sync-from-local.sh

#!/usr/bin/env bash

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

info() {
  printf "${BLUE}==>${NC} %s\n" "$1"
}

success() {
  printf "${GREEN}==>${NC} %s\n" "$1"
}

warn() {
  printf "${YELLOW}==>${NC} %s\n" "$1"
}

error() {
  printf "${RED}==>${NC} %s\n" "$1" >&2
}

DOTFILES_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/managed-configs.sh
source "$DOTFILES_DIR/lib/managed-configs.sh"

RSYNC_EXCLUDES=(
  '--exclude=.git/'
  '--exclude=node_modules/'
  '--exclude=.DS_Store'
  '--exclude=*.log'
  '--exclude=*.swp'
  '--exclude=*.swo'
  '--exclude=*~'
  '--exclude=.#*'
)

DIFF_EXCLUDES=(
  '-x' '.git'
  '-x' 'node_modules'
  '-x' '.DS_Store'
  '-x' '*.log'
  '-x' '*.swp'
  '-x' '*.swo'
  '-x' '*~'
  '-x' '.#*'
)

MANIFEST_FILE="$(mktemp "${TMPDIR:-/tmp}/dotfiles-sync-manifest.XXXXXX")"
PROGRAMS_FILE="$(mktemp "${TMPDIR:-/tmp}/dotfiles-sync-programs.XXXXXX")"
STATE_FILE="$(mktemp "${TMPDIR:-/tmp}/dotfiles-sync-state.XXXXXX")"
DECISIONS_FILE="$(mktemp "${TMPDIR:-/tmp}/dotfiles-sync-decisions.XXXXXX")"
SYNCED_FILE="$(mktemp "${TMPDIR:-/tmp}/dotfiles-sync-written.XXXXXX")"

cleanup() {
  rm -f "$MANIFEST_FILE" "$PROGRAMS_FILE" "$STATE_FILE" "$DECISIONS_FILE" "$SYNCED_FILE"
}
trap cleanup EXIT

managed_entries > "$MANIFEST_FILE"
awk -F '|' '!seen[$1]++ { print $1 "|" $2 }' "$MANIFEST_FILE" > "$PROGRAMS_FILE"

if ! git -C "$DOTFILES_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  error "$DOTFILES_DIR is not a Git working tree"
  exit 1
fi

if ! command -v rsync >/dev/null 2>&1; then
  error "rsync is required to mirror managed directories"
  exit 1
fi

is_expected_repository_link() {
  local target="$1"
  local source="$2"

  [ -L "$target" ] && [ -e "$target" ] && [ "$target" -ef "$source" ]
}

directory_is_equal() {
  diff -qr "${DIFF_EXCLUDES[@]}" "$1" "$2" >/dev/null 2>&1
}

show_file_diff() {
  local repository_path="$1"
  local local_path="$2"

  diff -u --label "repo:  $repository_path" --label "local: $local_path" "$repository_path" "$local_path" || true
}

show_directory_diff() {
  local repository_path="$1"
  local local_path="$2"

  diff -ru "${DIFF_EXCLUDES[@]}" "$repository_path" "$local_path" || true
}

repository_path_is_dirty() {
  [ -n "$(git -C "$DOTFILES_DIR" status --porcelain --untracked-files=all -- "$1")" ]
}

file_contains_suspected_secret() {
  local path="$1"
  local strong_pattern generic_pattern

  strong_pattern='-----BEGIN ([A-Z0-9]+ )?PRIVATE KEY-----|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,}|gh[pousr]_[0-9A-Za-z]{20,}|sk-[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}'
  generic_pattern='(api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|password|passwd|private[_-]?key)["'"'"'[:space:]]*[:=][[:space:]]*["'"'"']?[0-9A-Za-z+/=_-]{12,}'

  [ -f "$path" ] || return 1
  LC_ALL=C grep -Eiq -- "$strong_pattern" "$path" && return 0
  LC_ALL=C grep -Eiq -- "$generic_pattern" "$path"
}

path_contains_suspected_secret() {
  local path="$1"
  local expected_type="$2"
  local file

  if [ "$expected_type" = 'file' ]; then
    file_contains_suspected_secret "$path"
    return
  fi

  while IFS= read -r -d '' file; do
    if file_contains_suspected_secret "$file"; then
      return 0
    fi
  done < <(
    find -L "$path" \
      \( -name .git -o -name node_modules \) -prune -o \
      -type f \
      ! -name .DS_Store \
      ! -name '*.log' \
      ! -name '*.swp' \
      ! -name '*.swo' \
      ! -name '*~' \
      ! -name '.#*' \
      -print0
  )

