@zerwiz/ymir 0.1.5 → 0.1.8

package/bin/omarchy-plugins.sh

@@ -26,6 +26,19 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 YES=0
 
 case "${1-}" in
@@ -77,7 +90,7 @@ is_installed() {  # <id>
 }
 
 repo_for() {  # <id> — read the repo from the registry's own catalog when reachable
-  local id=$1 cache="$ROOT/state/omarchy-catalog.json"
+  local id=$1 cache="$YMIR_STATE_DIR/omarchy-catalog.json"
   if [ -r "$cache" ]; then
     python3 - "$cache" "$id" <<'PY' 2>/dev/null
 import json,sys
@@ -135,7 +148,7 @@ case "$ACTION" in
       printf 'omarchy-plugins[1]{id,state}:\n  "%s","already installed"\n' "$id"; exit 0
     fi
     # Resolve the repo from the registry catalog; refresh it if absent.
-    cache="$ROOT/state/omarchy-catalog.json"
+    cache="$YMIR_STATE_DIR/omarchy-catalog.json"
     if [ ! -r "$cache" ] && have curl; then
       mkdir -p "$(dirname "$cache")"
       curl -fsS --max-time 25 https://plugins.omarchy.org/catalog.json -o "$cache" 2>/dev/null || true

package/bin/omarchy-sense.sh

@@ -21,7 +21,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-STATE_DIR="${BROKK_STATE_OVERRIDE:-$ROOT/state}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+STATE_DIR="${BROKK_STATE_OVERRIDE:-$YMIR_STATE_DIR}"
 SNAP="$STATE_DIR/omarchy-setup.json"
 
 # Rule 05: this is the OMARCHY layer's sensor, so it is gated on its host. Ymir

package/bin/pi-model-agnostic.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# pi-model-agnostic — pi must not EXPECT any model. Local and online are peers.
+#
+# The law (Allfather, 2026-09-17): a seat that answers is used; a seat that does not
+# must not stop pi from starting. pi was failing at launch because providers pointed at
+# local ports with nothing behind them:
+#   [llama-cpp] failed to reach http://localhost:8080/v1/models: fetch failed
+# An unreachable local seat is a SKIP, not an error.
+#
+# This prunes unreachable LOCAL providers from pi's models config, keeping every seat
+# that answers and every online provider untouched.
+#
+#   bin/pi-model-agnostic.sh            # report and prune
+#   bin/pi-model-agnostic.sh --dry-run  # report only
+set -euo pipefail
+
+CFG="${PI_MODELS_JSON:-$HOME/.pi/agent/models.json}"
+DRY=0
+[ "${1:-}" = "--dry-run" ] && DRY=1
+[ -f "$CFG" ] || { printf 'error: no pi models config at %s\nhelp: set PI_MODELS_JSON\n' "$CFG" >&2; exit 1; }
+
+CFG="$CFG" DRY="$DRY" python3 - <<'INNER'
+import json, os, shutil, sys, time, urllib.request
+
+cfg = os.environ["CFG"]
+dry = os.environ.get("DRY") == "1"
+d = json.load(open(cfg))
+providers = d.get("providers", {})
+
+def reachable(url):
+    if not url:
+        return False
+    probe = url.rstrip("/")
+    if not probe.endswith("/v1"):
+        probe += "/v1"
+    try:
+        with urllib.request.urlopen(probe + "/models", timeout=3) as r:
+            return r.status == 200
+    except Exception:
+        return False
+
+kept, dropped = [], []
+for name, prov in providers.items():
+    base = str(prov.get("baseUrl", ""))
+    local = ("127.0.0.1" in base) or ("localhost" in base) or ("0.0.0.0" in base)
+    if local and not reachable(base):
+        dropped.append((name, base))
+    else:
+        kept.append(name)
+
+print("pi_models[%d]{provider,base,verdict}:" % (len(kept) + len(dropped)))
+for n in kept:
+    print('  "%s","%s","kept"' % (n, providers[n].get("baseUrl", "")))
+for n, b in dropped:
+    print('  "%s","%s","unreachable local seat - pruned"' % (n, b))
+
+if dropped and not dry:
+    shutil.copy2(cfg, cfg + ".bak-" + time.strftime("%Y%m%d%H%M%S"))
+    d["providers"] = {k: v for k, v in providers.items() if k in kept}
+    dm = d.get("defaultProvider")
+    if dm and dm not in kept and kept:
+        d["defaultProvider"] = kept[0]
+        ids = (d["providers"][kept[0]].get("models") or [{}])
+        if ids and ids[0].get("id"):
+            d["defaultModel"] = ids[0]["id"]
+        print("  default -> %s / %s" % (d.get("defaultProvider"), d.get("defaultModel")))
+    json.dump(d, open(cfg, "w"), indent=2)
+    print("pi_models: %d pruned, backup beside the config" % len(dropped))
+elif dry:
+    print("pi_models: dry run - nothing written")
+INNER

