#!/usr/bin/env bash # ============================================================================= # reverie-audit — local install auditor for reveried (the reverie memory daemon) # ============================================================================= # # WHAT THIS DOES # Runs a series of read-only diagnostic checks against your local reverie / # reveried ("engram") install to answer the question: "why is reverie having # no effect?" — i.e. is memory actually being captured and, crucially, surfaced # back into your coding sessions. It collects the results into a single JSON # document and (optionally) uploads it to the Cerebral audit portal so the # maintainers can see exactly what your box reports. # # WHAT IT DOES *NOT* DO # - No writes to your system. Every check is read-only (ps / curl /health / # stat / jq over config). It never touches your DB, config, or secrets. # - No secret exfiltration. It reads config *keys*, never values. It does not # dump environment variables. Home-directory paths are collapsed to "~". # - No `sudo`, no package installs, no network calls except (a) your LOCAL # reveried /health endpoint and (b) the single results upload you can skip. # # SAFETY / "curl | bash" # You can run this two ways: # 1) REVIEW FIRST (recommended): # curl -fsSL https://audit.cerebral.work/audit.sh -o audit.sh # # read it — it's this file, heavily commented # sha256sum audit.sh # compare to: # curl -fsSL https://audit.cerebral.work/audit.sh.sha256 # bash audit.sh # 2) ONE-LINER (convenient, pipes remote code to your shell): # curl -fsSL https://audit.cerebral.work/audit.sh | bash # The one-liner is offered for convenience. Piping remote code to a shell is # inherently trust-on-first-use — the published SHA-256 above lets you verify # the bytes match what you can read here. If you don't trust it, use path (1). # # FLAGS # --no-upload run all checks, print JSON locally, do NOT upload # --print also pretty-print a human summary to the terminal (default on # when stdout is a TTY) # --port reveried port to probe (default: auto-detect, then 7437) # # EXIT CODE # 0 if the audit ran (regardless of findings). Non-zero only on its own error. # ============================================================================= set -u # --- values injected by the portal when served over HTTP ------------------- # When you download this from https://audit.cerebral.work/audit.sh these two # placeholders are replaced with the live upload endpoint + a write-only token. # The token can ONLY append an audit object to the "incoming/" prefix of the # bucket — it cannot read, list, or delete anything. It is intentionally public. AUDIT_UPLOAD_URL="https://audit.cerebral.work/api/audit" AUDIT_TOKEN="rvat_b4b9ab8f8e3f65b089e05a50dd1601f6fb9ebd451d1728b4" # --- arg parsing ----------------------------------------------------------- DO_UPLOAD=1 DO_PRINT=0 FORCE_PORT="" [ -t 1 ] && DO_PRINT=1 while [ $# -gt 0 ]; do case "$1" in --no-upload) DO_UPLOAD=0 ;; --print) DO_PRINT=1 ;; --port) shift; FORCE_PORT="${1:-}" ;; -h|--help) sed -n '2,60p' "$0" 2>/dev/null; exit 0 ;; *) echo "unknown flag: $1" >&2 ;; esac shift done # --- tiny helpers ---------------------------------------------------------- # collapse absolute home paths to ~ so uploaded evidence carries no usernames redact() { printf '%s' "${1:-}" | sed "s#${HOME}#~#g"; } # JSON-escape an arbitrary string (uses jq if present, else a safe fallback) jstr() { if command -v jq >/dev/null 2>&1; then jq -Rn --arg s "${1:-}" '$s' else printf '%s' "${1:-}" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g' | awk 'BEGIN{printf "\""} {printf "%s", $0} END{printf "\""}'; fi } # checks[] accumulator (one JSON object per line, assembled at the end) CHECKS_FILE="$(mktemp)" trap 'rm -f "$CHECKS_FILE"' EXIT PASS=0; WARN=0; FAIL=0; INFO=0 # add_check