skillwiki 0.9.12 → 0.9.14

package/dist/cli.js

@@ -6183,6 +6183,10 @@ function readVaultSyncConfig(home) {
     const content = readFileSync7(join29(home, ".skillwiki", ".env"), "utf8");
     let installed = false;
     let role;
+    let serviceScope;
+    let snapshotScript;
+    let snapshotProfile;
+    let snapshotWorktree;
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -6193,12 +6197,42 @@ function readVaultSyncConfig(home) {
       if (v.length === 0) continue;
       if (k === "vault_sync.installed" && v === "true") installed = true;
       if (k === "vault_sync.role") role = v;
+      if (k === "vault_sync.service_scope") serviceScope = v;
+      if (k === "vault_sync.snapshot_script") snapshotScript = v;
+      if (k === "vault_sync.snapshot_profile") snapshotProfile = v;
+      if (k === "vault_sync.snapshot_worktree") snapshotWorktree = v;
     }
-    return { installed, role };
+    return { installed, role, serviceScope, snapshotScript, snapshotProfile, snapshotWorktree };
   } catch {
     return { installed: false };
   }
 }
+function readKeyFromEnvFile(path, keys) {
+  try {
+    const content = readFileSync7(path, "utf8");
+    for (const line of content.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq <= 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (!keys.includes(key)) continue;
+      const value = trimmed.slice(eq + 1).trim();
+      if (value.length > 0) return value;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function resolveSnapshotGitWorktree(config) {
+  if (config.snapshotWorktree) return config.snapshotWorktree;
+  if (config.snapshotProfile) {
+    const fromProfile = readKeyFromEnvFile(config.snapshotProfile, ["WIKI_GIT_WORKTREE", "SNAPSHOT_WORKTREE", "GIT_DIR"]);
+    if (fromProfile) return fromProfile;
+  }
+  const defaultPath = "/root/wiki-git";
+  return existsSync11(defaultPath) ? defaultPath : void 0;
+}
 function vaultSyncChecks(input) {
   const os = input.os ?? platform2();
   const home = input.home;
@@ -6217,7 +6251,89 @@ function vaultSyncChecks(input) {
   const logDir = input.logDir ?? (isMac ? join29(home, "Library", "Logs") : join29(home, ".local", "state", "vault-sync", "log"));
   const shareDir = input.shareDir ?? (isMac ? join29(home, "Library", "Application Support", "vault-sync", "bin") : join29(home, ".local", "share", "vault-sync", "bin"));
   const filterPath = input.filterPath ?? join29(home, ".config", "rclone", "wiki-push-filters.txt");
-  const snapshotPath = input.snapshotScriptPath ?? "/root/.hermes/scripts/wiki-snapshot-v3.sh";
+  const packagedSnapshotPath = join29(shareDir, "wiki-snapshot.sh");
+  const legacySnapshotPath = "/root/.hermes/scripts/wiki-snapshot-v3.sh";
+  const snapshotPath = input.snapshotScriptPath ?? (existsSync11(packagedSnapshotPath) ? packagedSnapshotPath : legacySnapshotPath);
+  if (input.vaultSyncRole === "snapshotter") {
+    const c12 = existsSync11(snapshotPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found snapshot script: ${snapshotPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Snapshot script not found at ${snapshotPath}`);
+    const serviceScope = input.vaultSyncServiceScope ?? "user";
+    const userTimerPath = join29(home, ".config", "systemd", "user", "wiki-snapshot.timer");
+    const systemTimerPath = "/etc/systemd/system/wiki-snapshot.timer";
+    let c22;
+    if (serviceScope === "user" && existsSync11(userTimerPath)) {
+      c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${userTimerPath}`);
+    } else if (serviceScope === "system" && existsSync11(systemTimerPath)) {
+      c22 = check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `Found: ${systemTimerPath}`);
+    } else if (os !== "linux") {
+      c22 = check("warn", "vault_sync_jobs_enabled", "Vault sync jobs enabled", "Snapshotter scheduler is Linux-only and no wiki-snapshot.timer file was found");
+    } else {
+      try {
+        const command = serviceScope === "system" ? "systemctl is-enabled wiki-snapshot.timer" : "systemctl --user is-enabled wiki-snapshot.timer";
+        const out = execSync2(command, {
+          encoding: "utf8",
+          timeout: 2e3,
+          stdio: ["pipe", "pipe", "pipe"]
+        }).trim();
+        c22 = out === "enabled" ? check("pass", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `systemd: wiki-snapshot.timer enabled (${serviceScope})`) : check("error", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `systemd: wiki-snapshot.timer is ${out || "not enabled"} (${serviceScope})`);
+      } catch {
+        c22 = check("error", "vault_sync_jobs_enabled", "Vault sync jobs enabled", `wiki-snapshot.timer check failed (${serviceScope})`);
+      }
+    }
+    const c32 = check(
+      "pass",
+      "vault_sync_last_push_age",
+      "Vault sync last push recency",
+      "Snapshotter host \u2014 leaf wiki-push log not applicable"
+    );
+    const cFetch2 = check(
+      "pass",
+      "vault_sync_last_fetch_status",
+      "Vault sync last fetch status",
+      "Snapshotter host \u2014 leaf wiki-fetch-notify log not applicable"
+    );
+    const c42 = check(
+      "pass",
+      "vault_sync_filter_present",
+      "Vault sync filter file present",
+      "Snapshotter host \u2014 leaf wiki-push filter not applicable"
+    );
+    let c52;
+    try {
+      if (!existsSync11(snapshotPath)) {
+        c52 = check(
+          "error",
+          "vault_sync_snapshot_guard",
+          "Snapshot script guard",
+          `Snapshot script not found at ${snapshotPath}`
+        );
+      } else {
+        const content = readFileSync7(snapshotPath, "utf8");
+        if (!content.includes("--max-delete")) {
+          c52 = check(
+            "error",
+            "vault_sync_snapshot_guard",
+            "Snapshot script guard",
+            `${snapshotPath} is missing --max-delete guard \u2014 dangerous without it`
+          );
+        } else {
+          c52 = check(
+            "pass",
+            "vault_sync_snapshot_guard",
+            "Snapshot script guard",
+            `--max-delete present in ${snapshotPath}`
+          );
+        }
+      }
+    } catch {
+      c52 = check(
+        "error",
+        "vault_sync_snapshot_guard",
+        "Snapshot script guard",
+        `Cannot read ${snapshotPath}`
+      );
+    }
+    return [c12, c22, c32, cFetch2, c42, c52];
+  }
   const pushScriptPath = join29(shareDir, "wiki-push.sh");
   const c1 = existsSync11(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
@@ -6576,20 +6692,21 @@ async function runDoctor(input) {
     checks.push(check("error", "wiki_path_set", "WIKI_PATH configured", "No vault configured. Run `skillwiki init` or pass --vault."));
   }
   const resolvedPath = resolved.ok ? resolved.data.path : void 0;
+  const gitCheckPath = vsConfig.role === "snapshotter" ? resolveSnapshotGitWorktree(vsConfig) ?? resolvedPath : resolvedPath;
   checks.push(checkWikiPathExists(resolvedPath));
   checks.push(checkVaultStructure(resolvedPath));
   checks.push(checkObsidianTemplates(resolvedPath));
-  checks.push(checkVaultGitRemote(resolvedPath));
+  checks.push(checkVaultGitRemote(gitCheckPath));
   checks.push(await checkFleetIdentity({
     vaultPath: resolvedPath,
     home: input.home,
     cwd: input.cwd,
     envValue: input.envValue
   }));
-  checks.push(checkSyncLastPush(resolvedPath));
-  checks.push(checkVaultGitDirty(resolvedPath));
-  checks.push(checkVaultGitAhead(resolvedPath));
-  checks.push(checkVaultGitBehind(resolvedPath));
+  checks.push(checkSyncLastPush(gitCheckPath));
+  checks.push(checkVaultGitDirty(gitCheckPath));
+  checks.push(checkVaultGitAhead(gitCheckPath));
+  checks.push(checkVaultGitBehind(gitCheckPath));
   checks.push(checkVaultGitPullFailures(input.home));
   checks.push(checkDotStoreClean(resolvedPath));
   checks.push(checkS3MountPerf(resolvedPath));
@@ -6605,7 +6722,9 @@ async function runDoctor(input) {
   checks.push(...vaultSyncChecks({
     home: input.home,
     vaultSyncInstalled: vsConfig.installed,
-    vaultSyncRole: vsConfig.role
+    vaultSyncRole: vsConfig.role,
+    vaultSyncServiceScope: vsConfig.serviceScope,
+    snapshotScriptPath: vsConfig.snapshotScript
   }));
   checks.push(...await vaultMetrics(resolvedPath));
   const summary = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js"

