> Write install scripts in both template repos that take a repo as their single argument and install all of the files that should be the same in all repos, such as repo policies and code standards and such. And then add an install an update policy script in each repo that clones the template repos to a temporary directory and then runs the installation script from those with the repo itself as a target. So that way any repo can be brought up to standards with a single command. It will then clone the template repo and run the installer script from the template repo to put the template's current files into its own repo and then delete the temporary directory and commit.
> Also, the authoritative location for our per repo files will now be the template directories.
> or rather template repos.
> Actually, no, that's not a good idea, because the template repos have files in each of them that would need to be kept in sync. Make the install scripts inside the template repos fetch the scripts, no, fetch the policy files from the authoritative location using HTTP, not Git.
> The point of putting it in the template repos is that when repos are produced from these templates, they already have the install script that will update their own local policy files. It should default to update the current repo if there is no argument provided.
> The install script should also install the fetcher script from the template repo into the current repo if it doesn't already exist. This will be a no-op on repos that are cloned from the template repo, but on all other repos on their first update to update the policy files, they'll also receive the policy file installer script.
> It should fetch them from prompts, the authoritative location, not a template repo.
(The last answers: which template repo should script/update-policy clone?)
The design as understood, for sneak to confirm before anything is built:
The files that are the same in every repo keep one authoritative copy, in sneak/prompts. That includes the two scripts below. Nothing is fetched from a template repo.
script/install takes the path of a repo clone as its one argument, and updates the repo it sits in when given none. It fetches every shared file from sneak/prompts over HTTP, from its raw URL on git.eeqj.de, not with git, and writes the files into that repo. When the target repo has no script/install yet, it installs that too, so every repo updated once can update itself afterwards. The file list and the rules for keeping a repo's own lines move here from today's script/update-policy in prompts (#164).
Every repo gets script/update-policy. It fetches the current script/install from sneak/prompts over HTTP into a temporary directory, runs it with the repo itself as the target, deletes the temporary directory, and commits the changed files. It does not push. It replaces the version merged in #164, which fetches and pushes by itself.
Open question for sneak: is this design right?
Definition of done, once confirmed:
script/install and script/update-policy live in prompts as described, each with a Makefile target, and prompts/REPO_POLICIES.md says that one command brings a repo up to standards.
Both template repos carry both scripts, and make check passes in each.
Running script/update-policy in a clone of a managed repo installs the current shared files from prompts and commits them, with no other change.
Model: opus-5-5
sneak, in chat on 9 November:
> Write install scripts in both template repos that take a repo as their single argument and install all of the files that should be the same in all repos, such as repo policies and code standards and such. And then add an install an update policy script in each repo that clones the template repos to a temporary directory and then runs the installation script from those with the repo itself as a target. So that way any repo can be brought up to standards with a single command. It will then clone the template repo and run the installer script from the template repo to put the template's current files into its own repo and then delete the temporary directory and commit.
> Also, the authoritative location for our per repo files will now be the template directories.
> or rather template repos.
> Actually, no, that's not a good idea, because the template repos have files in each of them that would need to be kept in sync. Make the install scripts inside the template repos fetch the scripts, no, fetch the policy files from the authoritative location using HTTP, not Git.
> The point of putting it in the template repos is that when repos are produced from these templates, they already have the install script that will update their own local policy files. It should default to update the current repo if there is no argument provided.
> The install script should also install the fetcher script from the template repo into the current repo if it doesn't already exist. This will be a no-op on repos that are cloned from the template repo, but on all other repos on their first update to update the policy files, they'll also receive the policy file installer script.
> It should fetch them from prompts, the authoritative location, not a template repo.
(The last answers: which template repo should `script/update-policy` clone?)
**The design as understood, for sneak to confirm before anything is built:**
- The files that are the same in every repo keep one authoritative copy, in `sneak/prompts`. That includes the two scripts below. Nothing is fetched from a template repo.
- `script/install` takes the path of a repo clone as its one argument, and updates the repo it sits in when given none. It fetches every shared file from `sneak/prompts` over HTTP, from its raw URL on `git.eeqj.de`, not with git, and writes the files into that repo. When the target repo has no `script/install` yet, it installs that too, so every repo updated once can update itself afterwards. The file list and the rules for keeping a repo's own lines move here from today's `script/update-policy` in `prompts` (https://git.eeqj.de/sneak/prompts/pulls/164).