package/bin/private-guard.sh

@@ -18,6 +18,20 @@ FORBID='^(hodd/|svartalfaheim/|state/|data/|workspace/(work|personal|memory|comp
 # Allowed tracked exceptions inside those roots.
 ALLOW='^(hodd/(README\.md|\.gitignore|AGENTS\.example\.md|[^/]+\.example(\.md)?)$|svartalfaheim/.*(README\.md|\.gitkeep|\.gitignore|\.example(\.md)?)$|state/\.gitkeep$|data/[^/]+\.example$|assets/reference/state/[^/]+\.example$|\.env\.example|\.env\.sample)$'
 
+# Tenant DOCUMENTS — a wiki, policy set, vision, roadmap or strategy file is
+# company/operator knowledge, not a public asset. It belongs at
+# $YMIR_HOME/hodd/identity/companies/<company>/ and nowhere in this repo.
+# Added 2026-09-17 after `midgard/company_wiki/` was found sitting in the
+# public tree: it was an empty placeholder, but the shape invited the leak.
+#
+# The match is deliberately a DIRECTORY or a doc suffixed with tenant content —
+# NOT the bare word. `svartalfaheim/examples/SECRETS.md` is a public how-to (it
+# teaches where secrets go and holds no value), so a bare `secrets` match would
+# be a false positive.
+TENANT_DOC='((^|/)(company_wiki|wiki|policies|handbook|playbook|internal|confidential)(/|\.)|(^|/)(vision|strategy|roadmap|policies)[^/]*\.(md|txt|rst|pdf|docx?)$)'
+# Public exceptions: a wiki-shaped name that is a genuine scaffold or doc.
+TENANT_DOC_ALLOW='(\.example$|\.example\.md$|README\.md$|/\.gitkeep$)'
+
 scan_list() {
   local hit=0 f
   while IFS= read -r f; do
@@ -25,6 +39,12 @@ scan_list() {
     if printf '%s\n' "$f" | grep -Eq "$FORBID" && ! printf '%s\n' "$f" | grep -Eq "$ALLOW"; then
       printf 'private-guard: tracked private path: %s\n' "$f" >&2
       hit=1
+      continue
+    fi
+    if printf '%s\n' "$f" | grep -Eq "$TENANT_DOC" && ! printf '%s\n' "$f" | grep -Eq "$TENANT_DOC_ALLOW"; then
+      printf 'private-guard: tenant/company document in the public tree: %s\n' "$f" >&2
+      printf '  company knowledge belongs at $YMIR_HOME/hodd/identity/companies/, never here\n' >&2
+      hit=1
     fi
   done
   return "$hit"

package/bin/project-git.sh

@@ -4,12 +4,12 @@
 # remote. Auth is a REFERENCE (app|pat|ssh|gh), never a value.
 #
 # Usage:
-#   project-git.sh <project-id> [--field host|owner|repo|remote|default_branch|auth]
+#   project-git.sh <project-id> [--field host|owner|repo|remote|default_branch|auth|machine]
 #   project-git.sh list
 #   project-git.sh --version
 set -u
 
-VERSION="1.0.0"
+VERSION="1.2.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 # shellcheck source=bin/hoard-lib.sh
@@ -26,6 +26,14 @@ while [ $# -gt 0 ]; do case "$1" in --field) FIELD=${2-}; shift 2 ;; *) shift ;;
 
