create-egregore 0.18.16 → 0.18.18

package/lib/auth.js

@@ -110,6 +110,26 @@ function explainNoGhHeadless(ui) {
   ui?.info?.(`  Install for any OS: ${GH_INSTALL_URL}`);
 }
 
+// Status text for the ACTIVE github.com account only. `gh auth status`
+// writes to stderr on some versions; capture both streams. With multiple
+// accounts the plain form lists every account (including broken ones), so
+// try --active first (gh ≥ 2.61) and otherwise cut the active account's
+// block out of the combined output.
+function ghActiveStatusText() {
+  let run = spawnSync("gh", ["auth", "status", "--active", "--hostname", "github.com"], { stdio: "pipe", encoding: "utf-8" });
+  let text = `${run.stdout || ""}${run.stderr || ""}`;
+  if (run.error || /unknown flag/i.test(text)) {
+    run = spawnSync("gh", ["auth", "status", "--hostname", "github.com"], { stdio: "pipe", encoding: "utf-8" });
+    text = `${run.stdout || ""}${run.stderr || ""}`;
+  }
+  // Split into per-account blocks (each starts at a "... account <login>"
+  // line) and keep the one marked active. Single-account/older gh output has
+  // no "Active account" marker — return it whole.
+  const blocks = text.split(/\n(?=\s*[✓✗xX-]?\s*(?:Logged in to|Failed to log in to))/);
+  const active = blocks.find((b) => /Active account:\s*true/i.test(b));
+  return active || text;
+}
+
 function tryGhAuth() {
   if (process.env.EGREGORE_SKIP_GH === "1") return null;
 
@@ -118,16 +138,21 @@ function tryGhAuth() {
 
   if (!ghCliExists()) return null;
 
-  // gh auth status writes to stderr; capture both.
-  const status = spawnSync("gh", ["auth", "status"], { stdio: "pipe", encoding: "utf-8" });
-  if (status.status !== 0) return null;
-  const statusText = `${status.stdout || ""}${status.stderr || ""}`;
-
-  const tokenRun = spawnSync("gh", ["auth", "token"], { stdio: "pipe", encoding: "utf-8" });
+  // The token is the source of truth: `gh auth token` succeeds iff the ACTIVE
+  // account is usable. Do NOT gate on `gh auth status`'s exit code — on
+  // multi-account setups it is non-zero when ANY configured account has a
+  // revoked/expired token, even though the active account is fine, which used
+  // to hard-fail installs until the user logged the stale accounts out.
+  const tokenRun = spawnSync("gh", ["auth", "token", "--hostname", "github.com"], { stdio: "pipe", encoding: "utf-8" });
   if (tokenRun.status !== 0) return null;
   const token = (tokenRun.stdout || "").trim();
   if (!token) return null;
 
+  // Status output is metadata only (scopes + login). Prefer --active (gh ≥
+  // 2.61) so stale sibling accounts don't pollute the output; fall back to the
+  // plain form and pick the active account's block out of it.
+  const statusText = ghActiveStatusText();
+
   // Parse declared token scopes when gh exposes them. Some gh versions and
   // fine-grained auth paths do not print a classic Token scopes line. Treat
   // that as "unknown" and continue with the first-party gh token instead of

package/lib/local.js

@@ -198,6 +198,63 @@ async function putFileContent(token, owner, repo, filePath, content, message) {
   return ghApi("PUT", `/repos/${owner}/${repo}/contents/${filePath}`, token, body);
 }
 
+async function paginateRepos(token, baseUrl) {
+  let all = [];
+  let page = 1;
+  while (page <= 5) { // cap at 500 repos
+    const url = `${baseUrl}${baseUrl.includes("?") ? "&" : "?"}page=${page}`;
+    const { status, data } = await ghApi("GET", url, token);
+    if (status !== 200 || !Array.isArray(data) || data.length === 0) break;
+    all = all.concat(data);
+    if (data.length < 100) break; // last page
+    page++;
+  }
+  return all;
+}
+
+function pickerRepoFilter(r) {
+  return !r.archived && r.name !== "egregore" && !r.name.endsWith("-memory");
+}
+
+function toPickerRepo(r) {
+  return { name: r.name, language: r.language || "", description: r.description || "" };
+}
+
+// Teams the user belongs to in this org. Big orgs bury a team's repos past
+// the 500-most-recently-updated cap of the org-wide listing, so a team scope
+// is often the only practical way to find them. Non-fatal on error.
+async function listUserTeams(token, org) {
+  try {
+    const teams = await paginateRepos(token, "/user/teams?per_page=100");
+    const orgLc = org.toLowerCase();
+    return teams
+      .filter((t) => t.organization && (t.organization.login || "").toLowerCase() === orgLc)
+      .map((t) => ({ name: t.name, slug: t.slug, reposCount: t.repos_count }));
+  } catch {
+    return [];
+  }
+}
+
+async function listTeamRepos(token, org, teamSlug) {
+  const repos = await paginateRepos(token, `/orgs/${org}/teams/${teamSlug}/repos?per_page=100`);
+  return repos.filter(pickerRepoFilter).map(toPickerRepo);
+}
+
+// Live search across the WHOLE org/account via GitHub's search index —
+// unlike the listing endpoints this isn't bounded to a recency window, so
+// the picker can reach any repo the token can see. Non-fatal on error.
+async function searchOrgRepos(token, owner, isOrg, term) {
+  try {
+    const qualifier = isOrg ? `org:${owner}` : `user:${owner}`;
+    const q = encodeURIComponent(`${qualifier} ${term} in:name archived:false`);
+    const { status, data } = await ghApi("GET", `/search/repositories?q=${q}&per_page=30`, token);
+    if (status !== 200 || !data || !Array.isArray(data.items)) return [];
+    return data.items.filter(pickerRepoFilter).map(toPickerRepo);
+  } catch {
+    return [];
+  }
+}
+
 async function listOrgRepos(token, owner, isOrg) {
   // Fetch all repos (public + private). Paginate to get beyond the first 100.
   //
@@ -214,16 +271,7 @@ async function listOrgRepos(token, owner, isOrg) {
     ? `/orgs/${owner}/repos?per_page=100&sort=updated&type=all`
     : `/user/repos?per_page=100&sort=updated&affiliation=owner`;
 
-  let allRepos = [];
-  let page = 1;
-  while (page <= 5) { // cap at 500 repos
-    const url = `${baseUrl}&page=${page}`;
-    const { status, data } = await ghApi("GET", url, token);
-    if (status !== 200 || !Array.isArray(data) || data.length === 0) break;
-    allRepos = allRepos.concat(data);
-    if (data.length < 100) break; // last page
-    page++;
-  }
+  let allRepos = await paginateRepos(token, baseUrl);
 
