chore(pocketbase): publish hooks to WFDASH-PBHOOKS for the VPS sync

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -135,8 +135,9 @@ Read side: `src/lib/server/audit-log-service.ts` →
 Noisy fields (search/AI/timers) are skipped via `IGNORED_FIELDS` in the
 hook utils — add new auto-updated fields there.
 
-Hooks deploy from git: a VPS cron syncs the files listed in
-`pocketbase/pb_hooks/DEPLOY` from `main` into the live PB hooks volume
+Hooks deploy from git: commit changes in `pocketbase/pb_hooks/`, then
+`npm run pb:hooks:publish` (pushes that folder to Forgejo `David/WFDASH-PBHOOKS`);
+a VPS cron syncs the files listed in `DEPLOY` into the live PB hooks volume
 (see `scripts/pb-hooks/README.md`). **As of 2026-10-17 only `quotes.pb.js`
 is deployed — the audit hooks are NOT live yet**, so `audit_log` is empty
 until both `audit_log.pb.js` and `audit_log_utils.js` are added to `DEPLOY`.

package.json

@@ -66,7 +66,8 @@
     "test:coverage": "vitest run --coverage",
     "e2e": "playwright test",
     "e2e:ui": "playwright test --ui",
-    "e2e:install": "playwright install --with-deps chromium"
+    "e2e:install": "playwright install --with-deps chromium",
+    "pb:hooks:publish": "git subtree push --prefix=pocketbase/pb_hooks http://forgejo-b82b4lpyyzyg40thdsjdd38i.163.245.214.68.sslip.io/David/WFDASH-PBHOOKS.git main"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.116.0",

scripts/pb-hooks/README.md

@@ -7,18 +7,23 @@ at `/app/pb_hooks`.
 
 Hooks are deployed from git, not edited on the server:
 
-1. Edit or add files in `pocketbase/pb_hooks/` in this repo.
+1. Edit or add files in `pocketbase/pb_hooks/` in this repo (the source of truth).
 2. List every file to deploy in `pocketbase/pb_hooks/DEPLOY`.
-3. Push to `main` on Forgejo.
+3. Commit, then publish the folder to the hooks repo:
+   `npm run pb:hooks:publish` (pushes `pocketbase/pb_hooks` to `main` of
+   Forgejo `David/WFDASH-PBHOOKS` with `git subtree`).
 
-Within ~2 minutes the VPS cron runs `sync-pb-hooks.sh`, which pulls `main`
-into `/opt/wfdash-pb-hooks/repo` (sparse clone, read-only deploy key) and
-copies the listed files into the volume. PocketBase reloads itself when a hook
-file changes. A `.js` file on the server that isn't in `DEPLOY` is removed.
+Within ~2 minutes the VPS cron runs `/opt/wfdash-pb-hooks/sync-pb-hooks.sh`,
+which pulls `WFDASH-PBHOOKS` into `/opt/wfdash-pb-hooks/repo` and copies the
+listed files into the volume. PocketBase reloads itself when a hook file
+changes. A `.js` file on the server that isn't in `DEPLOY` is removed.
 
 - Log: `/var/log/wfdash-pb-hooks-sync.log` on the VPS.
-- Force a sync: `/opt/wfdash-pb-hooks/repo/scripts/pb-hooks/sync-pb-hooks.sh --force`
-- Roll back: revert the commit (or remove the line from `DEPLOY`) and push.
+- Force a sync: `/opt/wfdash-pb-hooks/sync-pb-hooks.sh --force`
+- Roll back: revert the commit (or remove the line from `DEPLOY`), commit,
+  `npm run pb:hooks:publish`.
 - Pause syncing: comment out the cron line (`crontab -e` as root).
+- The script itself is installed by copying this file to the VPS; re-copy it
+  after changing it.
 
 The sync never touches `pb_data` (the database).

scripts/pb-hooks/sync-pb-hooks.sh

@@ -1,8 +1,10 @@
 #!/bin/sh
 # Sync the WFDASH PocketBase hooks from git into the live hooks volume.
 #
-# Runs on the VPS from cron. Pulls origin/main into a sparse clone and copies
-# every file listed in pocketbase/pb_hooks/DEPLOY into the PocketBase hooks
+# Runs on the VPS from cron. Pulls origin/main of the WFDASH-PBHOOKS repo
+# (a copy of this app's pocketbase/pb_hooks folder, published with
+# `npm run pb:hooks:publish`) and copies every file listed in its DEPLOY
+# file into the PocketBase hooks
 # volume. PocketBase reloads itself when a file in pb_hooks changes, so no
 # container restart is needed. Files are only written when their content
 # changed, so an unchanged repo never triggers a reload.
@@ -29,7 +31,7 @@ if [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ] && [ "${1:-}" !=
 fi
 git reset --quiet --hard origin/main
 
-SRC="$REPO/pocketbase/pb_hooks"
+SRC="${PB_HOOKS_SRC:-$REPO}"
 LIST="$SRC/DEPLOY"
 if [ ! -f "$LIST" ]; then
   log "no $LIST; nothing deployed"