@erclx/canon 4.0.0

package/scripts/lib/sandbox-git.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+
+# The sandbox reaches GitHub over HTTPS with the gh token so a headless run needs
+# no SSH key and no agent. `gh auth login` authenticates the CLI but leaves git
+# itself without a credential, so the harness supplies the helper rather than
+# assuming the machine carries one.
+SANDBOX_GIT_CREDENTIAL_HELPER='!gh auth git-credential'
+
+# Call from the main shell before any scenario runs. sandbox_anchor_url is used
+# inside command substitutions, where log_error would exit only the subshell and
+# leave the caller building an empty remote, so the run has to stop here instead.
+require_sandbox_anchor_config() {
+  if [ -z "${GITHUB_ORG:-}" ]; then
+    log_error "GITHUB_ORG is empty. Export GITHUB_ORG=<org>, or run from a clone whose remote.origin.url points at GitHub."
+  fi
+}
+
+resolve_sandbox_anchor_repo() {
+  printf '%s\n' "${1:-${ANCHOR_REPO:-}}"
+}
+
+sandbox_anchor_url() {
+  local repo_name
+  repo_name="$(resolve_sandbox_anchor_repo "$@")"
+
+  if [ -z "$repo_name" ] || [ -z "${GITHUB_ORG:-}" ]; then
+    log_error "sandbox_anchor_url needs GITHUB_ORG and a repository name. Call require_sandbox_anchor_config first."
+  fi
+
+  printf 'https://github.com/%s/%s.git\n' "$GITHUB_ORG" "$repo_name"
+}
+
+# credential.helper is multi-valued and git concatenates it across system, global,
+# and local, trying each in order until one returns a credential. A plain set
+# leaves an operator's existing helper ahead of this one, so a stale token wins
+# and gh never runs. The empty value resets the inherited list first.
+configure_sandbox_git_credentials() {
+  git config credential.helper ""
+  git config --add credential.helper "$SANDBOX_GIT_CREDENTIAL_HELPER"
+}
+
+resolve_sandbox_git_identity() {
+  SANDBOX_GIT_NAME="${SANDBOX_GIT_NAME:-$(git config --global user.name 2>/dev/null || true)}"
+  SANDBOX_GIT_EMAIL="${SANDBOX_GIT_EMAIL:-$(git config --global user.email 2>/dev/null || true)}"
+
+  : "${SANDBOX_GIT_NAME:=aitk-sandbox}"
+  : "${SANDBOX_GIT_EMAIL:=sandbox@example.com}"
+
+  export SANDBOX_GIT_NAME SANDBOX_GIT_EMAIL
+}
+
+configure_sandbox_git_identity() {
+  resolve_sandbox_git_identity
+  git config user.name "$SANDBOX_GIT_NAME"
+  git config user.email "$SANDBOX_GIT_EMAIL"
+}
+
+# Every scenario that needs a remote points at the same throwaway repository, so
+# the name lives here rather than in each one.
+SANDBOX_ANCHOR_REPO="aitk-sandbox"
+
+# A scenario calls this from its own use_anchor hook rather than this file
+# defining the hook. manage-sandbox.sh keys off `type -t use_anchor`, so
+# declaring it here would hand an anchor to the scenarios that source this file
+# for the identity helpers alone.
+use_sandbox_anchor() {
+  export ANCHOR_REPO="${1:-$SANDBOX_ANCHOR_REPO}"
+}
+
+# gh answers an absent repository and an unreachable host with the same exit
+# status, so the 404 is the only thing separating them. Anything else is a
+# network or credential fault, where creating a repository would be the wrong
+# answer and would fail for the same reason the read did.
+ensure_sandbox_anchor_repo() {
+  local repo_name gh_error
+
+  repo_name="$(resolve_sandbox_anchor_repo "$@")"
+
+  if [ -z "$repo_name" ] || [ -z "${GITHUB_ORG:-}" ]; then
+    log_error "ensure_sandbox_anchor_repo needs GITHUB_ORG and a repository name. Call require_sandbox_anchor_config first."
+  fi
+
+  if gh_error="$(gh api "repos/${GITHUB_ORG}/${repo_name}" --silent 2>&1)"; then
+    return 0
+  fi
+
+  case "$gh_error" in
+  *"HTTP 404"*) ;;
+  *) log_error "Cannot reach ${GITHUB_ORG}/${repo_name}: ${gh_error}" ;;
+  esac
+
+  # An absent anchor is nearly always a wrong GITHUB_ORG or a rename nobody
+  # performed, and provisioning stages a fixture rather than cloning while every
+  # scenario force-pushes to main, so a repository created here would carry all
+  # nine to a pass against something that is not the anchor. Refusing is the safe
+  # default and creating is the opt-in, the shape `canon tooling sync --write`
+  # already sets. `canon records push` refuses outright for the reason
+  # `.claude/context/development/scratch.md` records, so the two still differ.