   // Personal /user/repos returns repos across all of the user's accounts
   // (their personal namespace + any orgs they're a member of). When the
@@ -233,9 +281,7 @@ async function listOrgRepos(token, owner, isOrg) {
     allRepos = allRepos.filter((r) => r.owner && r.owner.login === owner);
   }
 
-  return allRepos
-    .filter((r) => !r.archived && r.name !== "egregore" && !r.name.endsWith("-memory"))
-    .map((r) => ({ name: r.name, language: r.language || "", description: r.description || "" }));
+  return allRepos.filter(pickerRepoFilter).map(toPickerRepo);
 }
 
 async function addCollaborator(token, owner, repo, username) {
@@ -607,130 +653,218 @@ async function localFounderFlow(ui, ctx = {}) {
   // 2. Get user info
   const user = await getUser(githubToken);
 
-  // 3. Where — we always have a gh token (the only local auth path), which
-  //    carries org read, so we can list the user's accounts and offer a picker.
-  ui.section("Pick a home", "where should this Egregore live?");
-  const s = ui.spinner("Checking your GitHub accounts...");
-  const orgs = await listOrgs(githubToken);
-  s.stop("Accounts loaded");
-
-  let githubOrg, isOrg;
-  if (orgs.length === 0) {
-    githubOrg = user.login;
-    isOrg = false;
-    ui.info(`Using your personal account: ${ui.bold(githubOrg)}`);
-  } else {
-    const orgChoices = [{ label: user.login, description: "Personal account" }];
-    for (const o of orgs) {
-      orgChoices.push({ label: o.login, description: "Organization" });
+  // 3–6. Home → new/existing → naming → repo picker → repo names, as a
+  // step machine so esc walks BACKWARDS through the flow (field request:
+  // a wrong org pick shouldn't mean Ctrl-C and start over). Every answer
+  // lives in `st`, so a revisited step re-offers the previous choice.
+  // Creation (step 7 below) is the point of no return — no back from there.
+  const slugifyName = (s) => (s || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "");
+  const BACK = ui.BACK;
+  const SKIP = Symbol("step-skip"); // deterministic step — passes through in both directions
+
+  const st = {
+    orgs: null,               // fetched once
+    githubOrg: null, isOrg: false,
+    isNewProject: null,
+    orgName: null, description: "", newProjectRepo: null,
+    selectedRepoNames: null,  // raw picker selection (preserved across back)
+    selectedRepos: [],        // enriched {name, base_branch}
+    repoName: null, memoryRepoName: null,
+    reposCache: null,         // {org, repos, teamRepoCount}
+  };
+
+  const stepHome = async () => {
+    if (!st.orgs) {
+      ui.section("Pick a home", "where should this Egregore live?");
+      const s = ui.spinner("Checking your GitHub accounts...");
+      st.orgs = await listOrgs(githubToken);
+      s.stop("Accounts loaded");
+    }
+    if (st.orgs.length === 0) {
+      if (!st.githubOrg) {
+        st.githubOrg = user.login;
+        st.isOrg = false;
+        ui.info(`Using your personal account: ${ui.bold(st.githubOrg)}`);
+      }
+      return SKIP;
     }
     const orgChoice = await ui.choose(
       "Where should Egregore live?",
-      orgChoices,
+      [
+        { label: user.login, description: "Personal account" },
+        ...st.orgs.map((o) => ({ label: o.login, description: "Organization" })),
+      ],
       "Don't see your org? Authorize it for your account on GitHub, then re-run.",
+      { escAction: "back" },
     );
-    githubOrg = orgChoice.label;
-    isOrg = githubOrg !== user.login;
-  }
+    if (orgChoice === BACK) return BACK; // first step — driver clamps to a re-ask
+    st.githubOrg = orgChoice.label;
+    st.isOrg = st.githubOrg !== user.login;
+    return true;
+  };
 
-  // 4. What — new or existing?
-  // If the user came in via the in-repo detection and chose "install
-  // alongside", they already told us they have an existing project — don't
-  // re-ask. Go straight to the existing-project path.
-  let isNewProject;
-  if (ctx.prefilledRepo) {
-    isNewProject = false;
-    ui.info(`${ui.green("→")} existing project — we'll manage ${ui.cyan(ctx.prefilledRepo.localName)} plus any others you pick.`);
-  } else {
+  const stepWorkType = async () => {
+    // In-repo detection already answered this — pass through both ways.
+    if (ctx.prefilledRepo) {
+      if (st.isNewProject === null) {
+        st.isNewProject = false;
+        ui.info(`${ui.green("→")} existing project — we'll manage ${ui.cyan(ctx.prefilledRepo.localName)} plus any others you pick.`);
+      }
+      return SKIP;
+    }
     const action = await ui.choose("What are you working on?", [
       { label: "Starting something new", description: "Create a project from scratch" },
       { label: "Existing project", description: "Connect repos I already have" },
-    ]);
-    isNewProject = action.label.startsWith("Starting");
-  }
-
-  // 5. Collect project info
-  ui.section("Name it", "what's this Egregore called?");
-  let orgName, description, selectedRepos = [], newProjectRepo = null;
-
-  if (isNewProject) {
-    orgName = await ui.prompt("name your Egregore (team or group name)", { default: githubOrg });
-    description = await ui.prompt("what are you building? (one line)");
-
-    // Derive the egregore + memory repo names now so we can validate the
-    // optional project repo name against them before the user commits to it.
-    // Matches the final derivation at line ~395 below.
-    const slugifyRepo = (s) => s.toLowerCase()
-      .replace(/[^a-z0-9-]/g, "-")
-      .replace(/-+/g, "-")
-      .replace(/^-|-$/g, "") || "egregore";
-    const predictedRepoName = slugifyRepo(orgName);
-    const predictedMemoryRepoName = `${predictedRepoName}-memory`;
-
-    // Ask about project repo
-    ui.note([
-      "Your Egregore gets its own repo (memory + config) in your account.",
-      "Have a code project too? Egregore can add a repo for it in your account.",
-    ]);
+    ], undefined, { escAction: "back" });
+    if (action === BACK) return BACK;
+    st.isNewProject = action.label.startsWith("Starting");
+    return true;
+  };
 
