create-egregore 0.19.18 → 0.19.20

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.18
+// egregore-launcher-version: 0.19.20
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.18";
+const VERSION = "0.19.20";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -42,7 +42,6 @@ const UPDATE_REGISTRY_URL =
   process.env.EGREGORE_UPDATE_REGISTRY_URL ||
   `https://registry.npmjs.org/${PUBLIC_NPX_PACKAGE}/latest`;
 const UPDATE_AVAILABLE_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
-const UPDATE_CURRENT_CACHE_TTL_MS = 5 * 60 * 1000;
 const UPDATE_FAILURE_CACHE_TTL_MS = 5 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 1500;
 const CONNECT_API_URL = (
@@ -750,6 +749,9 @@ async function launch(inst, runtimeOverride) {
   }
   const runtime = await chooseRuntimeForLaunch(inst, runtimeOverride);
   if (!runtime) return;
+  if (runtime === "claude-code") {
+    normalizeClaudeDenyRules(inst.path);
+  }
   const binary = runtimeBinary(runtime);
   if (!commandExists(binary)) {
     die(`${runtimeLabel(runtime)} is not installed.\n  Install it with:\n    ${assistantInstallCommand(runtime)}\n  Then run: egregore`);
@@ -1051,11 +1053,14 @@ function readUpdateCache() {
     const age = Date.now() - new Date(cache.checked_at).getTime();
     const cachedUpdate = cache.latest ? cliUpdateState(cache.latest) : null;
     if (cache.latest && !cachedUpdate) return null;
+    // A cached "current" result is never authoritative. Startup has already
+    // rendered by the time this check runs, so revalidate it in the background
+    // on every launch. Otherwise a release published seconds after a user opens
+    // Egregore stays invisible until the cache TTL expires.
+    if (cachedUpdate && !cachedUpdate.available) return null;
     const ttl = !cache.latest
       ? UPDATE_FAILURE_CACHE_TTL_MS
-      : cachedUpdate.available
-        ? UPDATE_AVAILABLE_CACHE_TTL_MS
-        : UPDATE_CURRENT_CACHE_TTL_MS;
+      : UPDATE_AVAILABLE_CACHE_TTL_MS;
     if (!Number.isFinite(age) || age < 0 || age > ttl) return null;
     if (!cache.latest) return { current: VERSION, latest: null, available: false };
     return cachedUpdate;
@@ -1211,15 +1216,19 @@ function writeJsonFileAtomic(file, value) {
   atomicWrite(file, JSON.stringify(value, null, 2) + "\n", 0o644);
 }
 
-function normalizeClaudeRegistryDenyRule(instancePath) {
-  const stale = "Write(~/.egregore/instances.json)";
-  const supported = "Edit(~/.egregore/instances.json)";
+function normalizeClaudeDenyRules(instancePath) {
   for (const relative of [".claude/settings.json", ".claude/settings.local.json"]) {
     const file = path.join(instancePath, relative);
     const settings = readJsonFile(file);
     const deny = settings?.permissions?.deny;
-    if (!Array.isArray(deny) || !deny.includes(stale)) continue;
-    settings.permissions.deny = [...new Set(deny.map((rule) => rule === stale ? supported : rule))];
+    if (!Array.isArray(deny)) continue;
+    const normalized = deny.map((rule) => (
+      typeof rule === "string" && /^Write\(.+\)$/.test(rule)
+        ? `Edit${rule.slice("Write".length)}`
+        : rule
+    ));
+    if (normalized.every((rule, index) => rule === deny[index])) continue;
+    settings.permissions.deny = [...new Set(normalized)];
     writeJsonFileAtomic(file, settings);
   }
 }
@@ -1452,7 +1461,7 @@ async function cmdConnect(args) {
     api_url: claim.data.api_url,
   });
   writeEnvValueAtomic(envFile, "EGREGORE_API_KEY", claim.data.api_key);
-  normalizeClaudeRegistryDenyRule(inst.path);
+  normalizeClaudeDenyRules(inst.path);
   persistConnectState(inst, {
     status: "backfilling",
     activation_protocol: claim.data.activation_protocol,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.18",
+  "version": "0.19.20",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -12,7 +12,7 @@
   "scripts": {
     "build:runtime": "node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/bin/agent.sh

