# AGENTS.md

Guidance for a coding agent working on **this plugin's own repository**. `CLAUDE.md` beside it only
points here — the two harnesses discover different filenames and one set of instructions has to
reach both.

**This is not what the plugin is.** `README.md` answers that, for a person deciding whether to
install it. This file answers "I have to change something in here — what will I break?"

## Where you are

A plugin repository, cloned into `~/officer-dev/plugins/vault`, its own git remote. It is **not**
part of the platform's repository, and `platform/plugins/vault` is a different thing — that is
where this plugin gets INSTALLED, by the installer cloning it from gitea. Never edit there; the
next install overwrites it.

Check the checkout with `bun run plugins:check` from the platform repo.

## What it ships

- `api/router.ts` — routes, mounted at `/api/vault`
- `sidecar/index.ts` — a process, run by PM2 as `officer-vault`
- `db/schema.ts` — tables: `vault_config`, `vault_tokens`, `vault_unlock_keys`
- `web/` — panels and a layout; the platform renders the screen, not this plugin

Presence is the declaration: the platform decides what this plugin has by what files exist. Adding
`db/schema.ts` gives it tables; deleting `api/router.ts` removes its routes. There is no field to
keep in step.

## What must not change without knowing why

- **Permission key `vault`** — stored as the subject of every grant. Renaming one is a data change, not a rename.
- **Panel keys** (`vault-settings`) — a user's stored layout names them.
- **Table names** — they hold real rows on installed machines.
- **Top-level claims** (`/identity, /notifications, /icons, /events`) — served ABOVE the account gate, and reserved names only a first-party plugin may take.
- **Unauthenticated paths** (`/bw/*`) — served without a session. Adding one is a security decision.
- **`appName`** — the directory name IS the id: route segment, table prefix, sidecar suffix, install key.

## Verifying

From the platform repo, which is where the toolchain lives:

```bash
bunx tsgo                 # a red typecheck is not done
bun test                  # 1 known failure: ModelSelector, unrelated
bun run plugins:check
bunx prettier --write <the files you touched>
```

A sidecar change needs `pm2 restart officer-vault`; anything in `api/` or `web/` needs
`pm2 restart officer`.

## Related

- `README.md` — what it is and what it claims, for someone installing it
- `PLUGIN.md` — this plugin's own reference: conventions and API surface