diff --git a/AGENTS.md b/AGENTS.md index 0e8e68f..f308f30 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,3 +20,20 @@ Claude-generated PLAN-*.md files (from Kagi discussions) are dropped in - After pickup: move the PLAN file to docs/plans/archive/ and add a row to docs/plans/REGISTRY.md (plan -> project ID -> status). +## Security & secret-handling (all agents, all tasks) + +Standing rules (learned from a past leak — see AGENTS.zodiac.md, zodiac repo): + +1. **Secrets are never quoted.** Reference real credentials by type + location + only (e.g. "Kagi session token at docs/...:18"). Never reproduce values in + reports, commit messages, code comments, or chat output. +2. **Findings ledgers stay out of git** (`red-team-output/` is gitignored). + `git add -A` is FORBIDDEN — stage files by name. +3. **No auto-executing tool state in git:** `.claude/`, `.cursor/`, + `.impeccable/` hook configs execute code on tool events — gitignored. +4. **Live configs never committed.** Machine configs (drive UUIDs, machine + policies) live in `~/.config/backup3/` (see config/backup3/README.md). + THIS REPO IS PUBLIC — assume everything pushed is world-readable. +5. **History rewrites need explicit owner approval** (force-push to the public + remote; unreachable objects may persist server-side). + diff --git a/README.md b/README.md index b447adc..0058922 100755 --- a/README.md +++ b/README.md @@ -15,7 +15,6 @@ hermes/1/ ├── scripts/ # Executable tools │ ├── smart_chat.sh # Intelligent model router │ ├── budget_monitor.sh # Cost tracking & budget management -│ ├── sync_chat.sh # Chat backup utility │ ├── extract_kagi_conversations.sh # Kagi conversation extractor │ └── test_kagi_auth.sh # Authentication tester ├── config/ # Configuration files @@ -114,7 +113,6 @@ hermes logs costs --daily --last 7d |--------|---------|-------| | `smart_chat.sh` | Intelligent model selection | `./scripts/smart_chat.sh "prompt"` | | `budget_monitor.sh` | Cost tracking | `./scripts/budget_monitor.sh status` | -| `sync_chat.sh` | Chat backup | `./scripts/sync_chat.sh` | | `extract_kagi_conversations.sh` | Export Kagi threads | `./scripts/extract_kagi_conversations.sh` | | `test_kagi_auth.sh` | Test authentication | `./scripts/test_kagi_auth.sh` | diff --git a/scripts/sync_chat.sh b/scripts/sync_chat.sh deleted file mode 100755 index 240b24b..0000000 --- a/scripts/sync_chat.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/bash - -# Sync Chat Script -# Appends the current conversation to chat_history and updates chat_current - -# Get current timestamp -TIMESTAMP=$(date +"%Y%m%d_%H%M%S") -CHAT_HISTORY="chat_history_${TIMESTAMP}.md" - -# Get the current directory -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" - -echo "Syncing chat history..." -echo "Timestamp: $TIMESTAMP" -echo - -# Function to append to chat history -sync_chat() { - local chat_file="$SCRIPT_DIR/agent_logging/chat_current.md" - local history_file="$SCRIPT_DIR/agent_logging/$CHAT_HISTORY" - - # Check if chat_current.md exists - if [ ! -f "$chat_file" ]; then - echo "❌ chat_current.md not found!" - echo "Creating new chat_current.md..." - cat > "$chat_file" << 'EOF' -# Current Chat Session - -**Started**: $(date +"%Y-%m-%d") -**Status**: Active - ---- - -## Conversation Log - -EOF - fi - - # Create backup of current chat - if [ -f "$chat_file" ]; then - echo "✓ Creating backup: $history_file" - cp "$chat_file" "$history_file" - - # Add footer to history file - echo "" >> "$history_file" - echo "---" >> "$history_file" - echo "Backed up from chat_current.md on $(date)" >> "$history_file" - - echo "✓ Backup created successfully" - else - echo "❌ No chat history to backup" - fi -} - -# Main execution -sync_chat - -echo -echo "📁 Files created:" -echo " - agent_logging/$CHAT_HISTORY" -echo " - agent_logging/chat_current.md (updated)" -echo -echo "✅ Chat sync complete!" \ No newline at end of file diff --git a/skills/hermes-macos-project-setup/SKILL.md b/skills/hermes-macos-project-setup/SKILL.md index e9bb53a..bfaef03 100644 --- a/skills/hermes-macos-project-setup/SKILL.md +++ b/skills/hermes-macos-project-setup/SKILL.md @@ -39,14 +39,14 @@ bw --version ### 2. Tangled SSH ```bash -ssh-keygen -t ed25519 -C "you@email.com" -f ~/.ssh/id_ed25519_tangled +ssh-keygen -t ed25519 -C "you@email.com" -f ~/.ssh/id_ed25519_ # Register at