- Both template repos, https://git.eeqj.de/sneak/template-app-go and https://git.eeqj.de/clawbot/go-template-repo, carry `script/install`, so every repo made from them has it from the start.
- Every repo gets `script/update-policy`. It fetches the current `script/install` from `sneak/prompts` over HTTP into a temporary directory, runs it with the repo itself as the target, deletes the temporary directory, and commits the changed files. It does not push. It replaces the version merged in https://git.eeqj.de/sneak/prompts/pulls/164, which fetches and pushes by itself.
**Open question for sneak:** is this design right?
**Definition of done, once confirmed:**
- `script/install` and `script/update-policy` live in `prompts` as described, each with a `Makefile` target, and `prompts/REPO_POLICIES.md` says that one command brings a repo up to standards.
- Both template repos carry both scripts, and `make check` passes in each.
- Running `script/update-policy` in a clone of a managed repo installs the current shared files from `prompts` and commits them, with no other change.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-09 19:18:45 +01:00
sneak confirmed the design in this issue's description in chat at 18:21 UTC on 9 November.
For prompts' manager: build it as one PR into next, per the description and its definition of done:
script/install and script/update-policy in prompts, both fetching from sneak/prompts over HTTP only, with Makefile targets. script/install takes a repo path and defaults to the repo it sits in, and installs itself into a target that lacks it. script/update-policy fetches the current script/install into a temporary directory, runs it on its own repo, deletes the directory and commits, without pushing.
Carry over the file list and the rules for keeping a repo's own lines from today's script/update-policy (#164), and its tests.
prompts/REPO_POLICIES.md says that one command brings a repo up to standards.
sneak confirmed the design in this issue's description in chat at 18:21 UTC on 9 November.
**For prompts' manager:** build it as one PR into `next`, per the description and its definition of done:
- `script/install` and `script/update-policy` in `prompts`, both fetching from `sneak/prompts` over HTTP only, with `Makefile` targets. `script/install` takes a repo path and defaults to the repo it sits in, and installs itself into a target that lacks it. `script/update-policy` fetches the current `script/install` into a temporary directory, runs it on its own repo, deletes the directory and commits, without pushing.
- Carry over the file list and the rules for keeping a repo's own lines from today's `script/update-policy` (https://git.eeqj.de/sneak/prompts/pulls/164), and its tests.
- `prompts/REPO_POLICIES.md` says that one command brings a repo up to standards.
Once it is merged into `next`, file one issue in each template repo, https://git.eeqj.de/sneak/template-app-go and https://git.eeqj.de/clawbot/go-template-repo, to carry both scripts, and tell the top-level manager their URLs.
Model: opus-5-5
sneak
was unassigned by clawbot2026-11-09 19:21:45 +01:00
clawbot
self-assigned this 2026-11-09 19:21:45 +01:00
sneak, in chat at 18:22 UTC on 9 November: the PR for this issue goes to him for review before it merges.
For prompts' manager: once the independent review passes, assign the PR to sneak and comment that it is his to review. Do not merge it until he approves on the PR. The template-repo issues follow his approval and the merge.
Model: opus-5-5
sneak, in chat at 18:22 UTC on 9 November: the PR for this issue goes to him for review before it merges.
**For prompts' manager:** once the independent review passes, assign the PR to sneak and comment that it is his to review. Do not merge it until he approves on the PR. The template-repo issues follow his approval and the merge.
Model: opus-5-5
Plan, for the worker. One PR into next that replaces today's script/update-policy (#164) with two scripts, as this issue's description and #165 (comment) say. Both are POSIX sh, like their siblings in script/.
script/install, with one optional argument, the path of a repo clone. New. The file list, local_path, local_only_lines, keep_lines_below_last and keep_deny_entries move here from script/update-policy, unchanged. It fetches and writes; it never commits or pushes.
With no argument the target is the repo the script sits in, $(cd "$(dirname "$0")/.." && pwd -P). More than one argument, or a path that is not the top of a git clone, stops the script.
It stops when the target holds prompts/REPO_POLICIES.md, since that is this repo, the source. Not every repo has script/projectname, so that check goes.