 if [ "$ID" = "list" ]; then
   n=$(grep -cE '^\s*-\s+id:' "$REG" 2>/dev/null || echo 0)
+  if [ "$FIELD" = "about" ]; then
+    printf 'projects[%s]{id,about}:\n' "$n"
+    awk '
+      /^[[:space:]]*-[[:space:]]+id:/ { sub(/^[[:space:]]*-[[:space:]]+id:[[:space:]]*/, ""); id=$0 }
+      /^[[:space:]]*about:/ { sub(/^[[:space:]]*about:[[:space:]]*"/, ""); sub(/"[[:space:]]*$/, ""); if (id != "") printf "  \"%s\",\"%s\"\n", id, $0 }
+    ' "$REG"
+    exit 0
+  fi
   printf 'projects[%s]{id}:\n' "$n"
   grep -E '^\s*-\s+id:' "$REG" | sed -E 's/^\s*-\s+id:\s*/  "/; s/\s*$/" /'
   exit 0
@@ -41,15 +49,21 @@ block="$(awk -v id="$ID" '
 
 gitline="$(printf '%s\n' "$block" | grep -m1 'git:')"
 val() { printf '%s' "$gitline" | sed -nE "s/.*[ {,]?$1:[[:space:]]*([^,}]+).*/\1/p" | tr -d ' '; }
+# non-git top-level keys resolve from the block itself, not the git line
+blockval() { printf '%s' "$block" | sed -nE "s/^[[:space:]]*$1:[[:space:]]*([^,}]+).*/\1/p" | head -1 | tr -d ' '; }
 
 host="$(val host)"; owner="$(val owner)"; repo="$(val repo)"; remote="$(val remote)"; br="$(val default_branch)"; auth="$(val auth)"
+machine="$(blockval machine)"; company="$(blockval company)"; workspace="$(blockval workspace)"
+about="$(printf '%s' "$block" | sed -nE 's/^[[:space:]]*about:[[:space:]]*"(.*)"[[:space:]]*$/\1/p' | head -1)"
 if [ -n "$FIELD" ]; then
   case "$FIELD" in
     host) printf '%s\n' "$host" ;; owner) printf '%s\n' "$owner" ;; repo) printf '%s\n' "$repo" ;;
     remote) printf '%s\n' "$remote" ;; default_branch) printf '%s\n' "$br" ;; auth) printf '%s\n' "$auth" ;;
+    machine) printf '%s\n' "$machine" ;; company) printf '%s\n' "$company" ;; workspace) printf '%s\n' "$workspace" ;;
+    about) printf '%s\n' "$about" ;;
     *) printf 'error: unknown field %s\n' "$FIELD" >&2; exit 2 ;;
   esac
   exit 0
 fi
-printf 'project[1]{id,host,owner,repo,remote,default_branch,auth}:\n'
-printf '  "%s","%s","%s","%s","%s","%s","%s"\n' "$ID" "$host" "$owner" "$repo" "$remote" "$br" "$auth"
+printf 'project[1]{id,host,owner,repo,remote,default_branch,auth,machine,company,workspace}:\n'
+printf '  "%s","%s","%s","%s","%s","%s","%s","%s","%s","%s"\n' "$ID" "$host" "$owner" "$repo" "$remote" "$br" "$auth" "$machine" "$company" "$workspace"

package/bin/public-guard.sh

@@ -43,8 +43,9 @@ leaks() {  # stdin → prints masked hits, returns 1 on any
 scan_one() {  # $1 = path in the index; prints a finding, returns 1 when clean
   local f="$1" out
   # This file necessarily contains the patterns it looks for; scanning it would
-  # always fail. Exempt by name, and keep the patterns here honest.
-  case "$f" in bin/public-guard.sh|bin/secret-guard.sh) return 0 ;; esac
+  # always fail. The same is true of every guard whose job is to name a secret
+  # shape, so all three are exempt by name — and the patterns in them stay honest.
+  case "$f" in bin/public-guard.sh|bin/secret-guard.sh|bin/hoard-guard.sh) return 0 ;; esac
   printf '%s\n' "$f" | grep -Eq "$PUBLIC" || return 0
   printf '%s\n' "$f" | grep -Eq "$APPEND_ONLY" && return 0
   out="$(git -C "$ROOT" show ":$f" 2>/dev/null | leaks)" || true

package/bin/sessrumnir-ensure.sh

@@ -90,7 +90,7 @@ case "$CMD" in
     if [ "$DO_INSTALL" = 1 ]; then
       npm_install || true
       ensure_electron_binary || true
-      [ "$built_present" ] || build_app || true
+      built_present || build_app || true
       status
       exit $?
     fi

package/bin/sessrumnir.sh

@@ -14,9 +14,22 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
 APP="$ROOT/apps/sessrumnir"
-PID_FILE="$ROOT/state/sessrumnir.pid"
-LOG_FILE="$ROOT/state/sessrumnir.log"
+PID_FILE="$YMIR_STATE_DIR/sessrumnir.pid"
+LOG_FILE="$YMIR_STATE_DIR/sessrumnir.log"
 
 case "${1-}" in -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;; -h|--help|"") sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
 ACTION="${1:-start}"; shift || true
@@ -72,7 +85,7 @@ fi
   exit 1
 }
 