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 18 prompt-only skills (wiki-*, proj-*, using-skillwiki) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 18 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/using-skillwiki/SKILL.md

@@ -135,6 +135,15 @@ skillwiki --human fleet context "$VAULT"
 
 If `identity_status` is `unknown` or `invalid`, treat the runtime as ephemeral: do not infer SSH/self aliases, sync authority, deploy authority, or protected-host permissions. Rerun with `--host-id <id>` only after the user confirms the current machine is that named fleet host.
 
+## Session Kind Policy
+
+Before asking questions or running scheduled maintenance, resolve the session kind through the shared `session-kind` policy when the CLI/runtime exposes it.
+
+- `interactive`: prompts are allowed.
+- `headless`: prompts are forbidden; use recorded defaults or fail closed.
+- `goal`: prompts are forbidden; run only automation-ready work or explicitly approved defaults.
+- `satellite`: prompts are forbidden; run only host/profile-allowed jobs and fail closed on unsafe authority.
+
 ## Typical Workflow
 1. **Init** (`wiki-init`) — create vault, set domain and taxonomy
 2. **Ingest** (`wiki-ingest`) — add sources, build pages

package/skills/using-skillwiki/SKILL.md

@@ -135,6 +135,15 @@ skillwiki --human fleet context "$VAULT"
 
 If `identity_status` is `unknown` or `invalid`, treat the runtime as ephemeral: do not infer SSH/self aliases, sync authority, deploy authority, or protected-host permissions. Rerun with `--host-id <id>` only after the user confirms the current machine is that named fleet host.
 
+## Session Kind Policy
+
+Before asking questions or running scheduled maintenance, resolve the session kind through the shared `session-kind` policy when the CLI/runtime exposes it.
+
+- `interactive`: prompts are allowed.
+- `headless`: prompts are forbidden; use recorded defaults or fail closed.
+- `goal`: prompts are forbidden; run only automation-ready work or explicitly approved defaults.
+- `satellite`: prompts are forbidden; run only host/profile-allowed jobs and fail closed on unsafe authority.
+
 ## Typical Workflow
 1. **Init** (`wiki-init`) — create vault, set domain and taxonomy
 2. **Ingest** (`wiki-ingest`) — add sources, build pages