It fetches from sneak/prompts with curl only, never git clone or git ls-remote:
The head of main: the first 40-character hexadecimal value after "id":" in https://git.eeqj.de/api/v1/repos/sneak/prompts/branches/main. Every later fetch uses that hash, written HASH below.
Each file: https://git.eeqj.de/sneak/prompts/raw/commit/HASH/PATH.
The history: https://git.eeqj.de/sneak/prompts/compare/af257bef63f162a681bddc80d9b941c47a44b748...HASH.patch, one request of about 5 MB, confirmed to work on this server without a token. af257bef is this repo's first commit. Today's git log -p becomes a read of this one file: a file's former lines are the lines starting with - inside each of its diff --git sections, which end at the next diff --git line or the next commit's From HASH line. Compare the result against git log -p on the real repo.
Local git in the target stays as it is today. A carried file with uncommitted changes, or any failed fetch, stops the script before anything is written.
script/install and script/update-policy join the list. Unlike the other listed files, these two are written whether or not the target has them, so a repo updated once can update itself. Write them with mode 755, through a temporary name in the same directory and mv, since script/update-policy may be the script running.
Standard output is the full hash on the first line, then one line per path written. Messages go to standard error.
script/update-policy, no arguments, replacing the current file. Make a temporary directory with a trap that removes it, fetch https://git.eeqj.de/sneak/prompts/raw/branch/main/script/install into it, and run it with sh on this repo's root. git add each path it printed, by name. If nothing changed, say so and exit 0. Otherwise commit only those paths, with the subject Update policy files from prompts HASH. It does not push.
Also:
Makefile: an install target that runs the script, added to .PHONY.
test/update-policy.sh, name unchanged. The stub curl serves the four URL forms from the local prompts repository. Keep every scenario whose behaviour remains. Delete the ones for pushing and for the hash argument, both gone. Add:
script/update-policy commits and leaves origin unchanged, and the commit holds only the shared files.
A target lacking both scripts gets them, mode 755, in that commit.
script/update-policy replaces its own file and still exits 0.
script/install PATH writes into that clone from outside it and commits nothing.
script/install with no argument updates its own repo.
A failed fetch of each URL form stops the script with nothing written, and the output says cannot fetch.
prompts/REPO_POLICIES.md lines 96-97, 114, 194-196, 936-944 and 1172, both checklists, the README.md script list and TODO.md: one command, make update-policy, brings a repo up to standards, and it commits without pushing, so the person reviews and pushes. Keep the prompts/REPO_POLICIES.md change small: #159 rewrites that file, and whichever lands second rebases.
Settled on #164, carried over, not findings: a repo's own comment lines are replaced; .gitea/workflows/check.yml and .prettierrc are replaced whole; a repo's own line identical to one the canonical file once held is replaced without a stop; files are fetched with curl.
Disclosures for the PR body:
Until next reaches main, script/update-policy stops at its first fetch, because main has no script/install.
Judgement call: a listed file the repo does not carry is still skipped, apart from the two scripts, as today. Adding it would mean guessing where the repo keeps it, and whether a language's files apply.
Judgement call: the two scripts are refreshed on every run, not only when missing, since this issue's description names them among the files that are the same in every repo.
The file history comes from one compare-patch download of the whole repository, because git is ruled out.
The commit the script makes has no Model: line, since no model writes it.
make fmt, make check, push each commit as you make it. On a passed independent review this PR goes to sneak for his review; the fleet does not merge it until he approves on the PR.
Model: opus-5-5
**Plan, for the worker.** One PR into `next` that replaces today's `script/update-policy` (https://git.eeqj.de/sneak/prompts/pulls/164) with two scripts, as this issue's description and https://git.eeqj.de/sneak/prompts/issues/165#issuecomment-172315 say. Both are POSIX `sh`, like their siblings in `script/`.
**`script/install`, with one optional argument, the path of a repo clone.** New. The file list, `local_path`, `local_only_lines`, `keep_lines_below_last` and `keep_deny_entries` move here from `script/update-policy`, unchanged. It fetches and writes; it never commits or pushes.
1. With no argument the target is the repo the script sits in, `$(cd "$(dirname "$0")/.." && pwd -P)`. More than one argument, or a path that is not the top of a git clone, stops the script.
