8")
 PYEOF
 }
 

package/templates/hermes-agent/template/.scripts/lib/parse-fleet-env.py

@@ -389,6 +389,28 @@ def serialize_systemd_value(value: str) -> str:
     return '"' + "".join(escaped) + '"'
 
 
+def serialize_systemd_scalar(value: str) -> str:
+    """Return a scalar directive value without introducing literal quotes."""
+    validate_unicode(value)
+    if "\0" in value:
+        raise FleetEnvParseError(1, "NUL is not allowed in a systemd value")
+    if "\r" in value or "\n" in value:
+        raise FleetEnvParseError(1, "newline control characters are not allowed in a systemd value")
+    escaped: list[str] = []
+    for char in value:
+        if char == "\\":
+            escaped.append(r"\\")
+        elif char == "%":
+            escaped.append("%%")
+        elif char == "\t":
+            escaped.append(r"\t")
+        elif ord(char) < 0x20 or ord(char) == 0x7F:
+            escaped.append(f"\\x{ord(char):02x}")
+        else:
+            escaped.append(char)
+    return "".join(escaped)
+
+
 def serialize_systemd_environment(name: str, value: str) -> str:
     if not NAME.fullmatch(name):
         raise FleetEnvParseError(1, "invalid systemd environment variable name")
@@ -685,12 +707,14 @@ def main() -> int:
     parse_mode = len(sys.argv) == 2
     upsert_mode = len(sys.argv) == 5 and sys.argv[1] == "--upsert"
     systemd_value_mode = len(sys.argv) == 3 and sys.argv[1] == "--systemd-value"
+    systemd_scalar_mode = len(sys.argv) == 3 and sys.argv[1] == "--systemd-scalar"
     systemd_exec_value_mode = len(sys.argv) == 3 and sys.argv[1] == "--systemd-exec-value"
     systemd_environment_mode = len(sys.argv) == 4 and sys.argv[1] == "--systemd-environment"
-    if not parse_mode and not upsert_mode and not systemd_value_mode and not systemd_exec_value_mode and not systemd_environment_mode:
+    if not parse_mode and not upsert_mode and not systemd_value_mode and not systemd_scalar_mode and not systemd_exec_value_mode and not systemd_environment_mode:
         print(
             "usage: parse-fleet-env.py PATH | --upsert PATH KEY VALUE | "
-            "--systemd-value VALUE | --systemd-exec-value VALUE | --systemd-environment NAME VALUE",
+            "--systemd-value VALUE | --systemd-scalar VALUE | "
+            "--systemd-exec-value VALUE | --systemd-environment NAME VALUE",
             file=sys.stderr,
         )
         return 2
@@ -698,6 +722,9 @@ def main() -> int:
         if systemd_value_mode:
             print(serialize_systemd_value(sys.argv[2]), end="")
             return 0
+        if systemd_scalar_mode:
+            print(serialize_systemd_scalar(sys.argv[2]), end="")
+            return 0
         if systemd_exec_value_mode:
             print(serialize_systemd_exec_value(sys.argv[2]), end="")
             return 0

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env sh
 # Plane ticket-provider adapter.
 #
-# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (X-API-Key header)
+# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (raw at runtime or
+#               an op:// reference resolved immediately before use)
 # Endpoint:     PLANE_BASE       (default https://plane.delo.sh)
 # Board binding (repo-root .project.json `ticket_provider:`):
 #   workspace: <workspace-slug>      (or env PLANE_WORKSPACE)
@@ -59,6 +60,20 @@ print(value, end="")
 PY
 }
 
+# Resolve an approved secret reference only after selecting the exact provider
+# key. The shared dotenv stays inert and the resolved value exists only in this
+# provider process.
+resolve_secret_value() {
+  value="${1:-}"
+  case "$value" in
+    op://*)
+      command -v op >/dev/null 2>&1 || die "1Password CLI is required for the configured Plane credential"
+      op read "$value" || die "failed to resolve the configured Plane credential"
+      ;;
+    *) printf '%s' "$value" ;;
+  esac
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -103,8 +118,9 @@ if [ -z "${PLANE_API_KEY:-}" ]; then
   if [ -z "${PLANE_API_KEY:-}" ] && [ -f "$FLEET_ENV" ]; then
     PLANE_API_KEY="$(dotenv_value "$FLEET_ENV" "$KEY")"
   fi
-  export PLANE_API_KEY
 fi
+PLANE_API_KEY="$(resolve_secret_value "${PLANE_API_KEY:-}")"
+export PLANE_API_KEY
 
 # api METHOD PATH [JSON_BODY] — call Plane REST, print response body.
 api() {