From c7e847e4d48a6ba5e575f51f912973869c745cc9 Mon Sep 17 00:00:00 2001
From: jimmy <jimmy@hermes.local>
Date: Sun, 13 Sep 2026 12:00:35 -0700
Subject: [PATCH] vault-sync scripts: scope add to the vault tree, commit
 before pull, per-commit identity, autostash

---
 scripts/vault-change-log.sh | 11 ++++++-----
 scripts/vault-sync.sh       | 38 ++++++++++++++++++++++++++-----------
 2 files changed, 33 insertions(+), 16 deletions(-)

diff --git a/scripts/vault-change-log.sh b/scripts/vault-change-log.sh
index 9d42104..78b1d30 100644
--- a/scripts/vault-change-log.sh
+++ b/scripts/vault-change-log.sh
@@ -1,16 +1,15 @@
 #!/usr/bin/env bash
 # Zero-token vault change log
-# Dumps raw git log to a file for agents to read
+# Dumps raw git log to a file for agents to read.
 
 VAULT_DIR="/c/Users/fight/AgentOS/memory-systems/agent-os"
 LOG_FILE="$VAULT_DIR/03_shared/vault-updates-log.md"
 
 cd "$VAULT_DIR" || exit 1
 
-# Pull latest first
-git pull --rebase 2>&1 > /dev/null
+# Refresh from remote first (best-effort: --rebase refuses on a dirty tree).
+git pull --rebase > /dev/null 2>&1
 
-# Generate the log
 {
     echo "# Vault Updates Log"
     echo ""
@@ -32,7 +31,9 @@ git pull --rebase 2>&1 > /dev/null
     echo ""
     echo "## Files Changed (Last 24h)"
     echo ""
-    git diff --name-only HEAD@{24.hours.ago} HEAD 2>/dev/null || echo "No recent file changes."
+    # `HEAD@{24.hours.ago}` fails on a young reflog; derive the list from the log instead.
+    git log --since="24 hours ago" --name-only --pretty=format: -- . 2>/dev/null \
+        | sed '/^[[:space:]]*$/d' | sort -u
 } > "$LOG_FILE"
 
 echo "Vault change log updated: $LOG_FILE"
diff --git a/scripts/vault-sync.sh b/scripts/vault-sync.sh
index 726d2fe..9bd9015 100644
--- a/scripts/vault-sync.sh
+++ b/scripts/vault-sync.sh
@@ -1,27 +1,43 @@
 #!/usr/bin/env bash
 # Zero-token vault sync protocol
-# Pulls latest, commits local changes, pushes to Gitea mirror
+# Commit local changes, rebase onto the remote, push to the Gitea mirror.
+#
+# SCOPE: only the agent-os vault tree is staged. The git repo root is the PARENT
+# directory (AgentOS), so a bare `git add -A` sweeps unrelated agent work into
+# "vault-sync" commits. Both the status check and the add are pathspec-scoped.
+#
+# ORDER: commit BEFORE `git pull --rebase`. Rebase refuses to run on a dirty tree,
+# so pulling first is a silent no-op exactly when a pull is needed, and the
+# subsequent push gets rejected.
+#
+# IDENTITY: passed per-commit with `git -c`, never repo-local config — the repo is
+# shared by every agent profile, so a repo-local user.name attributes every agent's
+# commits to one agent. Override with VAULT_AGENT=<name>.
+# NOTE: set VAULT_AGENT (or edit the default) in your own profile's copy.
 
 VAULT_DIR="/c/Users/fight/AgentOS/memory-systems/agent-os"
+AGENT_NAME="${VAULT_AGENT:-jimmy}"
+GIT_ID=(-c "user.name=$AGENT_NAME" -c "user.email=$AGENT_NAME@hermes.local")
 
 cd "$VAULT_DIR" || exit 1
 
-echo "=== Vault Sync $(date '+%Y-%m-%d %H:%M') ==="
+echo "=== Vault Sync $(date '+%Y-%m-%d %H:%M') (agent: $AGENT_NAME) ==="
 
-# 1. Pull latest from remote
-echo "Pulling latest..."
-git pull --rebase 2>&1 | tail -3
-
-# 2. Stage and commit any local changes
-if [ -n "$(git status --porcelain)" ]; then
+# 1. Stage + commit local changes (vault tree only).
+if [ -n "$(git status --porcelain .)" ]; then
     echo "Local changes detected. Committing..."
-    git add -A
-    git commit -m "vault-sync: $(date '+%Y-%m-%d %H:%M')" 2>&1 | tail -3
+    git add -A . || exit 1
+    git "${GIT_ID[@]}" commit -m "vault-sync: $(date '+%Y-%m-%d %H:%M') ($AGENT_NAME)" 2>&1 | tail -3
 else
     echo "No local changes."
 fi
 
-# 3. Push to remote
+# 2. Rebase onto the remote. --autostash so unrelated dirty files elsewhere in the
+#    repo (AgentOS holds more than this vault) cannot block the pull.
+echo "Pulling latest..."
+git pull --rebase --autostash 2>&1 | tail -3
+
+# 3. Push to remote.
 echo "Pushing to Gitea..."
 git push 2>&1 | tail -3