-    while (true) {
-      const projectName = await ui.prompt("code project repo name (Enter to skip)");
-      if (!projectName) {
-        newProjectRepo = null;
+  const stepNameProject = async () => {
+    ui.section("Name it", "what's this Egregore called?");
+    if (st.isNewProject) {
+      const name = await ui.promptOrBack("name your Egregore (team or group name)", { default: st.orgName || st.githubOrg });
+      if (name === BACK) return BACK;
+      st.orgName = name;
+      const desc = await ui.promptOrBack("what are you building? (one line)", { default: st.description || undefined });
+      if (desc === BACK) return BACK;
+      st.description = desc;
+
+      // Validate the optional project repo name against the names the
+      // Egregore/memory repos WILL get (editable later, derived for now).
+      const predictedRepoName = slugifyName(st.orgName) || "egregore";
+      const predictedMemoryRepoName = `${predictedRepoName}-memory`;
+      ui.note([
+        "Your Egregore gets its own repo (memory + config) in your account.",
+        "Have a code project too? Egregore can add a repo for it in your account.",
+      ]);
+      for (;;) {
+        const projectName = await ui.promptOrBack("code project repo name (Enter to skip)", { default: st.newProjectRepo || undefined });
+        if (projectName === BACK) return BACK;
+        if (!projectName) { st.newProjectRepo = null; break; }
+        const slug = slugifyName(projectName);
+        if (!slug) {
+          ui.warn("That doesn't produce a valid repo name. Try letters, numbers, and dashes.");
+          continue;
+        }
+        if (slug === predictedRepoName) {
+          ui.warn(`"${slug}" is already the name of your Egregore repo. Pick a different name.`);
+          ui.info(`  ${ui.dim("suggestion:")} ${ui.cyan(`${slug}-app`)}`);
+          continue;
+        }
+        if (slug === predictedMemoryRepoName) {
+          ui.warn(`"${slug}" collides with your memory repo. Pick a different name.`);
+          continue;
+        }
+        st.newProjectRepo = slug;
         break;
       }
-      const slug = slugifyRepo(projectName);
-      if (!slug) {
-        ui.warn("That doesn't produce a valid repo name. Try letters, numbers, and dashes.");
-        continue;
-      }
-      if (slug === predictedRepoName) {
-        ui.warn(`"${slug}" is already the name of your Egregore repo. Pick a different name.`);
-        ui.info(`  ${ui.dim("suggestion:")} ${ui.cyan(`${slug}-app`)}`);
-        continue;
-      }
-      if (slug === predictedMemoryRepoName) {
-        ui.warn(`"${slug}" collides with your memory repo. Pick a different name.`);
-        continue;
-      }
-      newProjectRepo = slug;
-      break;
+    } else {
+      const name = await ui.promptOrBack("what should we call this Egregore?", { default: st.orgName || st.githubOrg });
+      if (name === BACK) return BACK;
+      st.orgName = name;
+      st.description = "";
+      st.newProjectRepo = null;
     }
-  } else {
-    // "Existing project"
-    orgName = await ui.prompt("what should we call this Egregore?", { default: githubOrg });
-    description = "";
+    return true;
+  };
 
+  const stepRepos = async () => {
+    if (st.isNewProject) {
+      st.selectedRepoNames = null;
+      st.selectedRepos = [];
+      return SKIP;
+    }
     // Auto-adopt the user's current repo if it's under the chosen GitHub owner.
     const autoAdopt =
       ctx.prefilledRepo &&
       ctx.prefilledRepo.owner &&
-      ctx.prefilledRepo.owner.toLowerCase() === githubOrg.toLowerCase()
+      ctx.prefilledRepo.owner.toLowerCase() === st.githubOrg.toLowerCase()
         ? ctx.prefilledRepo.name
         : null;
 
-    // Multi-select repos to manage
-    const s0 = ui.spinner("Loading repos...");
-    try {
-      const repos = await listOrgRepos(githubToken, githubOrg, isOrg);
-      s0.stop("Loaded repos");
-      if (repos.length > 0) {
-        const filtered = autoAdopt ? repos.filter((r) => r.name !== autoAdopt) : repos;
-        if (autoAdopt) {
-          console.log("");
-          ui.info(`${ui.cyan(autoAdopt)} will be managed automatically (your current repo)`);
+    // Multi-select repos to manage. The org-wide listing is capped at the
+    // 500 most recently updated repos, which buries a team's repos in a big
+    // org — so the user's team repos are loaded too and boosted to the top,
+    // and typing in the picker live-searches the WHOLE org (see
+    // searchOrgRepos), so no repo is unreachable. The load is cached per
+    // owner so back-navigation doesn't refetch.
+    if (!st.reposCache || st.reposCache.org !== st.githubOrg) {
+      const s0 = ui.spinner("Loading repos...");
+      const repos = [];
+      let teamRepoCount = 0;
+      try {
+        const [orgRepos, teams] = await Promise.all([
+          listOrgRepos(githubToken, st.githubOrg, st.isOrg),
+          st.isOrg ? listUserTeams(githubToken, st.githubOrg) : Promise.resolve([]),
+        ]);
+        const teamRepoLists = await Promise.all(
+          teams.map((t) => listTeamRepos(githubToken, st.githubOrg, t.slug).catch(() => [])),
+        );
+        const seen = new Set();
+        for (const list of teamRepoLists) {
+          for (const r of list) {
+            if (seen.has(r.name)) continue;
+            seen.add(r.name);
+            repos.push(r);
+          }
+        }
+        teamRepoCount = repos.length;
+        for (const r of orgRepos) {
+          if (seen.has(r.name)) continue;
+          seen.add(r.name);
+          repos.push(r);
+        }
+        s0.stop(teamRepoCount > 0 ? `Loaded repos — your teams' ${teamRepoCount} first` : "Loaded repos");
+      } catch {
+        s0.stop("Could not load repos");
+      }
+      st.reposCache = { org: st.githubOrg, repos, teamRepoCount };
+    }
+    const repos = st.reposCache.repos;
+
+    const filtered = autoAdopt ? repos.filter((r) => r.name !== autoAdopt) : repos;
+    if (autoAdopt) {
+      console.log("");
+      ui.info(`${ui.cyan(autoAdopt)} will be managed automatically (your current repo)`);
+    }
+    const picked = await ui.multiSelect(
+      "Which other repos should Egregore manage?",
+      filtered,
+      {
+        remoteSearch: (term) => searchOrgRepos(githubToken, st.githubOrg, st.isOrg, term),
+        preselected: st.selectedRepoNames || [],
+        escAction: "back",
+      },
+    );
+    if (picked === BACK) return BACK;
+    let selectedRepos = picked;
+
+    // Non-interactive terminals get no live search — keep a typed-names
+    // escape hatch there, validated so a typo doesn't become a ghost repo.
+    if (!(ui.canInteract && ui.canInteract())) {
+      const extraRaw = await ui.prompt("any repos not listed? exact names, comma-separated (Enter to skip)");
+      for (const raw of (extraRaw || "").split(",")) {
+        const name = raw.trim();
+        if (!name || selectedRepos.includes(name)) continue;
+        if (await repoExists(githubToken, st.githubOrg, name)) {
+          selectedRepos.push(name);
+          ui.success(`Added ${name}`);
+        } else {
+          ui.warn(`No repo ${st.githubOrg}/${name} — skipping`);
         }
-        selectedRepos = await ui.multiSelect("Which other repos should Egregore manage?", filtered);
-      } else {
-        ui.info("No repos found yet.");
       }
-    } catch {
-      s0.stop("Could not load repos");
     }
     if (autoAdopt && !selectedRepos.includes(autoAdopt)) {
       selectedRepos.unshift(autoAdopt);
     }
     if (autoAdopt) skipRepos.add(autoAdopt);
+    st.selectedRepoNames = [...selectedRepos];
 
