feat(shell): give ssm-get a callable form on PATH #1314

Merged

coilyco-ops merged 2 commits from aos/claude/pp94 into main

2026-08-27 04:14:38 +00:00

coilyco-ops commented

2026-08-27 04:10:40 +00:00

Owner

Closes #1308. Kai chose the callable form over interactive-only.

What changed

ssm-get was a shell function in shell/common.sh, so scripts, non-interactive shells, and agent tool calls could not reach it. Each one restated the raw aws ssm get-parameter --with-decryption call instead, which is the duplication the single-owning-source convention exists to prevent. It had been written down twice, most recently while working #1137.

scripts/ssm-get holds the logic, with the same <name> [profile] [region] shape and the same defaults.
It reaches PATH through the same ~/.local/bin link as the other wrappers, carried by apply-shell-links.
The shell function stays as a thin delegator, preferring the converged link and falling back to the checkout, so a host that has not run just apply-shell-links keeps the helper working with no gap.

README.md, docs/install.md, and the tooling-zsh skill say which surface is the implementation and which is the delegator.

Verification

uv run pytest tests/ - 730 passed
uv run pre-commit run --all-files - clean
bash -n and zsh -n on shell/common.sh, then a live fetch of /forgejo/coilyco-ops/api-token through the function

Also settled, outside this diff

#1307 is answered: commit.gpgsign is true on workstations, bot seats left unsigned. It is now true on kais-macbook-pro, and the commit in this PR verifies %G? = G, so the signing path added by #1306 is live rather than merely available. The fleet rollout for the other workstations belongs to the ansible shell role in infrastructure, per the authoring-versus-rollout contract, and is tracked on #1307.

Closes #1308. Kai chose the callable form over interactive-only. ## What changed `ssm-get` was a shell function in `shell/common.sh`, so scripts, non-interactive shells, and agent tool calls could not reach it. Each one restated the raw `aws ssm get-parameter --with-decryption` call instead, which is the duplication the single-owning-source convention exists to prevent. It had been written down twice, most recently while working #1137. * `scripts/ssm-get` holds the logic, with the same `<name> [profile] [region]` shape and the same defaults. * It reaches `PATH` through the same `~/.local/bin` link as the other wrappers, carried by `apply-shell-links`. * The shell function stays as a thin delegator, preferring the converged link and falling back to the checkout, so a host that has not run `just apply-shell-links` keeps the helper working with no gap. `README.md`, `docs/install.md`, and the `tooling-zsh` skill say which surface is the implementation and which is the delegator. ## Verification * `uv run pytest tests/` - 730 passed * `uv run pre-commit run --all-files` - clean * `bash -n` and `zsh -n` on `shell/common.sh`, then a live fetch of `/forgejo/coilyco-ops/api-token` through the function ## Also settled, outside this diff #1307 is answered: `commit.gpgsign` is true on workstations, bot seats left unsigned. It is now `true` on kais-macbook-pro, and the commit in this PR verifies `%G?` = `G`, so the signing path added by #1306 is live rather than merely available. The fleet rollout for the other workstations belongs to the ansible shell role in infrastructure, per the authoring-versus-rollout contract, and is tracked on #1307.

coilyco-ops added 1 commit

2026-08-27 04:10:40 +00:00

feat(shell): give ssm-get a callable form on PATH

ci / aos-eval-tests (pull_request) Successful in 9s

Details

ci / ward-doctor (pull_request) Successful in 7s

Details

ci / aos-cli-tests (pull_request) Successful in 28s

Details

ci / gate (pull_request) Successful in 1m0s

Details

8d45fcad16

`ssm-get` was a shell function, so scripts, non-interactive shells, and agent
tool calls could not reach it and restated the raw `aws ssm get-parameter`
call instead. That is the duplication the single-owning-source convention
exists to prevent, and it had been written down twice.

`scripts/ssm-get` now holds the logic and reaches `PATH` through the same
`~/.local/bin` link as the other wrappers, carried by `apply-shell-links`.
The shell function stays as a thin delegator, preferring the converged link
and falling back to the checkout, so an unconverged host keeps the helper.

Closes #1308

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops added 1 commit

2026-08-27 04:12:51 +00:00