+  # The sibling SANDBOX_ flags are presence tests, so any non-empty value turns
+  # them on. This one allowlists instead, because a presence test would have
+  # SANDBOX_ANCHOR_CREATE=false provisioning a repository. Both spellings are
+  # accepted so the `true` those siblings are set to does not land on a refusal.
+  case "${SANDBOX_ANCHOR_CREATE:-}" in
+  1 | true) ;;
+  *) log_error "${GITHUB_ORG}/${repo_name} does not exist. Check GITHUB_ORG and whether a rename is pending, then create it with 'gh repo create ${GITHUB_ORG}/${repo_name} --private' or re-run with SANDBOX_ANCHOR_CREATE=true." ;;
+  esac
+
+  log_warn "${GITHUB_ORG}/${repo_name} does not exist and SANDBOX_ANCHOR_CREATE is set. Creating it as private."
+  if ! gh_error="$(gh repo create "${GITHUB_ORG}/${repo_name}" --private 2>&1)"; then
+    log_error "Could not create ${GITHUB_ORG}/${repo_name}: ${gh_error}"
+  fi
+  log_info "Created ${GITHUB_ORG}/${repo_name} as a private repository."
+}
+
+# A remote is useless without an author, so the scenarios that reach one always
+# configure both. configure_sandbox_git_identity stays callable on its own for
+# the scenarios that never push. The probe runs first so an absent remote is
+# reported before the scenario stages anything. The remove keeps this idempotent
+# against a sandbox tree that already carries an origin.
+configure_sandbox_anchor_remote() {
+  ensure_sandbox_anchor_repo "$@"
+  configure_sandbox_git_identity
+  git remote remove origin 2>/dev/null || true
+  git remote add origin "$(sandbox_anchor_url "$@")"
+}

package/scripts/lib/sandbox-path.sh

@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+
+# The sandbox tree lives outside the toolkit worktree. `scripts/sandbox/run.sh`
+# sets cwd to it for `claude -p`, and every `CLAUDE.md` between that cwd and the
+# filesystem root loads into the session. Under the repository the toolkit's own
+# instructions join that chain beside the seeded copy the scenario installed,
+# both carry the rule sending shared session scratch to the main worktree root,
+# and nothing decides which root wins. A session picking the toolkit writes its
+# output where no manifest reads it, so the run reports success while the verdict
+# reports no writes at all. `scripts/eval/run.sh` keeps its fixture outside the
+# repository for the same reason.
+#
+# Mints a short random per-run identifier the first time it is asked for, then
+# holds it in CANON_SANDBOX_RUN_ID for the rest of this process. A direct call
+# (not `$(...)`) exports it into the caller's own shell, which is what lets
+# `run.sh` mint once and have manage-sandbox.sh and the check it shells out to
+# both inherit the same id as ordinary children. A call already carrying the
+# variable, inherited from such a parent, reuses it rather than minting a new one.
+#
+# Twin of `mintSandboxRunId` in `src/commands/sandbox.ts`.
+mint_sandbox_run_id() {
+  if [ -z "${CANON_SANDBOX_RUN_ID:-}" ]; then
+    CANON_SANDBOX_RUN_ID="$(date +%s)-$$-$RANDOM"
+  fi
+  export CANON_SANDBOX_RUN_ID
+}
+
+# The base every per-run tree nests under, with no run id appended. Split out
+# of `resolve_sandbox_dir` so a caller that needs to recognize any run's tree,
+# such as `require_project_root` in `scripts/lib/ui.sh`, tests against this
+# prefix instead of a single resolved path that changes on every call.
+sandbox_dir_prefix() {
+  printf '%s/canon/sandbox\n' "${XDG_STATE_HOME:-$HOME/.local/state}"
+}
+
+# Twin of `sandboxTree` in `src/commands/sandbox.ts`. The exec boundary rules out
+# a shared constant, so a change to the default lands on both sides.
+#
+# A bare fall-through with no per-run component is one path per machine, so
+# two sessions resolving the default at once would provision over each other
+# with neither told. `mint_sandbox_run_id` is what makes two such sessions
+# land on two different trees rather than one.
