dguiducci
080ea736e4
Nightly Build / build (push) Successful in 7m38s
`user-memory/` and `shared-memory/` live in SQLite, so nothing of them existed on disk — and that nothing was worse than it looks. `cat user-memory/x.md` returned a bare ENOENT, which a model reads as "the note is missing" rather than "wrong door"; and `mkdir -p user-memory && echo … > user-memory/x.md` *succeeded*, writing a real file into the home that no reader ever visits (every reader goes to `memory_docs`) and that the next `ls` then confirms as if it had worked. Each root now gets a read-only bind mount holding a README that names the tools to use instead. Read-only as a mount rather than as a mode: the container user has passwordless sudo, so a chmod would be a suggestion, while `:ro` holds — remounting needs CAP_SYS_ADMIN. Verified in a scratch container: write, sudo write, sudo chmod, sudo mount -o remount,rw and sudo rm all fail. And a README rather than an empty directory, because "Permission denied" is an error, not an instruction — models answer it by reaching for sudo; the README puts the correction in the same directory the failing command just named. The mounts are deliberately not part of `UserFs`: they back no agent path and the host-side fs-tools must never resolve into them. They reach existing containers as a fourth self-heal axis in `reusable()`, not as an IMAGE_TAG bump — the image is unchanged, and a bump would make every installation rebuild it to fix a mount. The matching half is in `classify_memory`, which now strips the home spellings (`./`, `~/`, `/root/`) before matching the root. Without it `~/user-memory/x.md` missed the match and fell through to the disk router — becoming exactly the invisible physical file the signpost exists to prevent. `agents/common/memory.md` says the rule outright: the stores are reachable only through the file tools and `memory_search`, never through `execute_cmd`.
74 lines
3.2 KiB
Plaintext
74 lines
3.2 KiB
Plaintext
# ── Runtime config & secrets ──────────────────────────────────────────────────
|
|
# Copy of default.config.yaml with real API keys — never commit
|
|
/config.yml
|
|
/config/
|
|
config.yml.bak
|
|
blueprint/
|
|
/.understand-anything
|
|
# ── Database & runtime data ───────────────────────────────────────────────────
|
|
/database/
|
|
# Per-user container home dirs ({WD}/homes/{userid}) — instance data, not source
|
|
/homes/
|
|
# Read-only memory signposts mounted into every container; regenerated at boot
|
|
# from the consts in crates/skald-core/src/container/mod.rs
|
|
/.memory-signpost/
|
|
# SQLite WAL-mode sidecar files (journal_mode=WAL)
|
|
*.db-wal
|
|
*.db-shm
|
|
*.db-journal
|
|
/data/
|
|
/logs/
|
|
/tmp/
|
|
/scripts/
|
|
# Connector folders installed from the marketplace — instance data, like homes/
|
|
# and database/, not source. See crates/skald-core/src/mcp/install.rs
|
|
/connectors/
|
|
|
|
# ── Rust build artifacts ──────────────────────────────────────────────────────
|
|
/target/
|
|
/deploy/
|
|
# Binary installed by ./build.sh, executed by ./run.sh
|
|
# ── Build output ──────────────────────────────────────────────────────────────
|
|
/dist/
|
|
/bin/
|
|
|
|
# ── Python environment ────────────────────────────────────────────────────────
|
|
/.venv/
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
|
|
# ── Node / WhatsApp bridge ────────────────────────────────────────────────────
|
|
node_modules/
|
|
# whatsapp-web.js local auth & cache
|
|
.wwebjs_auth/
|
|
.wwebjs_cache/
|
|
|
|
# ── LLM models (large binary files) ──────────────────────────────────────────
|
|
/models/
|
|
|
|
# ── Uploads ───────────────────────────────────────────────────────────────────
|
|
/uploads/
|
|
|
|
# ── macOS ─────────────────────────────────────────────────────────────────────
|
|
.DS_Store
|
|
|
|
# ── Private skills ────────────────────────────────────────────────────────────
|
|
skills/.gitignore
|
|
|
|
# ── Editors & IDEs ────────────────────────────────────────────────────────────
|
|
.claude/
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
*.swo
|
|
run-log.sh
|
|
/backup.sh
|
|
/reset.sh
|
|
debug/
|
|
|
|
# Honcho Docker secrets
|
|
honcho/.env
|
|
# Istanza personale — non nel repo
|
|
honcho-local/
|