Skip to content

CLI scripts

The host ships a set of pnpm scripts that wrap shell scripts under scripts/. The shell scripts are the canonical implementation; the pnpm alias is just a typed entry point. These are operator scripts — they manage the host process, its database, and its deployment.

Most backfill and sweep scripts are dry-run by default: they report what they would do, and only write when you add --execute. Per-environment variants (:dev / :staging / :prod) mirror db:migrate:<env>.

Script What it does
pnpm bootstrap One-command first-run setup: pre-flight checks → install → env scaffold → migrate → seed (defaults to the dev env)
pnpm bootstrap --env <env> Same, targeting staging or prod
pnpm setup:env <env> Just the env-scaffold step (idempotent; refuses to overwrite without --force, which rotates the master key)
pnpm setup:envs Create + migrate all per-env databases (idempotent)
pnpm dev:dev Run the host against the dev DB with file-watching
pnpm dev:staging Same, against staging
pnpm start:prod Run the built host against prod
Script What it does
pnpm db:migrate Run migrations against the current DATABASE_URL
pnpm db:migrate:<env> Run migrations against a specific env (dev / staging / prod)
pnpm db:seed Tiny hand-written CI fixture (a handful of entities)
pnpm db:seed:<env> Same, scoped to an env
pnpm db:seed:eval Realistic sam-rivera fixture (~30 entities, ~90 daily notes) for evals
pnpm db:reset:dev / :staging Truncate + reseed
pnpm db:studio Drizzle Studio (browser-based DB inspector)

There is intentionally no pnpm db:reset:prod. Wiping prod is deliberately awkward — you have to type the underlying command, with its guard environment variable, by hand.

Script What it does
pnpm test Vitest test suite
pnpm test:ci Same, with a JSON reporter for CI
pnpm check Biome lint + format check (local)
pnpm lint Biome in CI mode (stricter)
pnpm build Build the Admin SPA + compile TypeScript to dist/
pnpm build:admin Build just the Admin SPA

These run in CI and catch drift before it lands. They need no database, no LLM, and no network.

Script What it checks
pnpm check:doc-drift Documented counts (migrations, MCP tools, admin pages) match reality
pnpm check:edge-provenance Every knowledge-graph edge insert sets its source_kind and confidence explicitly
pnpm check:pinned-invariant The folio auto-refresh engine never deletes a manually pinned member
pnpm check:no-dags All LLM work routes through the skill harness, not hand-rolled call chains
pnpm check:context-surfaces Every prompt-emitting surface goes through the shared system-prompt assembler
Script What it does
pnpm smoke:e2e Full end-to-end smoke against a throwaway scratch database (a real host subprocess)
pnpm smoke:prod --url <host> Read-only liveness smoke against a deployed host — used by deploy:prod as the post-deploy gate
pnpm smoke:mcp Exercise the MCP retrieval tools in-memory (no DB, no LLM)
pnpm eval:agent Agent-eval harness — deterministically replays scripted retrieval trajectories and scores recall, answer overlap, and path efficiency
pnpm eval:skills Replays each registered skill’s golden fixtures (including ask-knowledge’s set) and scores per-category accuracy
pnpm eval:chat Host-native chat eval — multi-turn coherence, local-model tool-calling, and degraded-fallback legs (needs a live model; skips cleanly without one)
pnpm eval:multimodal Cross-modal (text ↔ image) retrieval eval
pnpm eval:memory Memory-network retrieval eval
pnpm eval:miss-rate Retrieval miss-rate harness over a labeled corpus
pnpm eval:unified-primary A/B eval for the unified embedding-space migration

Each eval:* script has a paired eval:*:check form that runs as a regression gate: it replays against the committed baseline and exits non-zero on a meaningful drop, without writing a new baseline. A deliberate change is recorded by re-running the plain eval:* script and committing the refreshed baseline.

Script What it does
pnpm deploy:prod Backup → pull → migrate → build → restart → smoke → auto-rollback on failure
pnpm deploy:prod --tag vX.Y.Z Pin the deploy to a specific release tag
pnpm rollback:prod --to <ref> Manual rollback (no migrations)
pnpm install-prod-service Install the launchd LaunchAgent (KeepAlive=true)

deploy:prod is the only supported way to change prod — a raw git pull plus manual restart skips the migrate-before-restart guard. See Deployment.

Script What it does
pnpm backup:<env> Encrypted DB backup — a single streamed pg_dump → compress → AES-256-GCM pipeline (no plaintext dump ever staged on disk)
pnpm backup:prune <env> Apply the retention policy: newest-per-day ×7 / weekly ×4 / monthly ×3
pnpm backup:status Report the age of the latest backup per env; exits non-zero if any are failing
pnpm backup:restore <env> <file> Interactive restore, with a production guardrail
pnpm backup:install-cron <env> Install the nightly backup cron (03:17 local)
pnpm backup:blobs <env> Encrypted nightly backup of blobs (photos, voice memos, imports); paired with backup:blobs:prune / :restore

See Backups for the full restore flow and retention details.

Retroactive one-shot scripts that bring already-ingested data up to a newer pipeline. All are dry-run by default — add --execute to write, and --workspace=<uuid> to scope to one workspace. A few of the common ones:

Script What it does
pnpm backfill:doc-extraction Re-enqueue already-ingested documents that never had their text extracted
pnpm backfill:image-text Re-enqueue image attachments for vision OCR so screenshots of documents become searchable text
pnpm backfill:doc-dates / backfill:photo-dates Backfill authoritative document / photo capture dates for recency ranking
pnpm reindex:imported-daily-notes Re-index imported daily-note content into the retrieval substrate
pnpm sweep:edge-confidence Demote vacuous knowledge-graph edges to their confidence caps
pnpm sweep:code-identifier-entities Clear leaked source-code identifiers from the entity graph and curation queue
pnpm sweep:apple-files-junk Purge code/build/data junk artifacts that leaked in via Apple Files indexing

The full per-script flag reference lives in the host’s operations docs.

Script What it does
pnpm docs:dev Local dev server for this documentation site
pnpm docs:build Production build of the documentation site
pnpm docs:preview Preview the production build locally
Script What it does
./scripts/gen-secret.sh [bytes] Print a fresh hex secret (default 32 bytes / 256 bits) — handy for HOST_MASTER_KEY