  return 1
}

info "Comparing local configuration with repository configuration"

agent_rules_consistent=1
agent_rules_reference=''
agent_rules_report_started=0

start_agent_rules_report() {
  if [ "$agent_rules_report_started" -eq 0 ]; then
    printf '\nAgent rules local-copy differences:\n'
    agent_rules_report_started=1
  fi
}

while IFS='|' read -r _ _ repository_path local_path expected_type; do
  [ "$repository_path" = 'agent-rules/AGENTS.global.md' ] || continue
  local_full_path="$HOME/$local_path"
  repository_full_path="$DOTFILES_DIR/$repository_path"

  if [ ! -e "$local_full_path" ] && [ ! -L "$local_full_path" ]; then
    start_agent_rules_report
    printf '  [missing] %s\n' "$local_full_path"
    agent_rules_consistent=0
    continue
  fi

  if [ -L "$local_full_path" ] && ! is_expected_repository_link "$local_full_path" "$repository_full_path"; then
    start_agent_rules_report
    printf '  [unknown symlink] %s -> %s\n' "$local_full_path" "$(readlink "$local_full_path" 2>/dev/null || printf '?')"
    agent_rules_consistent=0
    continue
  fi

  if [ "$expected_type" != 'file' ] || [ ! -f "$local_full_path" ]; then
    start_agent_rules_report
    printf '  [expected regular file] %s\n' "$local_full_path"
    agent_rules_consistent=0
    continue
  fi

  if [ -z "$agent_rules_reference" ]; then
    agent_rules_reference="$local_full_path"
  elif ! cmp -s "$agent_rules_reference" "$local_full_path"; then
    start_agent_rules_report
    printf '  [different] %s <> %s\n' "$agent_rules_reference" "$local_full_path"
    diff -u \
      --label "reference: $agent_rules_reference" \
      --label "local:     $local_full_path" \
      "$agent_rules_reference" "$local_full_path" || true
    agent_rules_consistent=0
  fi
done < "$MANIFEST_FILE"

if [ "$agent_rules_consistent" -eq 0 ]; then
  warn "Pi, Grok, Codex, and Claude rule copies are not all trustworthy and identical"
  warn "Agent rules will not be written to the repository"
fi

blocked_groups=0
while IFS='|' read -r program label; do
  group_changed=0
  group_blocked=0

  printf '\n%s:\n' "$label"

  if [ "$program" = 'agent_rules' ] && [ "$agent_rules_consistent" -eq 0 ]; then
    printf '  [blocked: local agent rule copies differ or are unavailable]\n'
    printf '%s|%s|blocked\n' "$program" "$label" >> "$STATE_FILE"
    blocked_groups=1
    continue
  fi

  while IFS='|' read -r entry_program _ repository_path local_path expected_type; do
    [ "$entry_program" = "$program" ] || continue

    repository_full_path="$DOTFILES_DIR/$repository_path"
    local_full_path="$HOME/$local_path"

    if [ "$program" = 'agent_rules' ] && [ "$local_full_path" != "$agent_rules_reference" ]; then
      continue
    fi

    if repository_path_is_dirty "$repository_path"; then
      printf '  [blocked: repository path has Git changes] %s\n' "$repository_path"
      group_blocked=1
      continue
    fi

    if [ ! -e "$local_full_path" ] && [ ! -L "$local_full_path" ]; then
      printf '  [blocked: missing local path] %s\n' "$local_full_path"
      group_blocked=1
      continue
    fi

    if [ -L "$local_full_path" ] && ! is_expected_repository_link "$local_full_path" "$repository_full_path"; then
      printf '  [blocked: unknown symlink] %s -> %s\n' "$local_full_path" "$(readlink "$local_full_path" 2>/dev/null || printf '?')"
      group_blocked=1
      continue
    fi

    case "$expected_type" in
      file)
        if [ ! -f "$local_full_path" ]; then
          printf '  [blocked: expected local file] %s\n' "$local_full_path"
          group_blocked=1
          continue
        fi
        ;;
      directory)
        if [ ! -d "$local_full_path" ]; then
          printf '  [blocked: expected local directory] %s\n' "$local_full_path"
          group_blocked=1
          continue
        fi
        ;;
    esac

    if path_contains_suspected_secret "$local_full_path" "$expected_type"; then
      printf '  [blocked: suspected secret] %s\n' "$local_full_path"
      group_blocked=1
      continue
    fi