+resolve_sandbox_dir() {
+  if [ -n "${CANON_SANDBOX_DIR:-}" ]; then
+    printf '%s\n' "$CANON_SANDBOX_DIR"
+    return 0
+  fi
+
+  mint_sandbox_run_id
+  printf '%s-%s\n' "$(sandbox_dir_prefix)" "$CANON_SANDBOX_RUN_ID"
+}
+
+# Collapses repeated separators, folds `.` and `..` segments, and strips every
+# trailing separator, leaving a bare root as `/`. Every comparison below is a
+# string test, so `//`, `$HOME//`, and `$HOME/../../usr` each read as a path no
+# rule names until this runs, and an unresolved `..` defeats the allowlist and
+# both directions of the repository test at once.
+#
+# The fold is lexical because the guard runs before provisioning creates the
+# tree, which rules out `cd` with `pwd -P` and any resolution needing the path
+# to exist. Nothing here follows a symlink, so a `..` below one resolves against
+# the link's own path rather than its target. A `..` climbing past the root
+# clamps to `/`, matching the kernel, which leaves the allowlist to refuse it
+# under the rule that already covers every root path.
+normalize_sandbox_path() {
+  local path="$1"
+
+  [ -n "$path" ] || return 0
+
+  while [ "$path" != "${path//\/\//\/}" ]; do
+    path="${path//\/\//\/}"
+  done
+
+  local root=""
+  if [ "${path#/}" != "$path" ]; then
+    root="/"
+    path="${path#/}"
+  fi
+
+  # `resolved` carries each kept segment behind its own separator, so a pop is
+  # one suffix removal and popping an empty stack is the no-op that clamps at
+  # the root. `climbed` holds the leading `..` a relative path has no segment to
+  # pop against, which dropping would change the directory it names.
+  local resolved="" climbed="" segment
+  local remaining=4096
+
+  while [ -n "$path" ] && [ "$remaining" -gt 0 ]; do
+    remaining=$((remaining - 1))
+
+    segment="${path%%/*}"
+    if [ "$segment" = "$path" ]; then
+      path=""
+    else
+      path="${path#*/}"
+    fi
+
+    case "$segment" in
+    "" | .) ;;
+    ..)
+      if [ -n "$resolved" ]; then
+        resolved="${resolved%/*}"
+      elif [ -z "$root" ]; then
+        climbed="$climbed../"
+      fi
+      ;;
+    *) resolved="$resolved/$segment" ;;
+    esac
+  done
+
+  if [ -n "$root" ]; then
+    path="${resolved:-/}"
+  else
+    path="${climbed}${resolved#/}"
+    path="${path:-.}"
+  fi
+
+  while [ "${#path}" -gt 1 ] && [ "${path%/}" != "$path" ]; do
+    path="${path%/}"
+  done
+
+  printf '%s' "$path"
+}
+
+# Whether `candidate` is `target` or a directory containing it. Removing the
+# former removes the latter, which is what makes an ancestor as dangerous as an
+# exact match.
+is_at_or_above() {
+  local candidate="$1"
+  local target="$2"
+
+  [ "$candidate" = "$target" ] || [ "${target#"$candidate"/}" != "$target" ]
+}
+
+# Prints the reason a location is unusable and returns non-zero, so the caller
+# reports one message naming the path rather than a bare refusal.
+#
+# Provisioning runs `rm -rf` on this path at three sites before staging, so the
+# test is an allowlist rather than a list of paths to refuse. A blocklist has to
+# name every system directory to be right once and stays wrong as soon as one is
+# missed, while requiring a strict descendant of the home directory or of the
+# temp root admits the default and every reasonable override and refuses `/`,
+# `/usr`, `/etc`, and `$HOME` itself without naming any of them.
+#
+# The repository test is separate and runs both ways. A path under the worktree
+# restores the ancestor chain the relocation removed, and a path above it is one
+# `rm -rf` away from deleting the repository. It resolves the main worktree root
+# rather than trusting `$PROJECT_ROOT`, since a linked worktree is itself inside
+# that root.
+assert_sandbox_dir_safe() {
+  local raw="$1"
+  local root="${2:-${PROJECT_ROOT:-$PWD}}"
+
+  if [ -z "$raw" ] || [ "${raw#/}" = "$raw" ]; then
+    printf 'CANON_SANDBOX_DIR must be an absolute path, got: %s\n' "${raw:-<empty>}"
+    return 1
+  fi
+
+  # `normalize_sandbox_path` stops at 4096 segments and drops the remainder,
+  # which would hand the tests below an ancestor of the path provisioning
+  # removes. Refusing past `PATH_MAX` keeps that bound out of reach, since a
+  # segment costs at least two bytes and no syscall accepts the string anyway.
