5b58460618
codex's config.toml held nine live API keys inline under
[mcp_servers.*.env] -- deepseek, gemini, kimi, mimo, qwen, glm, cursor,
an OpenAI key and a Home Assistant token -- so it could not be tracked
as it stood. TOML env tables take literal values only, with no ${VAR}
indirection or env_file, so the keys cannot simply be named there.
Move them to ~/.codex/secrets.env (0600, ignored) and route the four
affected servers through mcp-with-secrets.sh, which sources that file
and execs the real command. Doing it in the wrapper rather than relying
on exported shell vars means it does not depend on how codex handles
environment inheritance, and works on ssh-only boxes with no keychain or
1Password agent, which is why this was preferred over a chezmoi
template.
Adds configs for claude, codex, pi, grok, kimi, kimi-code and reasonix,
and extends .chezmoiignore so credentials, session logs, local state and
.bak files stay out even if a directory is ever added whole.
Held back for still containing live keys: opencode.json (bailian), and
reasonix config.json and .env.
17 lines
1.6 KiB
Markdown
17 lines
1.6 KiB
Markdown
# Global Rules
|
|
|
|
## Promises need mechanisms
|
|
Never promise behavioral changes with just words ("won't forget", "I'll make sure to"). Each conversation starts fresh — words have no effect on future behavior. When committing to a change:
|
|
1. Add to CLAUDE.md (always loaded) — not just memory
|
|
2. Add automated enforcement where possible (hooks, linters, CI checks)
|
|
3. Never say "I won't forget" without having done at least one of the above
|
|
|
|
## Watch long-running work yourself; don't trust notifiers
|
|
When you launch anything long-running (background workflow, agent swarm, build, deploy, remote/SSH process), do NOT rely on auto-completion notifications — they can silently fail to fire when the job dies. Actively re-check the job's real state (on-disk progress, file mtime, process liveness) on a **≤10-minute cadence**, enforced by a mechanism (a re-arming background watchdog or scheduled self-check), not a promise. Each check: confirm recent progress, detect stalls/silent deaths early, and resume or restart if it died. Prefer resume (cached/idempotent work) over a cold restart.
|
|
|
|
## Ask, don't guess
|
|
When something fails (SSH, commands, APIs, unexpected errors), report the error and ask the user how to proceed. Don't burn time trying alternative ports, paths, or workarounds — the user knows their system and can quickly point to the right answer.
|
|
|
|
## No throwaway implementations
|
|
Don't deploy placeholder or half-baked versions that will be replaced later. Either build the real implementation or wait until the design is ready. Deploying throwaway code wastes time and creates false confidence.
|