    case "$expected_type" in
      file)
        if cmp -s "$repository_full_path" "$local_full_path"; then
          printf '  [same] %s\n' "$local_full_path"
        else
          printf '  [different] %s\n' "$local_full_path"
          show_file_diff "$repository_full_path" "$local_full_path"
          group_changed=1
        fi
        ;;
      directory)
        if directory_is_equal "$repository_full_path" "$local_full_path"; then
          printf '  [same] %s\n' "$local_full_path"
        else
          printf '  [different] %s\n' "$local_full_path"
          show_directory_diff "$repository_full_path" "$local_full_path"
          group_changed=1
        fi
        ;;
    esac
  done < "$MANIFEST_FILE"

  if [ "$group_blocked" -eq 1 ]; then
    printf '%s|%s|blocked\n' "$program" "$label" >> "$STATE_FILE"
    blocked_groups=1
  elif [ "$group_changed" -eq 1 ]; then
    printf '%s|%s|changed\n' "$program" "$label" >> "$STATE_FILE"
  else
    printf '%s|%s|same\n' "$program" "$label" >> "$STATE_FILE"
  fi
done < "$PROGRAMS_FILE"

printf '\n'
info "Decisions are per program: every managed path in a group is synced or left alone together"
info "This avoids writing a partial program set into the repository"
exec 3<&0
while IFS='|' read -r program label state; do
  case "$state" in
    same)
      printf '%s|skip\n' "$program" >> "$DECISIONS_FILE"
      ;;
    blocked)
      warn "$label: blocked; entire managed set left unchanged in the repository"
      printf '%s|skip\n' "$program" >> "$DECISIONS_FILE"
      ;;
    changed)
      printf 'Overwrite ALL managed %s paths in the repository with the local set?\n' "$label"
      printf '  y = write every managed path in this group into the repository\n'
      printf '  N = leave the entire group unchanged in the repository [y/N] '
      if ! IFS= read -r answer <&3; then
        printf '\n' >&2
        error "No answer available; the repository was not changed"
        exit 1
      fi
      case "$answer" in
        y|Y|yes|YES|Yes)
          printf '%s|sync\n' "$program" >> "$DECISIONS_FILE"
          ;;
        *)
          info "$label: entire managed set left unchanged in the repository"
          printf '%s|skip\n' "$program" >> "$DECISIONS_FILE"
          ;;
      esac
      ;;
  esac
done < "$STATE_FILE"
exec 3<&-

copy_file_to_repository() {
  local source="$1"
  local target="$2"
  local parent temporary

  parent="$(dirname "$target")"
  temporary="$(mktemp "$parent/.dotfiles-sync.XXXXXX")"
  cp -p "$source" "$temporary"
  mv -f "$temporary" "$target"
}

while IFS='|' read -r program action; do
  [ "$action" = 'sync' ] || continue

  label="$(awk -F '|' -v selected="$program" '$1 == selected { print $2; exit }' "$PROGRAMS_FILE")"
  info "Syncing full managed set for $label into the repository"
  while IFS='|' read -r entry_program _ repository_path local_path expected_type; do
    [ "$entry_program" = "$program" ] || continue
    grep -Fqx "$repository_path" "$SYNCED_FILE" && continue

    repository_full_path="$DOTFILES_DIR/$repository_path"
    local_full_path="$HOME/$local_path"
    case "$expected_type" in
      file)
        copy_file_to_repository "$local_full_path" "$repository_full_path"
        ;;
      directory)
        rsync -a --delete "${RSYNC_EXCLUDES[@]}" "$local_full_path/" "$repository_full_path/"
        ;;
    esac

    printf '%s\n' "$repository_path" >> "$SYNCED_FILE"
    success "Synced $repository_path"
  done < "$MANIFEST_FILE"
done < "$DECISIONS_FILE"

if [ -s "$SYNCED_FILE" ]; then
  printf '\nChanged repository paths:\n'
  sed 's/^/  - /' "$SYNCED_FILE"
  printf '\nReview with:\n'
  printf '  git -C %q status --short\n' "$DOTFILES_DIR"
  printf '  git -C %q diff --' "$DOTFILES_DIR"
  while IFS= read -r repository_path; do
    printf ' %q' "$repository_path"
  done < "$SYNCED_FILE"
  printf '\n'
else
  info "No repository files were changed"
fi

if [ "$blocked_groups" -eq 1 ]; then
  error "One or more programs were blocked; see the messages above"
  exit 1
fi

success "Local configuration sync complete"