https://tangled.org/settings/keys (paste the .pub) cat >> ~/.ssh/config << 'SSH' Host tangled.org HostName tangled.org User git - IdentityFile ~/.ssh/id_ed25519_tangled + IdentityFile ~/.ssh/id_ed25519_ IdentitiesOnly yes SSH diff --git a/skills/hermes-macos-project-setup/references/scripts/project-init.sh b/skills/hermes-macos-project-setup/references/scripts/project-init.sh index 5a63900..a0b2b39 100755 --- a/skills/hermes-macos-project-setup/references/scripts/project-init.sh +++ b/skills/hermes-macos-project-setup/references/scripts/project-init.sh @@ -43,9 +43,9 @@ if [ $MISSING -eq 1 ]; then exit 1 fi -if [ ! -f ~/.ssh/id_ed25519_tangled ]; then - echo -e "${YELLOW}⚠ Tangled SSH key not found at ~/.ssh/id_ed25519_tangled${NC}" - echo " Generate: ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_tangled" +if ! ls ~/.ssh/id_ed25519_* >/dev/null 2>&1; then + echo -e "${YELLOW}⚠ No Tangled SSH key found (~/.ssh/id_ed25519_*)${NC}" + echo " Generate: ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_" echo " Register: https://tangled.org/settings/keys" exit 1 fi diff --git a/skills/hermes-macos-project-setup/references/templates/hermes.md.tmpl b/skills/hermes-macos-project-setup/references/templates/hermes.md.tmpl index e40f508..aa9c414 100644 --- a/skills/hermes-macos-project-setup/references/templates/hermes.md.tmpl +++ b/skills/hermes-macos-project-setup/references/templates/hermes.md.tmpl @@ -21,7 +21,7 @@ ## AT Protocol - `wispctl` OAuth session: `~/.config/wispctl/state.sqlite` -- Tangled SSH: `~/.ssh/id_ed25519_tangled` +- Tangled SSH: `~/.ssh/id_ed25519_` - DID:WEB private key: `~/.config/{{PROJECT_NAME}}/did-web-private-key.hex` (0o600) {{/IS_ATPROTO_APP}} diff --git a/skills/productivity/project-bootstrap/templates/hermes.md.tmpl b/skills/productivity/project-bootstrap/templates/hermes.md.tmpl index e40f508..aa9c414 100644 --- a/skills/productivity/project-bootstrap/templates/hermes.md.tmpl +++ b/skills/productivity/project-bootstrap/templates/hermes.md.tmpl @@ -21,7 +21,7 @@ ## AT Protocol - `wispctl` OAuth session: `~/.config/wispctl/state.sqlite` -- Tangled SSH: `~/.ssh/id_ed25519_tangled` +- Tangled SSH: `~/.ssh/id_ed25519_` - DID:WEB private key: `~/.config/{{PROJECT_NAME}}/did-web-private-key.hex` (0o600) {{/IS_ATPROTO_APP}} diff --git a/skills/productivity/project-organization/SKILL.md b/skills/productivity/project-organization/SKILL.md index 617c526..adc510d 100644 --- a/skills/productivity/project-organization/SKILL.md +++ b/skills/productivity/project-organization/SKILL.md @@ -53,7 +53,7 @@ SSH configuration (`~/.ssh/config`): Host tangled.org HostName tangled.org User git - IdentityFile ~/.ssh/id_ed25519_tangled + IdentityFile ~/.ssh/id_ed25519_ IdentitiesOnly yes AddressFamily inet ``` diff --git a/skills/productivity/project-organization/references/directory-structure.md b/skills/productivity/project-organization/references/directory-structure.md index a02b60a..d93a11d 100644 --- a/skills/productivity/project-organization/references/directory-structure.md +++ b/skills/productivity/project-organization/references/directory-structure.md @@ -10,17 +10,11 @@ hermes/1/ ├── docs/ 📚 Documentation │ ├── SYSTEMS_TEST_RESULTS.md # Systems test results │ ├── kagi-cli-guide.md # Kagi CLI guide -│ ├── kagi-authentication-guide.md # Auth reference -│ ├── MODEL_STRATEGY_GUIDE.md # Model selection guide -│ └── agent_logging/ # Chat history logs -│ ├── README.md -│ ├── LOGIN.md -│ ├── chat_current.md -│ └── chat_history_*.md +│ ├── BACKUP3-PLAN.md # Backup design +│ └── MODEL_STRATEGY_GUIDE.md # Model selection guide ├── scripts/ ⚡ Executable tools │ ├── smart_chat.sh # Intelligent model router │ ├── budget_monitor.sh # Cost tracking -│ ├── sync_chat.sh # Chat backup utility │ ├── extract_kagi_conversations.sh # Kagi extractor │ └── test_kagi_auth.sh # Auth tester ├── config/ ⚙️ Configuration @@ -59,9 +53,8 @@ This structure works well with OneDrive synchronization: ### Scripts Created 1. **smart_chat.sh** - Intelligently routes to appropriate model based on task type 2. **budget_monitor.sh** - Tracks spending and provides cost optimization tips -3. **sync_chat.sh** - Backs up current chat to timestamped file -4. **extract_kagi_conversations.sh** - Batch exports Kagi conversation threads -5. **test_kagi_auth.sh** - Verifies Kagi authentication