2. It stops when the target holds `prompts/REPO_POLICIES.md`, since that is this repo, the source. Not every repo has `script/projectname`, so that check goes.
3. It fetches from `sneak/prompts` with `curl` only, never `git clone` or `git ls-remote`:
- The head of `main`: the first 40-character hexadecimal value after `"id":"` in `https://git.eeqj.de/api/v1/repos/sneak/prompts/branches/main`. Every later fetch uses that hash, written HASH below.
- Each file: `https://git.eeqj.de/sneak/prompts/raw/commit/HASH/PATH`.
- The history: `https://git.eeqj.de/sneak/prompts/compare/af257bef63f162a681bddc80d9b941c47a44b748...HASH.patch`, one request of about 5 MB, confirmed to work on this server without a token. `af257bef` is this repo's first commit. Today's `git log -p` becomes a read of this one file: a file's former lines are the lines starting with `-` inside each of its `diff --git` sections, which end at the next `diff --git` line or the next commit's `From HASH` line. Compare the result against `git log -p` on the real repo.
4. Local `git` in the target stays as it is today. A carried file with uncommitted changes, or any failed fetch, stops the script before anything is written.
5. `script/install` and `script/update-policy` join the list. Unlike the other listed files, these two are written whether or not the target has them, so a repo updated once can update itself. Write them with mode 755, through a temporary name in the same directory and `mv`, since `script/update-policy` may be the script running.
6. Standard output is the full hash on the first line, then one line per path written. Messages go to standard error.
**`script/update-policy`**, no arguments, replacing the current file. Make a temporary directory with a `trap` that removes it, fetch `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/install` into it, and run it with `sh` on this repo's root. `git add` each path it printed, by name. If nothing changed, say so and exit 0. Otherwise commit only those paths, with the subject `Update policy files from prompts HASH`. It does not push.
**Also:**
- `Makefile`: an `install` target that runs the script, added to `.PHONY`.
- `test/update-policy.sh`, name unchanged. The stub `curl` serves the four URL forms from the local `prompts` repository. Keep every scenario whose behaviour remains. Delete the ones for pushing and for the hash argument, both gone. Add:
- `script/update-policy` commits and leaves `origin` unchanged, and the commit holds only the shared files.
- A target lacking both scripts gets them, mode 755, in that commit.
- `script/update-policy` replaces its own file and still exits 0.
- `script/install PATH` writes into that clone from outside it and commits nothing.
- `script/install` with no argument updates its own repo.
- A failed fetch of each URL form stops the script with nothing written, and the output says `cannot fetch`.
- `prompts/REPO_POLICIES.md` lines 96-97, 114, 194-196, 936-944 and 1172, both checklists, the `README.md` script list and `TODO.md`: one command, `make update-policy`, brings a repo up to standards, and it commits without pushing, so the person reviews and pushes. Keep the `prompts/REPO_POLICIES.md` change small: https://git.eeqj.de/sneak/prompts/pulls/159 rewrites that file, and whichever lands second rebases.
**Settled on https://git.eeqj.de/sneak/prompts/pulls/164, carried over, not findings:** a repo's own comment lines are replaced; `.gitea/workflows/check.yml` and `.prettierrc` are replaced whole; a repo's own line identical to one the canonical file once held is replaced without a stop; files are fetched with `curl`.
**Disclosures for the PR body:**
- Until `next` reaches `main`, `script/update-policy` stops at its first fetch, because `main` has no `script/install`.
- Judgement call: a listed file the repo does not carry is still skipped, apart from the two scripts, as today. Adding it would mean guessing where the repo keeps it, and whether a language's files apply.
- Judgement call: the two scripts are refreshed on every run, not only when missing, since this issue's description names them among the files that are the same in every repo.
- The file history comes from one compare-patch download of the whole repository, because `git` is ruled out.
- The commit the script makes has no `Model:` line, since no model writes it.
`make fmt`, `make check`, push each commit as you make it. On a passed independent review this PR goes to sneak for his review; the fleet does not merge it until he approves on the PR.
Model: opus-5-5
Built as #166, per the plan above; disclosures are in its body. The template-repo issues follow sneak's approval and the merge.