@@ -36,6 +36,7 @@ Runtime-neutral commands:
                                    Commit and push current repo + memory changes;
                                    PR body follows .claude/context/pr-format.md
                                    (auto-generated skeleton if not provided)
+  autosave [status|on|off|scope|publish|merge]  Personal ambient-save settings + consent
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
   handoff --from A --to B --topic T [--intent action|feedback|fyi]
       [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
@@ -732,6 +733,7 @@ case "${1:-}" in
   people) shift; cmd_people "$@" ;;
   branch) shift; cmd_branch "$@" ;;
   save) shift; cmd_save "$@" ;;
+  autosave) shift; bash "$SCRIPT_DIR/bin/autosave.sh" "$@" ;;
   wrap) shift; cmd_wrap "$@" ;;
   handoff) shift; cmd_handoff "$@" ;;
   ask) shift; cmd_ask "$@" ;;

package/runtime/codex/bin/autosave.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# autosave.sh — per-user autosave settings. The consent surface for ambient
+# session capture (see bin/session-autosave.sh, docs/autosave.md).
+#
+# Settings live in .egregore-state.json (gitignored, personal — same pattern
+# as the transcript_sharing consent flag):
+#   autosave_enabled  true|false   ambient capture on/off        (default FALSE — opt-in experiment)
+#   autosave_scope    all|handoffs what it touches               (default all)
+#                     all      = memory repo + core-repo non-coding work
+#                     handoffs = memory repo only; core repo never touched
+#                                ambiently
+#   autosave_publish  gate|auto    what happens to the PR        (default gate)
+#                     gate = PR opened, merge waits for your explicit word
+#                     auto = PR merged to develop automatically
+#
+# Usage:
+#   autosave.sh status
+#   autosave.sh on | off
+#   autosave.sh scope all|handoffs
+#   autosave.sh publish gate|auto
+#   autosave.sh merge          # the consent act: merge YOUR staged auto-save PRs
+#
+# Exposed to Claude via the /autosave skill and to Codex/Pi via
+# `bin/agent.sh autosave ...`.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+
+[ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
+
+# NB: jq's `//` swallows false — status would show "on" for enabled:false.
+# Test key presence instead.
+get() {
+  local v
+  v=$(jq -r "if ($1 != null) then ($1|tostring) else empty end" "$STATE_FILE" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+
+set_key() { # key value(json-encoded)
+  jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+}
+
+status() {
+  local enabled scope publish
+  enabled=$(get '.autosave_enabled' 'false')
+  scope=$(get '.autosave_scope' 'all')
+  publish=$(get '.autosave_publish' 'gate')
+  echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
+  echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
+  echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
+}
+
+case "${1:-status}" in
+  status) status ;;
+  on)  set_key autosave_enabled true  && echo "autosave: on" ;;
+  off) set_key autosave_enabled false && echo "autosave: off — nothing is captured ambiently; /save and /handoff still work" ;;
+  scope)
+    case "${2:-}" in
+      all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
+      *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
+    esac ;;
+  publish)
+    case "${2:-}" in
+      gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
+      *) echo "usage: autosave.sh publish gate|auto" >&2; exit 2 ;;
+    esac ;;
+  merge)
+    # The consent act under publish=gate: merge this user's own staged
+    # Auto-save PRs. Never touches anyone else's.
+    command -v gh >/dev/null 2>&1 || { echo "gh not available" >&2; exit 1; }
+    GH_SELF=$(get '.github_username' '')
+    [ -n "$GH_SELF" ] || { echo "no github_username in .egregore-state.json" >&2; exit 1; }
+    PRS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '.[] | select(.title | startswith("Auto-save:")) | .number' 2>/dev/null)
+    [ -n "$PRS" ] || { echo "no auto-saves waiting"; exit 0; }
+    for n in $PRS; do
+      if gh pr merge "$n" --merge >/dev/null 2>&1; then
+        echo "✓ merged auto-save PR #$n → develop"
+      else
+        echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
+      fi
+    done ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
+esac

package/runtime/codex/bin/codex-session-start.sh

@@ -183,15 +183,26 @@ render_card() {
     if [ "$total_as" -gt "$seen_as" ]; then
       new_as=$((total_as - seen_as))
       merged_as=$(grep '|autosave|' "$autosave_log" 2>/dev/null | tail -n "$new_as" | grep -c '|merged|' || echo 0)
-      if [ "$merged_as" -ge "$new_as" ]; then
-        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$new_as"
-      else
-        printf '  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n' "$new_as" "$merged_as"
+      if [ "$merged_as" -gt 0 ]; then
+        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$merged_as"
       fi
     fi
     printf '%s' "$total_as" > "$autosave_seen" 2>/dev/null || true
   fi
 
+  # Staged auto-saves awaiting the user's merge (the autosave consent gate).
+  # Live gh query so the line persists until the PRs actually merge.
+  if command -v gh >/dev/null 2>&1; then
+    gh_self=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+    if [ -n "$gh_self" ]; then
+      waiting_as=$(gh pr list --state open --author "$gh_self" --limit 20 \
+        --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+      if [ -n "$waiting_as" ]; then
+        printf '  ⟲ auto-saves awaiting your merge: PR #%s — \$autosave merge (or bin/agent.sh autosave merge)\n' "$waiting_as"
+      fi
+    fi
+  fi
+
   # Greeting links. Org config `pinned_links` in egregore.json replaces the
   # default board link — same contract as bin/lib/greeting.sh.
   pinned_links=$(jq -c '.pinned_links // []' "$CONFIG" 2>/dev/null || echo "[]")

package/runtime/codex/bin/handoff-save-egregore.sh

@@ -33,11 +33,13 @@ shift 2 2>/dev/null || true
 REPO_DIR=""
 KIND="handoff"
 BRANCH_SUFFIX=""
+PUBLISH="auto"
 while [ $# -gt 0 ]; do
   case "$1" in
     --repo-dir) REPO_DIR="${2:-}"; shift 2 ;;
     --kind) KIND="${2:-handoff}"; shift 2 ;;
     --branch-suffix) BRANCH_SUFFIX="${2:-}"; shift 2 ;;
+    --publish) PUBLISH="${2:-auto}"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -158,14 +160,18 @@ fi
 
