muse-local-setup.sh
bash
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf
mirror: GitHub Phase A durable MCP OAuth (#270)
Human
minor
⚠ breaking
10 days ago
| 1 | #!/usr/bin/env bash |
| 2 | # muse-local-setup.sh — one-shot LOCAL hygiene for a Muse-as-source-of-truth repo. |
| 3 | # |
| 4 | # Run once per fresh clone. Everything here is local-only, idempotent, and reversible; |
| 5 | # it never changes tracked repo content, the Muse snapshot, or any remote. |
| 6 | # |
| 7 | # What it does: |
| 8 | # 1. Marks volatile .muse/* files `skip-worktree` so Muse rewriting its own bookkeeping |
| 9 | # (HEAD, config.toml, symlogs, logs) on every checkout/commit stops dirtying the git |
| 10 | # tree and blocking `git checkout`. (.muse/harmony/** is left live on purpose.) |
| 11 | # 2. Fails loudly if secret/local files (.env, config/local.yaml, …) are git-tracked — |
| 12 | # they must always be ignored so the bridge/CI never leak them. |
| 13 | # 3. Runs the bridge safety smoke test if present. |
| 14 | # 4. Prints the golden rule about the destructive bridge form. |
| 15 | # |
| 16 | # Canonical guidance: Knowtation vault → areas/muse-ops/muse-local-hygiene.md |
| 17 | # Reverse the skip-worktree bits with: git update-index --no-skip-worktree <file> |
| 18 | |
| 19 | set -euo pipefail |
| 20 | |
| 21 | info() { printf '\033[0;34m[muse-setup]\033[0m %s\n' "$*"; } |
| 22 | ok() { printf '\033[0;32m[muse-setup]\033[0m %s\n' "$*"; } |
| 23 | warn() { printf '\033[1;33m[muse-setup]\033[0m %s\n' "$*"; } |
| 24 | fail() { printf '\033[0;31m[muse-setup] ERROR:\033[0m %s\n' "$*" >&2; exit 1; } |
| 25 | |
| 26 | command -v git >/dev/null 2>&1 || fail "git is required." |
| 27 | REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || fail "Not inside a git repository." |
| 28 | cd "$REPO_ROOT" |
| 29 | |
| 30 | # ── 1. skip-worktree the volatile .muse bookkeeping files ──────────────────────────────── |
| 31 | info "Applying skip-worktree to volatile .muse/* files (keeping .muse/harmony/** live)…" |
| 32 | applied=0 |
| 33 | while IFS= read -r f; do |
| 34 | [ -n "$f" ] || continue |
| 35 | if git update-index --skip-worktree "$f" 2>/dev/null; then |
| 36 | applied=$((applied + 1)) |
| 37 | fi |
| 38 | done < <(git ls-files .muse/ | grep -Ev '^\.muse/harmony/' || true) |
| 39 | ok "skip-worktree set on ${applied} volatile .muse file(s)." |
| 40 | |
| 41 | # ── 2. Guard: secrets/local files must never be git-tracked ────────────────────────────── |
| 42 | info "Verifying secret/local files are NOT git-tracked…" |
| 43 | tracked_secrets="$(git ls-files \ |
| 44 | '.env' '.env.*' \ |
| 45 | 'config/local.yaml' 'config/*-local.*' \ |
| 46 | '*.key' '*.pem' '*.p12' 2>/dev/null | grep -Ev '(^|/)\.env\.example$' || true)" |
| 47 | if [ -n "$tracked_secrets" ]; then |
| 48 | warn "These secret/local files are git-tracked and MUST be untracked:" |
| 49 | printf ' %s\n' $tracked_secrets >&2 |
| 50 | fail "Untrack them (keep the working copy) with: git rm --cached <file> — then re-run this script." |
| 51 | fi |
| 52 | ok "No secret/local files are git-tracked." |
| 53 | |
| 54 | # ── 3. Bridge safety smoke test (if present) ───────────────────────────────────────────── |
| 55 | if [ -f scripts/test-muse-bridge-safety.sh ]; then |
| 56 | if command -v muse >/dev/null 2>&1; then |
| 57 | info "Running bridge safety smoke test…" |
| 58 | bash scripts/test-muse-bridge-safety.sh || fail "Bridge safety smoke test FAILED — do not run the bridge until resolved." |
| 59 | ok "Bridge safety smoke test passed." |
| 60 | else |
| 61 | warn "muse not on PATH — skipping bridge safety smoke test." |
| 62 | fi |
| 63 | else |
| 64 | info "No scripts/test-muse-bridge-safety.sh in this repo — skipping safety smoke test." |
| 65 | fi |
| 66 | |
| 67 | # ── 4. Golden rule ─────────────────────────────────────────────────────────────────────── |
| 68 | cat <<'RULE' |
| 69 | |
| 70 | ──────────────────────────────────────────────────────────────────────────── |
| 71 | GOLDEN RULE: never run `muse bridge git-export/import --git-dir .` on a working |
| 72 | tree — it deletes ignored files (.env, config/local.yaml, data/) permanently. |
| 73 | Mirror to GitHub ONLY via: ./scripts/muse-bridge-deploy.sh "mirror: <desc>" |
| 74 | After a merge, reconcile: git fetch origin && git checkout main && git reset --hard origin/main |
| 75 | ──────────────────────────────────────────────────────────────────────────── |
| 76 | |
| 77 | RULE |
| 78 | ok "Local Muse hygiene setup complete." |
File History
1 commit
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf
mirror: GitHub Phase A durable MCP OAuth (#270)
Human
minor
⚠
10 days ago