Repo rescue agent

Copy this into your AI, start the agent, keep the sKache. 🗃️

The agent runs on the machine where the files live, scans on a ten-minute loop, streams encrypted literal full-repo artifacts by default, writes proof receipts, and sends Resend update emails with recovery links.

Open repo lane 💻

Use this prompt

Copy/paste this into your coding AI 🧠

You are setting up SkyeVault Repo Rescue for this workspace.
Read the repo docs and the public SkyeVault agent install page first.
Use the existing FS27/SkyGate/Free99 owner auth lane. Do not create app-specific admin passwords.
Do not print or commit secrets, bearer tokens, passphrases, peppers, signed URLs, env values, or unlock codes.

Goal:
Run a local SkyeVault autosync agent that scans this repo about every ten minutes, tracks Git/dirty/untracked/local-only source state, packs and uploads an encrypted delta journal first, streams the encrypted literal full-repo artifact to SkyeVault/R2 when the digest changes, writes public-safe proof receipts, exports configured SkyeVault Bins such as SkyeAgents separately with dedupe, and sends owner Resend emails with proof/vault/unlock links.

Commands to run:
1. npm install
2. npm run vault:agent:status
3. npm run vault:autosync:status -- --env-file=env.txt --mode=full
4. npm run vault:delta:dry-run -- --env-file=env.txt
5. npm run vault:autosync:dry-run -- --env-file=env.txt --mode=full
6. npm run vault:bins:export:dry-run
7. npm run vault:autosync:notify:on
8. npm run vault:agent:start -- --env-file=env.txt --mode=full --interval-seconds=600
9. npm run vault:agent:status
10. npm run vault:autosync:proof

After setup, report:
- whether the daemon/agent is running
- latest delta journal receipt path and upload receipt id if present
- latest autosync receipt path
- latest SkyeVault bin export receipt path if present
- latest artifact receipt id if present
- proof page path
- notification status
- any missing env names only, never secret values

Important:
Full mode means literal all-bytes repo custody by default. Do not switch it back to source-custody unless the owner explicitly asks for the filtered package. A smaller 1GB-2GB source-custody receipt is useful proof, but it is not the full disaster-recovery copy of a much larger workspace.
The cloud Worker/R2/vault is the control plane. The local agent is required because only the machine or Codespace can see untracked files, ignored files, local env files, and secret-like source state before it disappears.

Open proof 🧾

Install commands

Local agent setup ⚙️

npm install npm run vault:agent:status npm run vault:delta:dry-run -- --env-file=env.txt npm run vault:autosync:dry-run -- --env-file=env.txt --mode=full npm run vault:bins:export:dry-run npm run vault:autosync:notify:on npm run vault:agent:start -- --env-file=env.txt --mode=full --interval-seconds=600 npm run vault:agent:status npm run vault:autosync:proof

Full means literal

The daemon now defaults to all-bytes repo custody.

Autosync full mode now passes --literal-full and forces the literal/all-bytes env flags before upload. Source-custody is still available, but only as an explicit opt-in for smaller filtered packages.

npm run vault:autosync:once -- --env-file=env.txt --mode=full --force npm run vault:repo:full -- --archive-format=tar.zst --literal-full --direct-r2 node tools/skyevault-mint-receipt-downloads.mjs --env-file=env.txt --handoff=/path/to/FULL_REPO_SKYDRIVE_HANDOFF.json --out=.skyevault-out/autosync/latest-full-repo-download-links.json

Proof 🧾 Autosync proof heartbeat

Public-safe digest, artifact receipt, control-pack receipt, daemon state, and proof log.

Vault 🗃️ Vault drive recovery

Owner-gated vault drive where encrypted repo artifacts and control packs can be recovered.

Unlock 🔓 SkyeSecure unlock surface

Use the control pack, passphrase, and pepper out-of-band to unlock custody material.

Command 🎛️ SkyeVault Command Center

Owner dashboard for receipts, notification controls, vault links, proof, and recovery posture.

Agent bins

Agents export separately, without double-writing shared files

The normal autosync still protects the repo. The companion bin export then packs configured lanes like skyeagents-bin and devooderator-blog. Agent-owned files win first, and overlapping site files are skipped in later bins with a dedupe receipt. Add --upload-bins or set SKYEVAULT_AUTOSYNC_BIN_UPLOAD=1 when the owner wants those encrypted bin packs uploaded as their own vault objects.

npm run vault:bins:list npm run vault:delta:status npm run vault:delta:upload -- --env-file=env.txt npm run vault:bins:export:dry-run npm run vault:agents:export

DevodeRator agent

Daily build blog workflow

Call the DevodeRator Field Scribe when you want today's work turned into a founder blog. It collects changed files, recent receipts, MCP proof, deploy links, vault state, and proof boundaries before writing.

npm run devooderator:agent:brief npm run devooderator:agent:draft

How it stays real

Cloud control plane plus local file agent

🌩️ Worker/R2 stores encrypted artifacts, receipts, proof logs, and recovery links.
💻 Local agent sees the actual repo files, including untracked source and local-only critical files.
⚡ Delta journal seals changed files and tombstones first, then the full encrypted snapshot catches up.
🔐 Source custody encrypts before upload; public proof never publishes secrets or file bodies.
📬 Resend emails include logo, proof, vault drive, unlock surface, command center, artifact receipt, and control-pack receipt links.

Recovery window

What "about ten minutes" means

If the machine or Codespace stays alive, the agent keeps scanning even when the editor closes. If the whole workspace is destroyed, recovery starts from the latest completed encrypted artifact plus the latest encrypted delta journal. Full streams can take longer than ten minutes, so the delta journal is the quick first seal and the full snapshot is the complete custody catch-up.