status +3. **extract_kagi_conversations.sh** - Batch exports Kagi conversation threads +4. **test_kagi_auth.sh** - Verifies Kagi authentication status ### Configuration - **model_config.yaml** - Contains fallback models, compression settings, budget limits @@ -71,7 +64,6 @@ This structure works well with OneDrive synchronization: - **MODEL_STRATEGY_GUIDE.md** - Complete guide to model selection - **SYSTEMS_TEST_RESULTS.md** - Systems verification results - **kagi-cli-guide.md** - Kagi CLI installation and usage -- **kagi-authentication-guide.md** - Quick auth reference ## Future Applications diff --git a/skills/software-development/feature-reduction-planning/references/tangled-ssh-setup.md b/skills/software-development/feature-reduction-planning/references/tangled-ssh-setup.md index d292d77..0cefe33 100644 --- a/skills/software-development/feature-reduction-planning/references/tangled-ssh-setup.md +++ b/skills/software-development/feature-reduction-planning/references/tangled-ssh-setup.md @@ -14,7 +14,7 @@ Tangled hosts git repositories at `tangled.org` (redirects to `knot1.tangled.sh` ### 1. Generate an SSH key (if none exists) ```bash -ssh-keygen -t ed25519 -C "your-handle@bsky.social" -f ~/.ssh/id_ed25519_tangled -N "" +ssh-keygen -t ed25519 -C "your-handle@bsky.social" -f ~/.ssh/id_ed25519_ -N "" ``` The `-N ""` creates a key without a passphrase. If you use a passphrase, you'll need `ssh-agent` integration. @@ -27,7 +27,7 @@ Add to `~/.ssh/config` (create the file if it doesn't exist, `chmod 600` it): Host tangled.org HostName tangled.org User git - IdentityFile ~/.ssh/id_ed25519_tangled + IdentityFile ~/.ssh/id_ed25519_ IdentitiesOnly yes ``` @@ -36,13 +36,13 @@ Host tangled.org Go to **https://tangled.org/settings/keys** and paste the contents of: ```bash -cat ~/.ssh/id_ed25519_tangled.pub +cat ~/.ssh/id_ed25519_.pub ``` ### 4. Add the key to the SSH agent ```bash -ssh-add ~/.ssh/id_ed25519_tangled +ssh-add ~/.ssh/id_ed25519_ ``` ### 5. Test the connection @@ -73,7 +73,7 @@ git push origin main 3. **`fatal: Could not read from remote repository`** — The repository doesn't exist at that path, or the handle/case is wrong. -4. **SSH agent has no identities** — Run `ssh-add ~/.ssh/id_ed25519_tangled` to load the key into the agent. On macOS, add `UseKeychain yes` to the SSH config and run `ssh-add --apple-use-keychain ~/.ssh/id_ed25519_tangled` for persistence across reboots. +4. **SSH agent has no identities** — Run `ssh-add ~/.ssh/id_ed25519_` to load the key into the agent. On macOS, add `UseKeychain yes` to the SSH config and run `ssh-add --apple-use-keychain ~/.ssh/id_ed25519_` for persistence across reboots. 5. **OneDrive `.git` directory blocks local git operations** — If the project lives in OneDrive, `git add`, `git commit`, and `git push` may all fail with `ETIMEDOUT` because OneDrive hasn't materialized `.git/` files. Workaround: clone from Tangled to `/tmp`, copy modified files there, and push from the `/tmp` clone. See `macos-file-provider-workarounds` skill for the full workflow. diff --git a/skills/software-development/macos-file-provider-workarounds/references/tangled-ssh-setup.md b/skills/software-development/macos-file-provider-workarounds/references/tangled-ssh-setup.md index a598e89..fc5374d 100644 --- a/skills/software-development/macos-file-provider-workarounds/references/tangled-ssh-setup.md +++ b/skills/software-development/macos-file-provider-workarounds/references/tangled-ssh-setup.md @@ -5,7 +5,7 @@ For pushing to Tangled repositories when `osxkeychain` has no stored credentials ## Generate Key ```bash -ssh-keygen -t ed25519 -C "verifier@psingletary.com" -f ~/.ssh/id_ed25519_tangled -N "" +ssh-keygen -t ed25519 -C "your-handle@bsky.social" -f ~/.ssh/id_ed25519_ -N "" ``` ## Configure SSH @@ -15,20 +15,20 @@ Add to `~/.ssh/config`: Host tangled.org HostName tangled.org User git - IdentityFile ~/.ssh/id_ed25519_tangled + IdentityFile ~/.ssh/id_ed25519_ IdentitiesOnly yes ``` ## Add to Tangled -1. Copy the public key: `cat ~/.ssh/id_ed25519_tangled.pub` +1. Copy the public key: `cat ~/.ssh/id_ed25519_.pub` 2. Go to https://tangled.org/settings/keys 3. Paste and save ## Add to SSH Agent & Test ```bash -ssh-add ~/.ssh/id_ed25519_tangled +ssh-add ~/.ssh/id_ed25519_ ssh -T git@tangled.org # Should print "Hi @handle! You're authenticated" ```