-mkdir -p "$ROOT/state"
+mkdir -p "$YMIR_STATE_DIR"
 args=()
 [ -n "$WORKSPACE" ] && args+=("$WORKSPACE")
 

package/bin/smidja-board.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# smidja-board.sh — Smíðja's board, by one name.
+#
+# The visualizer can live in two very different trees: a clone's
+# `apps/smidja-factory/apps/visualizer`, or the `@zerwiz/smidja-factory` package
+# a user got from npm. Its database lives in the HOME (`$YMIR_HOME/smidja/smidja.db`),
+# not in either tree. This door resolves all three so the operator never has to.
+#
+#   smidja-board.sh build     # install deps and build the UI (./dist)
+#   smidja-board.sh start     # raise the API + UI, detached, ready to answer
+#   smidja-board.sh stop
+#   smidja-board.sh status
+#   smidja-board.sh --version | --help
+#
+# The operator's door is `ymir smidja [build|start|stop|status]` — this is what
+# that door runs.
+#
+# Exit: 0 ok, 1 error, 2 usage.
+set -u
+
+VERSION="1.0.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+YMIR_HOME="${YMIR_HOME:-$HOME/Documents/Ymir}"
+
+# shellcheck source=bin/hoard-lib.sh
+. "$SCRIPT_DIR/hoard-lib.sh"
+ymir_home_root YMIR_HOME
+hoard_state_dir STATE
+# shellcheck source=bin/smidja-lib.sh
+. "$SCRIPT_DIR/smidja-lib.sh"
+
+PORT="${SMIDJA_VIZ_API_PORT:-8437}"
+PID_FILE="$STATE/smidja-viz-api.pid"
+LOG_FILE="$STATE/smidja-viz-api.log"
+
+# The database follows the HOME; SMIDJA_DB overrides. A tree-local copy is the
+# last resort, for a checkout that keeps its own.
+SMIDJA_DB_PATH="${SMIDJA_DB:-}"
+if [ -z "$SMIDJA_DB_PATH" ]; then
+  for _db in "$YMIR_HOME/smidja/smidja.db" "$ROOT/apps/smidja/smidja_data/smidja.db"; do
+    [ -f "$_db" ] && { SMIDJA_DB_PATH="$_db"; break; }
+  done
+fi
+
+viz_dir() {  # <result-var>
+  local result_var=${1-} v
+  [ -n "$result_var" ] || return 2
+  if smidja_visualizer_dir v; then printf -v "$result_var" '%s' "$v"; return 0; fi
+  printf -v "$result_var" '%s' ""; return 1
+}
+
+alive() { [ -f "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE" 2>/dev/null)" 2>/dev/null; }
+
+case "${1-}" in
+  -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;
+  -h|--help|"") sed -n '2,18p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+esac
+ACTION="$1"
+
+VIZ=""
+if ! viz_dir VIZ; then
+  printf 'error: the visualizer is not installed in this tree\n'
+  printf 'help: npm i -g @zerwiz/ymir (the smithy arrives as @zerwiz/smidja-factory)\n'
+  exit 1
+fi
+
+case "$ACTION" in
+  build)
+    if ! command -v bun >/dev/null 2>&1; then
+      printf 'error: bun is needed to build the UI\nhelp: bin/prereq-ensure.sh bun\n' >&2; exit 1
+    fi
+    printf 'visualizer_build[1]{step,state}:\n'
+    if [ ! -d "$VIZ/node_modules" ]; then
+      if (cd "$VIZ" && bun install >/dev/null 2>&1); then printf '  "deps","installed"\n'
+      else printf '  "deps","FAILED — (cd %s && bun install)"\n' "$VIZ" >&2; exit 1; fi
+    else printf '  "deps","present"\n'; fi