     // Detect default branch for each selected repo and convert to {name, base_branch} format
     if (selectedRepos.length > 0) {
@@ -738,14 +872,13 @@ async function localFounderFlow(ui, ctx = {}) {
       const reposWithBranch = [];
       for (const repoName of selectedRepos) {
         try {
-          const info = await detectRepoBranches(githubToken, githubOrg, repoName);
+          const info = await detectRepoBranches(githubToken, st.githubOrg, repoName);
           reposWithBranch.push({ name: repoName, base_branch: info ? info.defaultBranch : "main" });
         } catch {
           reposWithBranch.push({ name: repoName, base_branch: "main" });
         }
       }
       s0b.stop("Checked branches");
-      // Replace flat list with enriched objects
       selectedRepos = reposWithBranch;
       console.log("");
       ui.info("Detected branch setup:");
@@ -754,19 +887,76 @@ async function localFounderFlow(ui, ctx = {}) {
       }
       console.log("");
     }
+    st.selectedRepos = selectedRepos;
+    return true;
+  };
+
+  const stepRepoNames = async () => {
+    // Derived names shown as editable prompts — creating repos with silently
+    // derived names was a repeated field complaint.
+    const derivedSlug = slugifyName(st.orgName) || "egregore";
+    console.log("");
+    ui.note([
+      `Two repos will be created in ${ui.bold(st.githubOrg)}: the Egregore repo`,
+      "(config + skills) and its shared-memory repo. Enter keeps the defaults.",
+    ]);
+    for (;;) {
+      const answer = await ui.promptOrBack("Egregore repo name", { default: st.repoName || derivedSlug });
+      if (answer === BACK) return BACK;
+      const candidate = slugifyName(answer);
+      if (!candidate) { ui.warn("That doesn't produce a valid repo name. Try letters, numbers, and dashes."); continue; }
+      if (st.newProjectRepo && candidate === st.newProjectRepo) { ui.warn(`"${candidate}" is already your project repo. Pick a different name.`); continue; }
+      st.repoName = candidate;
+      break;
+    }
+    for (;;) {
+      const answer = await ui.promptOrBack("memory repo name", { default: st.memoryRepoName || `${st.repoName}-memory` });
+      if (answer === BACK) return BACK;
+      const candidate = slugifyName(answer);
+      if (!candidate) { ui.warn("That doesn't produce a valid repo name. Try letters, numbers, and dashes."); continue; }
+      if (candidate === st.repoName) { ui.warn("Memory repo can't share the Egregore repo's name."); continue; }
+      if (st.newProjectRepo && candidate === st.newProjectRepo) { ui.warn(`"${candidate}" is already your project repo. Pick a different name.`); continue; }
+      st.memoryRepoName = candidate;
+      break;
+    }
+    return true;
+  };
+
+  // Direction-aware driver: BACK rewinds one step; SKIP (deterministic
+  // steps) passes through in whichever direction we're moving, so backing
+  // over an auto-answered step doesn't bounce the user forward again.
+  const steps = [stepHome, stepWorkType, stepNameProject, stepRepos, stepRepoNames];
+  let stepIdx = 0;
+  let stepDir = 1;
+  while (stepIdx < steps.length) {
+    const result = await steps[stepIdx]();
+    if (result === BACK) {
+      stepDir = -1;
+      stepIdx = Math.max(0, stepIdx - 1);
+      continue;
+    }
+    if (result === SKIP) {
+      stepIdx += stepDir;
+      if (stepIdx < 0) { stepIdx = 0; stepDir = 1; }
+      continue;
+    }
+    stepDir = 1;
+    stepIdx++;
   }
 
-  // 6. Derive repo names from team name
-  const nameSlug = orgName
-    .toLowerCase()
-    .replace(/[^a-z0-9-]/g, "-")
-    .replace(/-+/g, "-")
-    .replace(/^-|-$/g, "") || "egregore";
+  const githubOrg = st.githubOrg;
+  const isOrg = st.isOrg;
+  const isNewProject = st.isNewProject;
+  const orgName = st.orgName;
+  const description = st.description;
+  let newProjectRepo = st.newProjectRepo;
+  let selectedRepos = st.selectedRepos;
+  const repoName = st.repoName;
+  const memoryRepoName = st.memoryRepoName;
+  const nameSlug = slugifyName(orgName) || "egregore";
   // Org slug prefixed with GitHub owner — globally unique across all egregores
-  const ghPrefix = githubOrg.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const ghPrefix = slugifyName(githubOrg);
   const slug = ghPrefix === nameSlug ? nameSlug : `${ghPrefix}-${nameSlug}`;
-  const repoName = nameSlug;
-  const memoryRepoName = `${nameSlug}-memory`;
 
   // Guard: if egregore repo already exists with a config, don't overwrite
   console.log("");
@@ -1169,7 +1359,11 @@ async function localFounderFlow(ui, ctx = {}) {
         ...pickable.map((m) => ({ label: m.login, description: `@${githubOrg} member` })),
         { label: "Type a username", description: "invite someone not in the list" },
       ];
-      const picked = await ui.choose(first ? "who should we invite?" : "invite someone else?", choices);
+      const picked = await ui.choose(
+        first ? "who should we invite?" : "invite someone else?",
+        choices,
+        first ? "Inviting is optional — the first option skips this step." : undefined,
+      );
       if (picked.label === stopChoice.label) break;
       if (picked.label === "Type a username") {
         invUsername = await ui.prompt("GitHub username");

package/lib/ui.js

@@ -226,6 +226,60 @@ function prompt(question, { default: defaultValue } = {}) {
   });
 }
 