+  if [ "${#raw}" -gt 4096 ]; then
+    printf 'Refusing the sandbox path. It is %s characters, past the longest path any filesystem here accepts.\n' "${#raw}"
+    return 1
+  fi
+
+  local dir home temp
+  dir="$(normalize_sandbox_path "$raw")"
+  home="$(normalize_sandbox_path "${HOME:-/root}")"
+  temp="$(normalize_sandbox_path "${TMPDIR:-/tmp}")"
+
+  # Every message below names `$raw`, which is what the operator set. The tests
+  # compare `$dir`, so a path carrying `..` is refused for a location its own
+  # spelling does not show.
+  local resolution=""
+  [ "$dir" = "$raw" ] || resolution=" It resolves to $dir."
+
+  if ! is_at_or_above "$home" "$dir" && ! is_at_or_above "$temp" "$dir"; then
+    printf 'Refusing %s as the sandbox. Provisioning removes the tree first, so the path has to sit under %s or %s.%s\n' "$raw" "$home" "$temp" "$resolution"
+    return 1
+  fi
+
+  if [ "$dir" = "$home" ] || [ "$dir" = "$temp" ]; then
+    printf 'Refusing %s as the sandbox. Provisioning removes the tree first, so the path has to sit under %s rather than be it.\n' "$raw" "$dir"
+    return 1
+  fi
+
+  local main_root
+  main_root="$(git -C "$root" worktree list --porcelain 2>/dev/null |
+    grep -m 1 '^worktree ' | cut -d' ' -f2-)"
+  main_root="$(normalize_sandbox_path "${main_root:-$root}")"
+
+  if is_at_or_above "$dir" "$main_root"; then
+    printf 'Refusing %s as the sandbox. Provisioning removes the tree first, and that path contains %s.%s\n' "$raw" "$main_root" "$resolution"
+    return 1
+  fi
+
+  case "$dir" in
+  "$main_root"/*)
+    printf 'Sandbox at %s sits inside %s, which puts the toolkit CLAUDE.md back on the session ancestor chain.%s Point CANON_SANDBOX_DIR outside the repository.\n' "$raw" "$main_root" "$resolution"
+    return 1
+    ;;
+  esac
+
+  return 0
+}

package/scripts/lib/tooling.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+TOOLING_STACK_EXCLUDE=("claude")
+
+is_tooling_stack_excluded() {
+  local name="$1"
+  local excluded
+  for excluded in "${TOOLING_STACK_EXCLUDE[@]}"; do
+    if [ "$name" = "$excluded" ]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+list_tooling_stacks() {
+  local tooling_dir="${1:-$PROJECT_ROOT/tooling}"
+  local name
+  while IFS= read -r entry; do
+    name=$(basename "$entry")
+    is_tooling_stack_excluded "$name" && continue
+    echo "$name"
+  done < <(find "$tooling_dir" -mindepth 1 -maxdepth 1 -type d | sort)
+}
+
+# Seed roots that carry a `.claude/`, emitted relative to `PROJECT_ROOT`. Every
+# stage measuring seed content discovers through this rather than naming a stack,
+# so a stack seeding `.claude/` later arrives covered with no edit to any caller.
+collect_seed_roots() {
+  local dir
+  for dir in "$PROJECT_ROOT"/tooling/*/seeds; do
+    [ -d "$dir/.claude" ] || continue
+    printf '%s\n' "${dir#"$PROJECT_ROOT"/}"
+  done
+}

package/scripts/lib/ui.sh

@@ -0,0 +1,266 @@
+#!/usr/bin/env bash
+
+if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
+  echo "canon requires bash 4 or newer. Current: ${BASH_VERSION:-unknown}." >&2
+  echo "Install via Homebrew: brew install bash" >&2
+  exit 1
+fi
+
+# Resolved from this file's own location rather than `$PROJECT_ROOT`, because
+# `require_project_root` is what several scripts call before anything has
+# established a root.
+# shellcheck source=/dev/null
+source "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/sandbox-path.sh"
+
+# `NO_COLOR` follows the published convention, where any non-empty value turns
+# color off whatever the value says.
