* Add orchestra: named scripts for permission-free agent operations
14 named scripts that wrap common Hey, tracker, and vault operations
into single commands. When added to the Bash permission allowlist,
they eliminate repeated permission prompts during email triage and
vault operations.
Scripts derive vault path from their own location (portable).
Installer and updater copy them to Meta/scripts/ in the vault.
Postman agent and email-triage skill updated to prefer scripts
over inline pipelines.
* Address Copilot review feedback on orchestra scripts
- Pass shell variables to Python via sys.argv instead of string
interpolation to prevent quoting/injection issues
- Validate --mailbox argument has a value before shifting
- Validate numeric arguments (hours, days) as integers
- Fix vault-stats folder list to use bash array (word splitting)
- Fix vault-inbox to handle missing 00-Inbox/ gracefully
- Remove unused import os from hey-check
- Narrow postman.md allowed commands from Meta/scripts/* wildcard
to explicitly named scripts
- Add .core-manifest tracking for scripts in launchme.sh/updateme.sh
with deprecation of removed scripts on update
- Fix contact-lookup description (matches senders only, not recipients)
* Fix orchestra scripts bugs, security allowlist, and docs consistency
- Replace deprecated datetime.utcnow() with datetime.now(timezone.utc)
in hey-check for Python 3.12+ compatibility
- Replace bare except: with except Exception: in all 6 tracker/lookup
scripts to avoid swallowing KeyboardInterrupt and SystemExit
- Fix postman.md Hey triage step numbering (5→7 gap, now 1-9 sequential)
- Add Meta/scripts/ commands to email-triage SKILL.md allowed Bash list
(procedure referenced them but security section blocked them)
- Update email-triage templates from hardcoded "Gmail" to {{source}}
placeholder for Hey/Gmail/MCP compatibility
- Add orchestra/ directory to README project structure tree and
Meta/scripts/ to installed vault structure diagram
* Address Copilot review: timestamp comparison, stale scripts, naming, JSON
- Fix tracker-recent timestamp comparison: truncate both cutoff and
active_at to YYYY-MM-DDTHH:MM:SS before comparing, avoiding
unreliable lexicographic comparison of Z vs +00:00 suffixes
- Fix contact-lookup dedup: skip entries with no topic_id to prevent
unrelated results collapsing into a single None key
- Rename hey-thread parameter from <topic_id> to <posting_id> to
align with Hey CLI terminology and hey-seen naming
- Fix orchestra README JSON snippet: wrap in valid settings.json
structure so users can copy/paste without syntax errors
- Add stale script cleanup to launchme.sh on reinstall, mirroring
the existing agent deprecation logic
- Separate removed-scripts counter from deprecated-files counter
in updateme.sh summary for accurate messaging
---------
Co-authored-by: gnekt <dima9610@gmail.com>
Orchestra
Named scripts that wrap common agent operations into single, permission-friendly commands.
Why
Claude Code prompts the user for permission on every novel Bash command. When agents run inline pipelines (e.g., hey box imbox --json | python3 -c "...") each unique pipeline triggers a prompt. Named scripts at known paths can be added to the permission allowlist once and run silently forever.
Installation
The installer (scripts/launchme.sh) copies these to Meta/scripts/ inside your vault. They derive their vault path from their own location, so no configuration is needed.
After installation, add the orchestra scripts to your Claude Code permission allowlist. In ~/.claude/settings.json, merge these entries into the permissions.allow array:
{
"permissions": {
"allow": [
"Bash(Meta/scripts/hey-imbox:*)",
"Bash(Meta/scripts/hey-feed:*)",
"Bash(Meta/scripts/hey-trail:*)",
"Bash(Meta/scripts/hey-later:*)",
"Bash(Meta/scripts/hey-thread:*)",
"Bash(Meta/scripts/hey-seen:*)",
"Bash(Meta/scripts/hey-check:*)",
"Bash(Meta/scripts/tracker-today:*)",
"Bash(Meta/scripts/tracker-recent:*)",
"Bash(Meta/scripts/tracker-search:*)",
"Bash(Meta/scripts/tracker-mailbox:*)",
"Bash(Meta/scripts/vault-stats:*)",
"Bash(Meta/scripts/vault-inbox:*)",
"Bash(Meta/scripts/contact-lookup:*)"
]
}
}
If you already have a
permissions.allowarray, add the entries to it rather than replacing it.
Scripts
Hey Mailbox Scripts
These wrap hey CLI commands into table-formatted output.
| Script | Usage | Description |
|---|---|---|
hey-imbox |
hey-imbox [--json] |
List Imbox (screened-in, high priority) |
hey-feed |
hey-feed [--json] |
List Feed (newsletters, notifications) |
hey-trail |
hey-trail [--json] |
List Paper Trail (receipts, financial) |
hey-later |
hey-later [--json] |
List Reply Later / Set Aside |
hey-thread |
hey-thread <id> |
Read a specific thread by posting ID |
hey-seen |
hey-seen <id> |
Mark a posting as seen |
Tracker Scripts
These query the local Meta/hey-tracker.jsonl file. No API calls, instant results, full history.
The tracker is populated by a cron job running hey-poll.sh (see the Hey poller setup docs).
| Script | Usage | Description |
|---|---|---|
hey-check |
hey-check [days] [--search query] [--all] |
General tracker query (default: last 2 days) |
tracker-today |
tracker-today [--mailbox box] [--json] |
Today's entries only |
tracker-recent |
tracker-recent [hours] [--mailbox box] [--json] |
Last N hours (default 24) |
tracker-search |
tracker-search <query> [--mailbox box] [--json] |
Full-text search across all history |
tracker-mailbox |
tracker-mailbox <box> [days] [--json] |
Filter by mailbox + time window |
contact-lookup |
contact-lookup <name> |
All emails from/to a specific person |
Vault Scripts
| Script | Usage | Description |
|---|---|---|
vault-stats |
vault-stats |
Note counts by folder, recent activity |
vault-inbox |
vault-inbox [--count] |
List inbox notes (or just count them) |
Requirements
- Hey scripts: require
heyCLI installed and authenticated - Tracker scripts: require
Meta/hey-tracker.jsonlto exist (populated by the Hey poller cron job) - Vault scripts: work with any vault, no dependencies
- All scripts require Python 3 (available by default on macOS)
Path Resolution
Scripts derive the vault root from their own location. They expect to be installed at Meta/scripts/ inside the vault:
your-vault/
Meta/
scripts/ <-- scripts live here
hey-imbox
tracker-today
...
hey-tracker.jsonl
00-Inbox/
01-Projects/
...