+// Line input that can step backwards: esc resolves BACK, enter resolves the
+// typed value (or the default). Raw-mode single-line editor — append +
+// backspace only, which covers the short names these prompts collect.
+// Falls back to the plain readline prompt when not interactive.
+function promptOrBack(question, { default: defaultValue } = {}) {
+  if (!canInteract()) return prompt(question, { default: defaultValue });
+  return new Promise((resolve) => {
+    let buf = "";
+    const label = defaultValue
+      ? `  ${CYAN}?${RESET} ${question} ${DIM}[${defaultValue}]${RESET} ${DIM}(esc back)${RESET} `
+      : `  ${CYAN}?${RESET} ${question} ${DIM}(esc back)${RESET} `;
+    const render = () => process.stdout.write(`\r\x1b[2K${label}${buf}`);
+    const cleanup = () => {
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdin.removeListener("keypress", onKey);
+    };
+    const onKey = (_str, key) => {
+      if (!key) return;
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        process.stdout.write(`\n  ${DIM}(cancelled)${RESET}\n`);
+        process.exit(130);
+      }
+      if (key.name === "escape") {
+        cleanup();
+        process.stdout.write(`\r\x1b[2K${label}${DIM}← back${RESET}\n`);
+        resolve(BACK);
+        return;
+      }
+      if (key.name === "return") {
+        cleanup();
+        process.stdout.write("\n");
+        resolve(buf.trim() || (defaultValue ?? ""));
+        return;
+      }
+      if (key.name === "backspace") {
+        buf = buf.slice(0, -1);
+        render();
+        return;
+      }
+      if (_str && _str.length === 1 && !key.ctrl && !key.meta && _str.charCodeAt(0) >= 32) {
+        buf += _str;
+        render();
+      }
+    };
+    readline.emitKeypressEvents(process.stdin);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on("keypress", onKey);
+    render();
+  });
+}
+
 async function confirm(question, defaultYes = false) {
   const hint = defaultYes ? `${DIM}[Y/n]${RESET}` : `${DIM}[y/N]${RESET}`;
   const answer = await prompt(`${question} ${hint}`);
@@ -254,12 +308,37 @@ function visualRows(line, width = process.stdout.columns || 80) {
 
 // Render a picker frame and return { lines: number } so the next frame can
 // rewind and clear. Shared by choose + multiSelect.
-function renderPicker({ question, filterText, lines, help }) {
+//
+// `input` makes the type-to-search field a first-class affordance: the
+// labelled input renders on the question line even when empty, and the REAL
+// terminal cursor is parked right after the typed text so it blinks where
+// keystrokes land — users shouldn't have to discover typing by accident.
+let _parkedRows = 0;
+
+function unparkCursor() {
+  if (_parkedRows > 0) {
+    process.stdout.write(`\x1b[${_parkedRows}B\r`);
+    _parkedRows = 0;
+  }
+}
+
+function renderPicker({ question, filterText, lines, help, input }) {
   const out = [];
-  const filterLabel = filterText
-    ? `  ${DIM}filter:${RESET} ${filterText}${CYAN}▌${RESET}`
-    : "";
-  out.push(`  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}${filterLabel ? "   " + filterLabel : ""}`);
+  const width = process.stdout.columns || 80;
+  const label = (input && input.label) || "filter";
+  const showInput = !!input || !!filterText;
+
+  // Bare header (no ANSI, no cursor glyph) drives the park-position math.
+  const headerPlain = `  ◆ ${question}   ${label}: ${filterText}`;
+  // Park only when the header fits one row — wrapped rows break the math.
+  const canPark = showInput && visualRows(headerPlain, width) === 1 && headerPlain.length + 1 < width;
+
+  if (showInput) {
+    const glyph = canPark ? "" : `${CYAN}▌${RESET}`;
+    out.push(`  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}   ${DIM}${label}:${RESET} ${filterText}${glyph}`);
+  } else {
+    out.push(`  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}`);
+  }
   out.push("");
   for (const line of lines) out.push(line);
   if (help) {
@@ -268,11 +347,17 @@ function renderPicker({ question, filterText, lines, help }) {
   }
   const text = out.join("\n") + "\n";
   process.stdout.write(text);
-  const width = process.stdout.columns || 80;
-  return out.reduce((sum, line) => sum + visualRows(line, width), 0);
+  const rows = out.reduce((sum, line) => sum + visualRows(line, width), 0);
+  _parkedRows = 0;
+  if (canPark) {
+    process.stdout.write(`\x1b[${rows}A\x1b[${headerPlain.length + 1}G`);
+    _parkedRows = rows;
+  }
+  return rows;
 }
 
 function clearLines(n) {
+  unparkCursor();
   if (n <= 0) return;
   // Move up n lines and clear from cursor to end of screen.
   process.stdout.write(`\x1b[${n}A\x1b[0J`);
@@ -289,24 +374,33 @@ function filterOptions(options, filterText, getText) {
   return result;
 }
 
+// ── back navigation ─────────────────────────────────────────────────
+//
+// Multi-step flows (the founder setup) let the user step backwards with
+// esc. Pickers and prompts opt in via `escAction: "back"` — esc then
+// resolves to the BACK sentinel instead of aborting the process, and the
+// caller's step machine rewinds. Ctrl-C always remains the hard abort.
+const BACK = Symbol.for("egregore.ui.back");
+
 // ── choose: interactive single-select picker ────────────────────────
 //
 // options: [{ label, description }]
-// returns: the picked option (same object reference as in options[])
+// returns: the picked option (same object reference as in options[]),
+//          or BACK when opts.escAction === "back" and the user pressed esc
 // keys:
 //   ↑ ↓       navigate
 //   enter     select
 //   type      filter (case-insensitive substring match on label + desc)
 //   backspace pop filter
-//   esc       cancel (returns the first option, or throws if opts.abortOnEsc)
+//   esc       cancel — or go back with opts.escAction: "back"
 //   ctrl-c    abort process
 
-async function choose(question, options, hint) {
-  if (!canInteract()) return legacyChoose(question, options, hint);
-  return interactiveChoose(question, options, hint);
+async function choose(question, options, hint, opts = {}) {
+  if (!canInteract()) return legacyChoose(question, options, hint, opts);
+  return interactiveChoose(question, options, hint, opts);
 }
 