+    if (cd "$VIZ" && bun run build >/dev/null 2>&1) || (cd "$VIZ" && bunx vite build >/dev/null 2>&1); then
+      printf '  "ui","%s/dist"\n' "$VIZ"
+    else
+      printf 'error: the UI build failed\nhelp: (cd %s && bun run build)\n' "$VIZ" >&2; exit 1
+    fi
+    ;;
+  start)
+    command -v bun >/dev/null 2>&1 || { printf 'error: bun is needed to run the visualizer\nhelp: bin/prereq-ensure.sh bun\n' >&2; exit 1; }
+    [ -n "$SMIDJA_DB_PATH" ] && [ -f "$SMIDJA_DB_PATH" ] || {
+      printf 'error: no smidja.db found\nhelp: bin/smidja-bootstrap.sh (creates $YMIR_HOME/smidja/smidja.db)\n' >&2; exit 1; }
+    [ -d "$VIZ/dist" ] || printf 'note: the UI is unbuilt — the API will answer and show no interface\nnote: mend it with: bin/ymir-visualizer.sh build\n' >&2
+    if alive; then
+      printf 'visualizer[1]{state,pid,url}:\n  "already running","%s","http://127.0.0.1:%s/"\n' "$(cat "$PID_FILE")" "$PORT"
+      exit 0
+    fi
+    mkdir -p "$STATE"
+    # ymir_detach PRINTS the pid it spawned (setsid/nohup is its business, not
+    # ours); reading $! here would read a variable the helper already consumed.
+    pid=""
+    if command -v ymir_detach >/dev/null 2>&1; then
+      pid="$(ymir_detach env CMD_DB="$SMIDJA_DB_PATH" PORT="$PORT" bun run "$VIZ/server/index.ts" 2>>"$LOG_FILE")"
+    fi
+    if [ -z "$pid" ]; then
+      ( cd "$VIZ" && exec env CMD_DB="$SMIDJA_DB_PATH" PORT="$PORT" bun run server/index.ts ) >>"$LOG_FILE" 2>&1 &
+      pid="$!"
+    fi
+    [ -n "$pid" ] && printf '%s\n' "$pid" >"$PID_FILE"
+    for _i in $(seq 1 20); do
+      curl -s -o /dev/null --max-time 1 "http://127.0.0.1:$PORT/api/health" 2>/dev/null && break
+      sleep 0.5
+    done
+    if curl -s --max-time 2 "http://127.0.0.1:$PORT/api/health" >/dev/null 2>&1; then
+      printf 'visualizer[1]{state,db,url}:\n  "up","%s","http://127.0.0.1:%s/"\n' "$SMIDJA_DB_PATH" "$PORT"
+    else
+      printf 'error: the visualizer did not answer on :%s\nhelp: see %s\n' "$PORT" "$LOG_FILE" >&2; exit 1
+    fi
+    ;;
+  stop)
+    if alive; then
+      kill "$(cat "$PID_FILE")" 2>/dev/null; rm -f "$PID_FILE"
+      printf 'visualizer[1]{state}:\n  "stopped"\n'
+    else
+      rm -f "$PID_FILE"
+      printf 'visualizer[1]{state}:\n  "not running"\n'
+    fi
+    ;;
+  status)
+    local_db="${SMIDJA_DB_PATH:-none}"
+    if alive && curl -s --max-time 2 "http://127.0.0.1:$PORT/api/health" >/dev/null 2>&1; then
+      printf 'visualizer[3]{state,pid,db,url}:\n  "up","%s","%s","http://127.0.0.1:%s/"\n' "$(cat "$PID_FILE")" "$local_db" "$PORT"
+    elif alive; then
+      printf 'visualizer[2]{state,pid,note}:\n  "starting or wedged","%s","answers nothing on :%s — see %s"\n' "$(cat "$PID_FILE")" "$PORT" "$LOG_FILE"
+      exit 1
+    else
+      printf 'visualizer[3]{state,tree,db,ui}:\n  "down","%s","%s","%s"\n' "$VIZ" "$local_db" "$([ -d "$VIZ/dist" ] && echo built || echo unbuilt)"
+    fi
+    ;;
+  *) printf 'error: unknown action %s\nhelp: bin/smidja-board.sh [build|start|stop|status]\n' "$ACTION" >&2; exit 2 ;;
+esac