+supports_color() {
+  [ -z "${NO_COLOR:-}" ] && [ -t "$1" ]
+}
+
+# Assigns the six palette names for one file descriptor. The blank palette keeps
+# every frame character and drops only the escapes, so a captured run still
+# reads as one block.
+#
+# Bash returns a string and nothing richer, so the palette arrives through the
+# caller's own scope. A writer declaring all six `local` before calling this
+# keeps the assignment to itself, which is what leaves the source-time answer
+# below standing for anything that sources this file.
+set_palette() {
+  if supports_color "$1"; then
+    GREEN='\033[0;32m'
+    RED='\033[0;31m'
+    YELLOW='\033[0;33m'
+    WHITE='\033[1;37m'
+    GREY='\033[0;90m'
+    NC='\033[0m'
+  else
+    GREEN=''
+    RED=''
+    YELLOW=''
+    WHITE=''
+    GREY=''
+    NC=''
+  fi
+}
+
+# Every writer below frames to stderr and asks about that stream at write time,
+# so no answer is frozen before a caller's redirect is in place. This one answers
+# for stdout instead, because it is read by a sourcing script writing its own
+# frame with a bare `echo`, and that is the stream a bare `echo` reaches.
+set_palette 1
+
+log_info() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1" >&2
+}
+log_warn() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${YELLOW}!${NC} $1" >&2
+}
+log_error() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${RED}✗${NC} $1" >&2
+  exit 1
+}
+log_step() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}" >&2
+}
+log_add() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${GREEN}+${NC} $1" >&2
+}
+log_rem() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}│${NC} ${RED}-${NC} $1" >&2
+}
+
+pipe_output() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  while IFS= read -r line; do echo -e "${GREY}│${NC}  $line" >&2; done
+}
+
+open_timeline() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}┌${NC}" >&2
+  if [ -n "${1:-}" ]; then
+    echo -e "${GREY}│${NC} ${WHITE}$1${NC}" >&2
+  fi
+}
+
+close_timeline() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  echo -e "${GREY}└${NC}" >&2
+}
+
+guard_root() {
+  local target="$1"
+  local target_abs
+  target_abs=$(cd "$target" && pwd)
+  if [ "$target_abs" = "$PROJECT_ROOT" ]; then
+    log_error "Cannot run against toolkit root. Files here are the source of truth."
+  fi
+}
+
+require_project_root() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  local sandbox in_sandbox=0
+  if [ -n "${CANON_SANDBOX_DIR:-}" ]; then
+    sandbox="$CANON_SANDBOX_DIR"
+    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* ]] && in_sandbox=1
+  else
+    sandbox="$(sandbox_dir_prefix)"
+    [[ "$PWD" == "$sandbox" || "$PWD" == "$sandbox"/* || "$PWD" == "$sandbox"-* ]] && in_sandbox=1
+  fi
+  if [ "$in_sandbox" -eq 1 ]; then
+    echo -e "${GREY}┌${NC}" >&2
+    log_error "Execution restricted: Command cannot be run from inside the sandbox environment."
+  fi
+  if [[ "$PWD" != "$PROJECT_ROOT"* ]]; then
+    echo -e "${GREY}┌${NC}" >&2
+    log_error "Context Error: You must run this command from inside the repository."
+  fi
+}
+
+# The retired spelling stays honored, and permanently. This variable is the
+# documented way to drive any command headlessly, so every skill body, CI job,
+# and operator script already written sets the old name, and those callers live
+# in repositories and plugin caches this release cannot reach. Dropping it
+# leaves them waiting on a TTY nobody is watching.