Model: opus-5-5
Built as https://git.eeqj.de/sneak/prompts/pulls/166, per the plan above; disclosures are in its body. The template-repo issues follow sneak's approval and the merge.
Model: opus-5-5
Waiting on sneak's approval on https://git.eeqj.de/sneak/prompts/pulls/166. Once he approves, in this order:
1. Rebase it onto `next` if `next` has moved, then squash-merge it with the subject ending ` (closes #165)`.
2. Add it to the description of the milestone PR, https://git.eeqj.de/sneak/prompts/pulls/68.
3. File one issue in each of https://git.eeqj.de/sneak/template-app-go and https://git.eeqj.de/clawbot/go-template-repo to carry `script/install` and `script/update-policy`, and comment their URLs here.
4. Close https://git.eeqj.de/sneak/template-app-go/issues/23 and https://git.eeqj.de/clawbot/go-template-repo/issues/3, which those new issues replace.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, in chat on 9 November:
> Write install scripts in both template repos that take a repo as their single argument and install all of the files that should be the same in all repos, such as repo policies and code standards and such. And then add an install an update policy script in each repo that clones the template repos to a temporary directory and then runs the installation script from those with the repo itself as a target. So that way any repo can be brought up to standards with a single command. It will then clone the template repo and run the installer script from the template repo to put the template's current files into its own repo and then delete the temporary directory and commit.
> Also, the authoritative location for our per repo files will now be the template directories.
> or rather template repos.
> Actually, no, that's not a good idea, because the template repos have files in each of them that would need to be kept in sync. Make the install scripts inside the template repos fetch the scripts, no, fetch the policy files from the authoritative location using HTTP, not Git.
> The point of putting it in the template repos is that when repos are produced from these templates, they already have the install script that will update their own local policy files. It should default to update the current repo if there is no argument provided.
> The install script should also install the fetcher script from the template repo into the current repo if it doesn't already exist. This will be a no-op on repos that are cloned from the template repo, but on all other repos on their first update to update the policy files, they'll also receive the policy file installer script.
> It should fetch them from prompts, the authoritative location, not a template repo.
(The last answers: which template repo should
script/update-policyclone?)The design as understood, for sneak to confirm before anything is built:
sneak/prompts. That includes the two scripts below. Nothing is fetched from a template repo.script/installtakes the path of a repo clone as its one argument, and updates the repo it sits in when given none. It fetches every shared file fromsneak/promptsover HTTP, from its raw URL ongit.eeqj.de, not with git, and writes the files into that repo. When the target repo has noscript/installyet, it installs that too, so every repo updated once can update itself afterwards. The file list and the rules for keeping a repo's own lines move here from today'sscript/update-policyinprompts(#164).script/install, so every repo made from them has it from the start.script/update-policy. It fetches the currentscript/installfromsneak/promptsover HTTP into a temporary directory, runs it with the repo itself as the target, deletes the temporary directory, and commits the changed files. It does not push. It replaces the version merged in #164, which fetches and pushes by itself.Open question for sneak: is this design right?
Definition of done, once confirmed:
script/installandscript/update-policylive inpromptsas described, each with aMakefiletarget, andprompts/REPO_POLICIES.mdsays that one command brings a repo up to standards.make checkpasses in each.script/update-policyin a clone of a managed repo installs the current shared files frompromptsand commits them, with no other change.Model: opus-5-5
sneak confirmed the design in this issue's description in chat at 18:21 UTC on 9 November.
For prompts' manager: build it as one PR into
next, per the description and its definition of done:script/installandscript/update-policyinprompts, both fetching fromsneak/promptsover HTTP only, withMakefiletargets.script/installtakes a repo path and defaults to the repo it sits in, and installs itself into a target that lacks it.script/update-policyfetches the currentscript/installinto a temporary directory, runs it on its own repo, deletes the directory and commits, without pushing.script/update-policy(#164), and its tests.prompts/REPO_POLICIES.mdsays that one command brings a repo up to standards.Once it is merged into
next, file one issue in each template repo, https://git.eeqj.de/sneak/template-app-go and https://git.eeqj.de/clawbot/go-template-repo, to carry both scripts, and tell the top-level manager their URLs.Model: opus-5-5
sneak, in chat at 18:22 UTC on 9 November: the PR for this issue goes to him for review before it merges.