package/bin/smidja-bootstrap.sh

@@ -69,7 +69,11 @@ if command -v uv >/dev/null 2>&1; then
       python3 -c '
 import os, sys
 from pathlib import Path
-sys.path.insert(0, str(Path.cwd() / "smidja"))
+root = Path.cwd()
+for sub in ("apps/smidja", "smidja"):
+    p = root / sub
+    if (p / "smidja_modules").is_dir():
+        sys.path.insert(0, str(p)); break
 from smidja_modules.tracer import Tracer
 db = os.environ["SMIDJA_BS_DB"]
 events = str(Path(db).parent / "sessions" / "bootstrap" / "events.jsonl")

package/bin/smidja-lib.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# smidja-lib.sh — where the smithy's parts actually live.
+#
+# Two installs, one name. In a clone the smithy sits at `apps/smidja-factory`
+# (the registry's `repo: apps/<path>` block clones it there), and
+# `.agents/skills/smidja-factory` is a symlink to it. In a packaged install the
+# tree has no `apps/` at all: the smithy arrives as a dependency, at
+# `node_modules/@zerwiz/smidja-factory`, and that symlink dangles.
+#
+# Every script that needs the visualizer resolves it HERE, so the two shapes can
+# never disagree (Rule 07). Source-safe; defines functions only.
+#
+#   smidja_factory_dir    <result-var>   the smithy: skill, skills/, templates/, apps/
+#   smidja_visualizer_dir <result-var>   the board: its server, its UI source, its dist
+set -u
+
+# A surface has a name the operator knows and a package has a name npm serves;
+# they are not always the same, and the smithy is the pair that proves it.
+SMIDJA_SURFACE="smidja"
+SMIDJA_PACKAGE="smidja-factory"
+
+smidja_factory_dir() {  # <result-var> — the smithy's directory, or empty
+  local result_var=${1-} root="${YMIR_ROOT_DIR:-}" c
+  [ -n "$result_var" ] || return 2
+  if [ -z "$root" ]; then
+    root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  fi
+  for c in \
+    "$root/apps/$SMIDJA_PACKAGE" \
+    "$root/node_modules/@zerwiz/$SMIDJA_PACKAGE" \
+    "$root/.agents/skills/$SMIDJA_PACKAGE"
+  do
+    # A dangling symlink is not a home: the visualizer must be readable there.
+    [ -d "$c/apps/visualizer" ] && { printf -v "$result_var" '%s' "$c"; return 0; }
+  done
+  printf -v "$result_var" '%s' ""
+  return 1
+}
+
+smidja_visualizer_dir() {  # <result-var> — the visualizer (server · UI source · dist)
+  local result_var=${1-} factory
+  [ -n "$result_var" ] || return 2
+  if smidja_factory_dir factory; then
+    printf -v "$result_var" '%s' "$factory/apps/visualizer"
+    return 0
+  fi
+  printf -v "$result_var" '%s' ""
+  return 1
+}

package/bin/syn-asset-pretool-check.sh

@@ -16,7 +16,20 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-READS="${SYN_ASSET_READS:-$ROOT/state/asset-reads}"
+
+# The roots that live OUTSIDE the code tree: this machine's records and the
+# runtime state belong to the home the operator chose at installation, never in
+# the tree — a packaged install replaces its tree on upgrade (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_state_dir YMIR_STATE_DIR
+hoard_data_dir YMIR_DATA_DIR
+READS="${SYN_ASSET_READS:-$YMIR_STATE_DIR/asset-reads}"
 TARGET=""; NOTE=""
 while [ $# -gt 0 ]; do
   case "$1" in