-async function interactiveChoose(question, options, hint) {
+async function interactiveChoose(question, options, hint, opts = {}) {
   return new Promise((resolve) => {
     let filterText = "";
     let visible = filterOptions(options, filterText, (o) => `${o.label} ${o.description || ""}`);
@@ -363,12 +457,13 @@ async function interactiveChoose(question, options, hint) {
         for (let i = start; i < end; i++) lines.push(renderRow(visible[i], i));
         if (end < total) lines.push(`    ${DIM}↓ ${total - end} more · type to filter${RESET}`);
       }
+      const escHint = opts.escAction === "back" ? `${DIM}esc${RESET} back` : `${DIM}esc${RESET} cancel`;
       if (!first) clearLines(lastLineCount);
       lastLineCount = renderPicker({
         question,
         filterText,
         lines,
-        help: hint || `${DIM}↑↓${RESET} navigate · ${DIM}enter${RESET} select · type to filter · ${DIM}esc${RESET} cancel`,
+        help: hint || `${DIM}↑↓${RESET} navigate · ${DIM}enter${RESET} select · type to filter · ${escHint}`,
       });
     };
 
@@ -385,10 +480,31 @@ async function interactiveChoose(question, options, hint) {
       resolve(value);
     };
 
+    const goBack = () => {
+      cleanup();
+      clearLines(lastLineCount);
+      process.stdout.write(`  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}  ${DIM}→ ← back${RESET}\n`);
+      resolve(BACK);
+    };
+
     const onKey = (_str, key) => {
       if (!key) return;
+      if (key.name === "escape" && filterText) {
+        // fzf convention: first esc clears an active filter; only a clean
+        // state goes back / cancels.
+        filterText = "";
+        visible = filterOptions(options, filterText, (o) => `${o.label} ${o.description || ""}`);
+        cursor = firstEnabled();
+        render();
+        return;
+      }
+      if (key.name === "escape" && opts.escAction === "back") {
+        goBack();
+        return;
+      }
       if ((key.ctrl && key.name === "c") || key.name === "escape") {
         cleanup();
+        unparkCursor();
         process.stdout.write(`\n  ${DIM}(cancelled)${RESET}\n`);
         process.exit(130);
       }
@@ -430,7 +546,7 @@ async function interactiveChoose(question, options, hint) {
   });
 }
 
-async function legacyChoose(question, options, hint) {
+async function legacyChoose(question, options, hint, opts = {}) {
   process.stdout.write(`\n  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}\n\n`);
   const labelWidth = Math.min(40, Math.max(...options.map((o) => o.label.length)));
   for (let i = 0; i < options.length; i++) {
@@ -441,8 +557,10 @@ async function legacyChoose(question, options, hint) {
     process.stdout.write(`    ${DIM}${num})${RESET} ${BOLD}${paddedLabel}${RESET}${desc}\n`);
   }
   if (hint) process.stdout.write(`\n  ${DIM}${hint}${RESET}\n`);
+  if (opts.escAction === "back") process.stdout.write(`  ${DIM}type "back" to go back${RESET}\n`);
   while (true) {
     const answer = await prompt(`pick ${DIM}[1-${options.length}]${RESET}:`);
+    if (opts.escAction === "back" && /^(b|back)$/i.test(answer)) return BACK;
     if (!answer) { warn(`Enter a number between 1 and ${options.length}.`); continue; }
     const n = parseInt(answer, 10);
     if (n >= 1 && n <= options.length) {
@@ -461,58 +579,146 @@ async function legacyChoose(question, options, hint) {
 // ── multiSelect: interactive multi-select picker ────────────────────
 //
 // options: [{ name, language?, description? }]
+// opts.remoteSearch: async (term) => [{ name, language?, description? }]
+//   Hybrid search source: typing filters the local pool instantly AND
+//   (debounced) queries the remote source, merging new results into the
+//   pool. Lets a picker seeded with a bounded window (e.g. the 500 most
+//   recently updated repos of a huge org) reach everything the API can
+//   search — no pagination, no separate "type the exact name" prompt.
 // returns: array of picked names
 // keys:
 //   ↑ ↓       navigate
 //   space     toggle current
-//   a         toggle all (respecting filter)
+//   ctrl-a    toggle all (respecting filter)
 //   enter     confirm
 //   type      filter
 //   esc       confirm with current selection
 
-async function multiSelect(question, options) {
-  if (options.length === 0) return [];
-  if (!canInteract()) return legacyMultiSelect(question, options);
-  return interactiveMultiSelect(question, options);
+async function multiSelect(question, options, opts = {}) {
+  // Remote search can populate an empty pool, but only interactively —
+  // the legacy numbered fallback has no live search.
+  if (!canInteract()) return options.length === 0 ? [] : legacyMultiSelect(question, options);
+  if (options.length === 0 && !opts.remoteSearch) return [];
+  return interactiveMultiSelect(question, options, opts);
 }
 
-async function interactiveMultiSelect(question, options) {
+const MULTISELECT_MAX_ROWS = 12;
+const REMOTE_SEARCH_DEBOUNCE_MS = 300;
+
+async function interactiveMultiSelect(question, options, opts = {}) {
   return new Promise((resolve) => {
     let cursor = 0;
     let filterText = "";
-    const picked = new Set();
-    let visible = filterOptions(options, filterText, (o) => `${o.name} ${o.description || ""} ${o.language || ""}`);
+    // opts.preselected re-arms a previous selection — used when the step
+    // machine navigates back to the picker so choices aren't lost.
+    const picked = new Set((opts.preselected || []).filter((n) => options.some((o) => o.name === n)));
+    // The pool grows as remote results merge in; seed order is preserved so
+    // boosted entries (e.g. the user's team repos) stay on top when idle.
+    const pool = [...options];
+    const poolNames = new Set(pool.map((o) => o.name));
+    const optText = (o) => `${o.name} ${o.description || ""} ${o.language || ""}`;
+    let visible = filterOptions(pool, filterText, optText);
     let lastLineCount = 0;
+    let searchTimer = null;
+    let searching = false;
 