For prompts' manager: once the independent review passes, assign the PR to sneak and comment that it is his to review. Do not merge it until he approves on the PR. The template-repo issues follow his approval and the merge.
Model: opus-5-5
Plan, for the worker. One PR into
nextthat replaces today'sscript/update-policy(#164) with two scripts, as this issue's description and #165 (comment) say. Both are POSIXsh, like their siblings inscript/.script/install, with one optional argument, the path of a repo clone. New. The file list,local_path,local_only_lines,keep_lines_below_lastandkeep_deny_entriesmove here fromscript/update-policy, unchanged. It fetches and writes; it never commits or pushes.$(cd "$(dirname "$0")/.." && pwd -P). More than one argument, or a path that is not the top of a git clone, stops the script.prompts/REPO_POLICIES.md, since that is this repo, the source. Not every repo hasscript/projectname, so that check goes.sneak/promptswithcurlonly, nevergit cloneorgit ls-remote:main: the first 40-character hexadecimal value after"id":"inhttps://git.eeqj.de/api/v1/repos/sneak/prompts/branches/main. Every later fetch uses that hash, written HASH below.https://git.eeqj.de/sneak/prompts/raw/commit/HASH/PATH.https://git.eeqj.de/sneak/prompts/compare/af257bef63f162a681bddc80d9b941c47a44b748...HASH.patch, one request of about 5 MB, confirmed to work on this server without a token.af257befis this repo's first commit. Today'sgit log -pbecomes a read of this one file: a file's former lines are the lines starting with-inside each of itsdiff --gitsections, which end at the nextdiff --gitline or the next commit'sFrom HASHline. Compare the result againstgit log -pon the real repo.gitin the target stays as it is today. A carried file with uncommitted changes, or any failed fetch, stops the script before anything is written.script/installandscript/update-policyjoin the list. Unlike the other listed files, these two are written whether or not the target has them, so a repo updated once can update itself. Write them with mode 755, through a temporary name in the same directory andmv, sincescript/update-policymay be the script running.script/update-policy, no arguments, replacing the current file. Make a temporary directory with atrapthat removes it, fetchhttps://git.eeqj.de/sneak/prompts/raw/branch/main/script/installinto it, and run it withshon this repo's root.git addeach path it printed, by name. If nothing changed, say so and exit 0. Otherwise commit only those paths, with the subjectUpdate policy files from prompts HASH. It does not push.Also:
Makefile: aninstalltarget that runs the script, added to.PHONY.test/update-policy.sh, name unchanged. The stubcurlserves the four URL forms from the localpromptsrepository. Keep every scenario whose behaviour remains. Delete the ones for pushing and for the hash argument, both gone. Add:script/update-policycommits and leavesoriginunchanged, and the commit holds only the shared files.script/update-policyreplaces its own file and still exits 0.script/install PATHwrites into that clone from outside it and commits nothing.script/installwith no argument updates its own repo.cannot fetch.prompts/REPO_POLICIES.mdlines 96-97, 114, 194-196, 936-944 and 1172, both checklists, theREADME.mdscript list andTODO.md: one command,make update-policy, brings a repo up to standards, and it commits without pushing, so the person reviews and pushes. Keep theprompts/REPO_POLICIES.mdchange small: #159 rewrites that file, and whichever lands second rebases.Settled on #164, carried over, not findings: a repo's own comment lines are replaced;
.gitea/workflows/check.ymland.prettierrcare replaced whole; a repo's own line identical to one the canonical file once held is replaced without a stop; files are fetched withcurl.Disclosures for the PR body:
nextreachesmain,script/update-policystops at its first fetch, becausemainhas noscript/install.gitis ruled out.Model:line, since no model writes it.make fmt,make check, push each commit as you make it. On a passed independent review this PR goes to sneak for his review; the fleet does not merge it until he approves on the PR.Model: opus-5-5
Built as #166, per the plan above; disclosures are in its body. The template-repo issues follow sneak's approval and the merge.
Model: opus-5-5
Waiting on sneak's approval on #166. Once he approves, in this order:
nextifnexthas moved, then squash-merge it with the subject ending(closes #165).script/installandscript/update-policy, and comment their URLs here.Model: opus-5-5