package/bin/syn-spawn-pretool-check.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# syn-spawn-pretool-check.sh - PreToolUse seatbelt for spawning and for typing.
+#
+# Sýn guards how workers are raised. The failure this exists to end, observed
+# live: an agent (me) hand-fired `herdr-run.sh eindri`, then delivered the brief
+# by TYPING it into the pane — and when the agent had already exited the brief
+# was typed into **bash**, where it sat as a command. Workers were "sent" and
+# never started, and text was executed in a shell. One door exists for this and
+# it is `bin/einherjar-spawn.sh` (firstmate's `fm-spawn.sh`, ported): it creates
+# the worktree, records `state/<id>.meta`, and fails closed on an unverified
+# harness.
+#
+# Usage: syn-spawn-pretool-check.sh --command <bash command>
+# Exit:  0 = allow, 2 = block (stderr carries the reason and the remedy)
+set -u
+
+command_text=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --command) command_text=${2-}; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+# 1. Never type into a pane. A brief is not keystrokes: typing lands in whatever
+#    owns the pane, and when the agent has exited that is the shell.
+case "$command_text" in
+  *"pane input"*|*"send-keys"*|*"pane type"*)
+    printf 'denied: do not type into a pane — a brief delivered as keystrokes lands in whatever owns it (a shell, once the agent has exited)\n' >&2
+    printf 'help: seat the worker through the door: bin/einherjar-spawn.sh <task-id> <project-dir> --mode local-only --harness opencode --model <model> --backend herdr\n' >&2
+    exit 2 ;;
+esac
+
+# 2. Never hand-raise an Eindri. `herdr-run.sh run` (a command in a pane) is
+#    fine; raising a WORKER by hand is not — it skips the worktree, the meta
+#    record, and the harness verification.
+case "$command_text" in
+  *"herdr-run.sh eindri"*|*"herdr-run.sh agent"*)
+    printf 'denied: an Eindri is raised through the door, not by hand — herdr-run.sh eindri skips the worktree, state/<id>.meta, and the harness check\n' >&2
+    printf 'help: bin/einherjar-spawn.sh <task-id> <project-dir> --mode <direct-PR|local-only|no-mistakes> [--harness <name>] [--model <name>] [--backend tmux|herdr]\n' >&2
+    exit 2 ;;
+esac
+
+# 3. A LOCAL model needs a live local server. Requesting one while the router is
+#    down is how a seat came up, errored, and left a shell behind.
+case "$command_text" in
+  *"einherjar-spawn.sh"*)
+    case "$command_text" in
+      *"llama-cpp/"*|*"llama.cpp/"*|*"lmstudio/"*|*"ollama/"*)
+        if ! (exec 3<>/dev/tcp/127.0.0.1/8080) 2>/dev/null; then
+          printf 'denied: a local model was requested but no local server answers on :8080 — the worker will start, fail, and leave a shell\n' >&2
+          printf 'help: raise the llama-router (bin/models-detect.sh reports what is served), or seat the worker on an online model\n' >&2
+          exit 2
+        fi ;;
+    esac ;;
+esac
+
+exit 0

package/bin/tailscale-sync.sh

@@ -16,7 +16,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-CFG="${YMIR_TAILSCALE_SYNC:-$ROOT/config/tailscale-sync.yaml}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+CFG="${YMIR_TAILSCALE_SYNC:-$YMIR_SETTINGS_DIR/tailscale-sync.yaml}"
 DRY=0; ACTION=""; PEER=""
 
 for a in "$@"; do
@@ -62,7 +75,7 @@ except Exception: pass' 2>/dev/null)"
 fi
 
 if [ "$ACTION" = init ]; then
-  TPL="$ROOT/config/tailscale-sync.example.yaml"
+  TPL="$YMIR_SETTINGS_DIR/tailscale-sync.example.yaml"
   if [ -r "$CFG" ]; then printf 'tailscale-sync[1]{action,state}:\n  "init","kept — %s exists"\n' "$CFG"; exit 0; fi
   [ -r "$TPL" ] || { printf 'error: template missing: %s\n' "$TPL" >&2; exit 1; }
   cp "$TPL" "$CFG" && printf 'tailscale-sync[1]{action,path}:\n  "init","%s"\n' "$CFG"

package/bin/telegram-bot.sh

@@ -12,7 +12,20 @@ set -u
 VERSION="1.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="${BROKK_ENV_FILE:-$ROOT/.env.local}"
+
+# The operator's settings and secrets live in the home they chose, never in the
+# code tree — a packaged install replaces its tree on upgrade, and a credential
+# must never sit in a tree that ships (Rule 04).
+if [ -z "${YMIR_HOARD_LIB_LOADED:-}" ]; then
+  _yr="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for _yc in "$_yr/hoard-lib.sh" "$(dirname "$_yr")/bin/hoard-lib.sh"; do
+    [ -r "$_yc" ] && { . "$_yc"; YMIR_HOARD_LIB_LOADED=1; break; }
+  done
+  unset _yr _yc
+fi
+hoard_settings_dir YMIR_SETTINGS_DIR
+hoard_local_env YMIR_ENV_FILE
+ENV_FILE="${BROKK_ENV_FILE:-$YMIR_ENV_FILE}"
 
 case "${1-}" in
   -v|-V|--version) printf '%s\n' "$VERSION"; exit 0 ;;