-    const nameWidth = Math.min(36, Math.max(...options.map((o) => (o.name || "").length)));
+    const nameWidth = () =>
+      Math.min(36, Math.max(12, ...pool.map((o) => (o.name || "").length)));
 
     const render = (first = false) => {
-      const lines = visible.map((entry, i) => {
+      const w = nameWidth();
+      const renderRow = (entry, i) => {
         const { opt } = entry;
         const isCursor = i === cursor;
         const isPicked = picked.has(opt.name);
         const cursorMark = isCursor ? `${CYAN}❯${RESET}` : " ";
         const checkbox = isPicked ? `${GREEN}[✓]${RESET}` : `${DIM}[ ]${RESET}`;
-        const name = isCursor ? `${BOLD}${CYAN}${pad(opt.name, nameWidth)}${RESET}` : pad(opt.name, nameWidth);
+        const name = isCursor ? `${BOLD}${CYAN}${pad(opt.name, w)}${RESET}` : pad(opt.name, w);
         const lang = opt.language ? `  ${DIM}(${opt.language})${RESET}` : "";
         const desc = opt.description ? `  ${DIM}${opt.description}${RESET}` : "";
         return `    ${cursorMark}  ${checkbox}  ${name}${lang}${desc}`;
-      });
-      if (visible.length === 0) {
-        lines.push(`    ${DIM}(no matches)${RESET}`);
+      };
+
+      // Bounded viewport that follows the cursor — a huge org must not dump
+      // hundreds of rows into the terminal. "↑/↓ N more" mark the remainder.
+      const lines = [];
+      const total = visible.length;
+      let start = 0;
+      if (total > MULTISELECT_MAX_ROWS) {
+        start = Math.min(
+          Math.max(0, cursor - Math.floor(MULTISELECT_MAX_ROWS / 2)),
+          total - MULTISELECT_MAX_ROWS,
+        );
+      }
+      const end = Math.min(total, start + MULTISELECT_MAX_ROWS);
+      if (start > 0) lines.push(`    ${DIM}↑ ${start} more${RESET}`);
+      for (let i = start; i < end; i++) lines.push(renderRow(visible[i], i));
+      if (end < total) lines.push(`    ${DIM}↓ ${total - end} more${RESET}`);
+      if (total === 0) {
+        lines.push(searching ? `    ${DIM}searching…${RESET}` : `    ${DIM}(no matches)${RESET}`);
       }
+
       lines.push("");
-      lines.push(`    ${DIM}${picked.size} selected${RESET}`);
+      // Selected tray: picked names stay visible even when the current
+      // filter hides their rows — a selection must never look lost.
+      if (picked.size > 0) {
+        const names = [...picked].join(", ");
+        const maxW = Math.max(20, (process.stdout.columns || 80) - 20);
+        const shown = names.length > maxW ? names.slice(0, maxW - 1) + "…" : names;
+        lines.push(`    ${GREEN}✓${RESET} ${DIM}selected (${picked.size}):${RESET} ${shown}`);
+      } else {
+        lines.push(`    ${DIM}0 selected${RESET}`);
+      }
+      if (searching && total > 0) lines.push(`    ${DIM}searching…${RESET}`);
+
+      const searchHint = opts.remoteSearch ? "type to search" : "type to filter";
+      const escHint = opts.escAction === "back" ? ` · ${DIM}esc${RESET} back` : "";
       if (!first) clearLines(lastLineCount);
       lastLineCount = renderPicker({
         question,
         filterText,
         lines,
-        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}a${RESET} all · ${DIM}enter${RESET} confirm · type to filter`,
+        input: { label: opts.remoteSearch ? "search" : "filter" },
+        help: `${DIM}↑↓${RESET} nav · ${DIM}space${RESET} toggle · ${DIM}ctrl-a${RESET} all · ${DIM}enter${RESET} confirm · ${searchHint}${escHint}`,
       });
     };
 
+    const refreshVisible = () => {
+      visible = filterOptions(pool, filterText, optText);
+      if (cursor >= visible.length) cursor = Math.max(0, visible.length - 1);
+    };
+
+    // Debounced remote search: merge results into the pool, ignore stale
+    // responses (the term changed while the request was in flight).
+    const scheduleRemoteSearch = () => {
+      if (!opts.remoteSearch) return;
+      if (searchTimer) clearTimeout(searchTimer);
+      const term = filterText.trim();
+      if (term.length < 2) { searching = false; return; }
+      searching = true;
+      searchTimer = setTimeout(() => {
+        Promise.resolve(opts.remoteSearch(term))
+          .then((results) => {
+            if (filterText.trim() !== term) return; // stale
+            for (const r of results || []) {
+              if (!r || !r.name || poolNames.has(r.name)) continue;
+              poolNames.add(r.name);
+              pool.push(r);
+            }
+            searching = false;
+            refreshVisible();
+            render();
+          })
+          .catch(() => {
+            if (filterText.trim() !== term) return;
+            searching = false; // network hiccup — local filter still works
+            render();
+          });
+      }, REMOTE_SEARCH_DEBOUNCE_MS);
+    };
+
     const cleanup = () => {
+      if (searchTimer) clearTimeout(searchTimer);
       process.stdin.setRawMode(false);
       process.stdin.pause();
       process.stdin.removeListener("keypress", onKey);
@@ -544,8 +750,24 @@ async function interactiveMultiSelect(question, options) {
 
     const onKey = (_str, key) => {
       if (!key) return;
+      if (key.name === "escape" && filterText) {
+        filterText = "";
+        refreshVisible();
+        cursor = 0;
+        searching = false;
+        render();
+        return;
+      }
+      if (key.name === "escape" && opts.escAction === "back") {
+        cleanup();
+        clearLines(lastLineCount);
+        process.stdout.write(`  ${CYAN}◆${RESET} ${BOLD}${question}${RESET}  ${DIM}→ ← back${RESET}\n`);
+        resolve(BACK);
+        return;
+      }
       if ((key.ctrl && key.name === "c") || key.name === "escape") {
         cleanup();
+        unparkCursor();
         process.stdout.write(`\n  ${DIM}(cancelled)${RESET}\n`);
         process.exit(130);
       }
@@ -565,22 +787,27 @@ async function interactiveMultiSelect(question, options) {
         render();
         return;
       }
-      if (_str === "a" && !filterText) {
+      // ctrl-a, not bare "a": with live type-to-search, a bare letter must
+      // always go to the filter — typing "alpha-api" on an empty filter used
+      // to toggle-all on the first keystroke.
+      if (key.ctrl && key.name === "a") {
         toggleAll();
         render();
         return;
       }
       if (key.name === "backspace") {
         filterText = filterText.slice(0, -1);
-        visible = filterOptions(options, filterText, (o) => `${o.name} ${o.description || ""} ${o.language || ""}`);
+        refreshVisible();
         cursor = 0;
+        scheduleRemoteSearch();
         render();
         return;
       }
       if (_str && _str.length === 1 && !key.ctrl && !key.meta && _str.charCodeAt(0) >= 32) {
         filterText += _str;
-        visible = filterOptions(options, filterText, (o) => `${o.name} ${o.description || ""} ${o.language || ""}`);
+        refreshVisible();
         cursor = 0;
+        scheduleRemoteSearch();
         render();
       }
     };
@@ -886,7 +1113,7 @@ module.exports = {
   banner, bannerCompact, section, note, card,
   info, success, warn, error, step,
   dim, bold, cyan, green, yellow, red,
-  spinner, prompt, choose, multiSelect, confirm,
+  spinner, prompt, promptOrBack, choose, multiSelect, confirm, canInteract, BACK,
   commandBox,
   canShowScreens, welcomeScreen, summaryScreen,
   _renderWelcomeBody, _readPkgVersion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.18.16",
+  "version": "0.18.18",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "build:runtime": "node scripts/build-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/bin/lib/identity.sh