+is_non_interactive() {
+  # canon-keep-retired
+  [[ "${CANON_NON_INTERACTIVE:-}" == "1" || "${AITK_NON_INTERACTIVE:-}" == "1" ]]
+}
+
+ask() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  local prompt_text=$1
+  local var_name=$2
+  local default_val=$3
+  local input=""
+  local char
+  local display_default=""
+  if [ -n "$default_val" ]; then
+    display_default=" (${default_val})"
+  fi
+  if is_non_interactive; then
+    echo -e "${GREY}│${NC}" >&2
+    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${default_val}${NC}" >&2
+    export "$var_name"="$default_val"
+    return
+  fi
+  echo -e "${GREY}│${NC}" >&2
+  echo -ne "${GREEN}◆${NC} ${prompt_text}${display_default} " >&2
+  while IFS= read -r -s -n1 char; do
+    if [[ $char == $'\x1b' ]]; then
+      read -rsn2 -t 0.001 _ || true
+      echo -ne "\r\033[K" >&2
+      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
+      exit 1
+    elif [[ $char == $'\x7f' || $char == $'\x08' ]]; then
+      if [ -n "$input" ]; then
+        input="${input%?}"
+        echo -ne "\b \b" >&2
+      fi
+    elif [[ -z "$char" ]]; then
+      break
+    else
+      input+="$char"
+      echo -n "$char" >&2
+    fi
+  done
+  [ -z "$input" ] && input="$default_val"
+  echo -ne "\r\033[K" >&2
+  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${input}${NC}" >&2
+  export "$var_name"="$input"
+}
+
+select_or_route_scenario() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  local prompt_text=$1
+  shift
+  local options=("$@")
+
+  if [ -n "${SANDBOX_SCENARIO:-}" ]; then
+    echo -e "${GREY}│${NC}" >&2
+    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${SANDBOX_SCENARIO}${NC}" >&2
+    export SELECTED_OPTION="$SANDBOX_SCENARIO"
+    return
+  fi
+
+  select_option "$prompt_text" "${options[@]}"
+}
+
+select_option() {
+  local GREEN RED YELLOW WHITE GREY NC
+  set_palette 2
+  local prompt_text=$1
+  shift
+  local options=("$@")
+  local cur=0
+  local count=${#options[@]}
+
+  if is_non_interactive; then
+    echo -e "${GREY}│${NC}" >&2
+    echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[0]}${NC}" >&2
+    export SELECTED_OPTION="${options[0]}"
+    return
+  fi
+
+  if [ ! -t 0 ]; then
+    log_error "${prompt_text} requires a TTY. Pass an argument or set CANON_NON_INTERACTIVE=1."
+  fi
+
+  echo -e "${GREY}│${NC}" >&2
+  echo -ne "${GREEN}◆${NC} ${prompt_text}\n" >&2
+
+  while true; do
+    for i in "${!options[@]}"; do
+      if [ "$i" -eq "$cur" ]; then
+        echo -e "${GREY}│${NC}  ${GREEN}❯ ${options[$i]}${NC}" >&2
+      else
+        echo -e "${GREY}│${NC}    ${GREY}${options[$i]}${NC}" >&2
+      fi
+    done
+
+    read -rsn1 key
+    case "$key" in
+    $'\x1b')
+      if read -rsn2 -t 0.001 key_seq; then
+        if [[ "$key_seq" == "[A" ]]; then cur=$(((cur - 1 + count) % count)); fi
+        if [[ "$key_seq" == "[B" ]]; then cur=$(((cur + 1) % count)); fi
+      else
+        echo -ne "\033[$((count + 1))A\033[J" >&2
+        echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
+        exit 1
+      fi
+      ;;
+    "k") cur=$(((cur - 1 + count) % count)) ;;
+    "j") cur=$(((cur + 1) % count)) ;;
+    "q")
+      echo -ne "\033[$((count + 1))A\033[J" >&2
+      echo -e "${GREY}◇${NC} ${prompt_text} ${RED}Cancelled${NC}" >&2
+      exit 1
+      ;;
+    "") break ;;
+    esac
+    echo -ne "\033[${count}A" >&2
+  done
+
+  echo -ne "\033[$((count + 1))A\033[J" >&2
+  echo -e "${GREY}◇${NC} ${prompt_text} ${WHITE}${options[$cur]}${NC}" >&2
+  export SELECTED_OPTION="${options[$cur]}"
+}

package/scripts/lib/worktree.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Claude Code's worktree entry writes core.bare into the parent repository's
+# shared config and its exit never restores it, stranding every later command in
+# the main worktree. Sourced by verify.sh, which runs the repair before any stage
+# because the flag breaks the git reads that scope the run.
+
+repair_bare_flag() {
+  local root="${1:-$PROJECT_ROOT}"
+  local common_dir
+  [ "$(git -C "$root" config --get core.bare 2>/dev/null || echo false)" = true ] || return 0
+
+  common_dir=$(git -C "$root" rev-parse --path-format=absolute --git-common-dir 2>/dev/null) || return 0
+  # A genuinely bare repository keeps its objects at the root and has no .git
+  # directory, so it fails this test and keeps its flag.
+  [ "$(basename "$common_dir")" = ".git" ] || return 0
+
+  git -C "$root" config core.bare false
+  log_warn "Repaired core.bare, which worktree entry left set. Recovery is 'git config core.bare false'."
+}