@@ -162,3 +162,13 @@ PROJ_HASH=$(echo -n "$SCRIPT_DIR" | md5 2>/dev/null || echo -n "$SCRIPT_DIR" | m
 echo "$EGREGORE_SESSION_ID" > "$SESSION_ID_DIR/session-${PROJ_HASH}.id"
 # Also write project-local file (CLAUDE.md reads this — no glob needed)
 echo "$EGREGORE_SESSION_ID" > "$SCRIPT_DIR/.egregore-session-id"
+
+# Model stamp hashes the git common-dir root because telemetry.sh resolves it that way.
+MODEL_REPO_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --path-format=absolute --git-common-dir 2>/dev/null | sed 's|/\.git$||') || MODEL_REPO_ROOT="$SCRIPT_DIR"
+MODEL_PROJ_HASH=$(echo -n "$MODEL_REPO_ROOT" | md5 2>/dev/null || echo -n "$MODEL_REPO_ROOT" | md5sum 2>/dev/null | cut -d' ' -f1)
+MODEL_STAMP_FILE="$SESSION_ID_DIR/session-model-${MODEL_PROJ_HASH}"
+if [ -n "${CLAUDE_MODEL:-}" ]; then
+  echo "$CLAUDE_MODEL" > "$MODEL_STAMP_FILE"
+else
+  rm -f "$MODEL_STAMP_FILE"
+fi

package/runtime/codex/bin/telemetry.sh

@@ -98,6 +98,13 @@ _resolve_org() {
   fi
 }
 
+_resolve_proj_hash() {
+  # Use git common dir so worktrees hash to the same path as the main checkout
+  local repo_root
+  repo_root=$(git -C "$SCRIPT_DIR" rev-parse --path-format=absolute --git-common-dir 2>/dev/null | sed 's|/\.git$||') || repo_root="$SCRIPT_DIR"
+  echo -n "$repo_root" | md5 2>/dev/null || echo -n "$repo_root" | md5sum 2>/dev/null | cut -d' ' -f1
+}
+
 _resolve_session_id() {
   if [ -n "${EGREGORE_SESSION_ID:-}" ]; then
     echo "$EGREGORE_SESSION_ID"
@@ -106,11 +113,8 @@ _resolve_session_id() {
 
   # Fallback: read from file written by session-start.sh
   # (env vars from hooks don't propagate into the Claude Code agent)
-  # Use git common dir so worktrees hash to the same path as the main checkout
-  local repo_root
-  repo_root=$(git -C "$SCRIPT_DIR" rev-parse --path-format=absolute --git-common-dir 2>/dev/null | sed 's|/\.git$||') || repo_root="$SCRIPT_DIR"
   local proj_hash
-  proj_hash=$(echo -n "$repo_root" | md5 2>/dev/null || echo -n "$repo_root" | md5sum 2>/dev/null | cut -d' ' -f1)
+  proj_hash=$(_resolve_proj_hash)
   local sid_file="$HOME/.egregore/session-${proj_hash}.id"
   if [ -f "$sid_file" ]; then
     cat "$sid_file" 2>/dev/null || echo "unknown"
@@ -119,6 +123,45 @@ _resolve_session_id() {
   fi
 }
 
+_resolve_model() {
+  local proj_hash
+  proj_hash=$(_resolve_proj_hash)
+  local model_file="$HOME/.egregore/session-model-${proj_hash}"
+  if [ ! -s "$model_file" ]; then
+    return 0
+  fi
+
+  local model=""
+  IFS= read -r model < "$model_file" || true
+  if [ -n "$model" ]; then
+    printf '%s\n' "$model"
+  fi
+}
+
+_stamp_model_if_absent() {
+  local compact_data="$1"
+  local has_model=""
+  has_model=$(printf '%s' "$compact_data" | jq -e 'has("model")' 2>/dev/null || true)
+  if [ "$has_model" != "false" ]; then
+    printf '%s' "$compact_data"
+    return 0
+  fi
+
+  local model=""
+  model=$(_resolve_model 2>/dev/null || true)
+  if [ -z "$model" ]; then
+    printf '%s' "$compact_data"
+    return 0
+  fi
+
+  local stamped_data=""
+  if stamped_data=$(printf '%s' "$compact_data" | jq -c --arg m "$model" 'if has("model") then . else . + {model:$m} end' 2>/dev/null); then
+    printf '%s' "$stamped_data"
+  else
+    printf '%s' "$compact_data"
+  fi
+}
+
 # --- emit: append event to local JSONL buffer ---
 cmd_emit() {
   local event_type="${1:?Usage: telemetry.sh emit <type> <json>}"
@@ -129,12 +172,15 @@ cmd_emit() {
     return 0
   fi
 
+  local ts
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  # Compact data to single line — callers may pass pretty-printed JSON
+  local compact_data
+  compact_data=$(printf '%s' "$data" | tr -d '\n' | tr -s ' ')
+  compact_data=$(_stamp_model_if_absent "$compact_data")
+
   # Debug mode: print to stderr instead of writing
   if _is_debug; then
-    local ts
-    ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-    local compact_data
-    compact_data=$(printf '%s' "$data" | tr -d '\n' | tr -s ' ')
     printf '{"ts":"%s","type":"%s","sid":"%s","org":"%s","user":"%s","data":%s}\n' \
       "$ts" "$event_type" "$(_resolve_session_id)" "$(_resolve_org)" "$(_resolve_user)" "$compact_data" >&2
     return 0
@@ -144,11 +190,6 @@ cmd_emit() {
   mkdir -p "$BUFFER_DIR"
 
   # Build event line (outside lock for minimal hold time)
-  local ts
-  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-  # Compact data to single line — callers may pass pretty-printed JSON
-  local compact_data
-  compact_data=$(printf '%s' "$data" | tr -d '\n' | tr -s ' ')
   local line
   line=$(printf '{"ts":"%s","type":"%s","sid":"%s","org":"%s","user":"%s","data":%s}' \
     "$ts" "$event_type" "$(_resolve_session_id)" "$(_resolve_org)" "$(_resolve_user)" "$compact_data")