 [ -n "$PR_NUMBER" ] || { ledger_write "-" "pushed"; exit 0; }
 
-# --- Auto-merge iff non-coding -------------------------------------------
+# --- Merge decision -------------------------------------------------------
+# Non-coding + publish=auto → merge now. publish=gate → the PR is staged and
+# the merge waits for the user's explicit word (the /autosave consent gate).
 # `--auto` only works when the repo allows auto-merge AND required checks are
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
 NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
-  if gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
+  if [ "$PUBLISH" = "gate" ]; then
+    OUTCOME="staged"
+  elif gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
      || gh pr merge "$PR_NUMBER" --merge >/dev/null 2>&1; then
     OUTCOME="merged"
   fi

package/runtime/codex/bin/lib/greeting.sh

@@ -164,15 +164,27 @@ if [ -f "$AUTOSAVE_LOG" ]; then
   if [ "$TOTAL_AS" -gt "$SEEN_AS" ]; then
     NEW_AS=$((TOTAL_AS - SEEN_AS))
     MERGED_AS=$(grep '|autosave|' "$AUTOSAVE_LOG" 2>/dev/null | tail -n "$NEW_AS" | grep -c '|merged|' || echo 0)
-    if [ "$MERGED_AS" -ge "$NEW_AS" ]; then
-      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$NEW_AS"
-    else
-      printf "  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n" "$NEW_AS" "$MERGED_AS"
+    if [ "$MERGED_AS" -gt 0 ]; then
+      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$MERGED_AS"
     fi
   fi
   printf '%s' "$TOTAL_AS" > "$AUTOSAVE_SEEN" 2>/dev/null || true
 fi
 
+# Staged auto-saves awaiting the user's merge (the /autosave consent gate).
+# Live gh query so the line persists until the PRs actually merge — the
+# ledger cursor above only reports once. Fail-soft when gh/network is out.
+if command -v gh >/dev/null 2>&1; then
+  GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+  if [ -n "$GH_SELF" ]; then
+    WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+    if [ -n "$WAITING_AS" ]; then
+      printf "  ⟲ auto-saves awaiting your merge: PR #%s — say \"merge my auto-saves\"\n" "$WAITING_AS"
+    fi
+  fi
+fi
+
 # Greeting links. Org config `pinned_links` in egregore.json replaces the
 # default dashboard + board links. Entries are strings or {url, label}.
 # (OSC 8 hyperlink — clickable text in supported terminals)

package/runtime/codex/bin/session-autosave.sh

@@ -87,6 +87,26 @@ touch "$STAMP" 2>/dev/null || true
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_ROOT/bin/lib/noncode.sh" 2>/dev/null || exit 0
 
+# --- Per-user consent settings (bin/autosave.sh / the /autosave skill) ----
+# enabled=false  → fully off, nothing captured ambiently
+# scope=handoffs → memory repo only; the core repo is never touched ambiently
+# publish=gate   → PR is opened but NEVER merged without the user's word
+# NB: jq's `//` swallows false (falsy) — `.k // empty` on k:false yields the
+# default, silently re-enabling autosave. Test key presence instead (this is
+# the same trap that broke auto_update:false).
+_as_conf() { # key default
+  local v
+  v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$DIR/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] || v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+# Autosave is an opt-in experiment: enabled defaults to FALSE. Nothing is
+# captured ambiently until the user runs `/autosave on` (or autosave.sh on).
+AS_ENABLED=$(_as_conf autosave_enabled false)
+AS_SCOPE=$(_as_conf autosave_scope all)
+AS_PUBLISH=$(_as_conf autosave_publish gate)
+[ "$AS_ENABLED" = "true" ] || exit 0
+
 if [ -z "$AUTHOR" ]; then
   AUTHOR=$(jq -r '.github_username // .name // empty' "$DIR/.egregore-state.json" 2>/dev/null || true)
   [ -n "$AUTHOR" ] || AUTHOR=$(jq -r '.github_username // .name // empty' "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null || true)
@@ -111,6 +131,10 @@ if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   fi
 fi
 
+# scope=handoffs: memory (above) is the handoff channel; stop before the
+# core repo — it is never captured ambiently under this scope.
+[ "$AS_SCOPE" = "handoffs" ] && exit 0
+
 # --- Core repo gate: everything pending must be non-coding ---------------
 # -uall expands untracked dirs to individual files: a collapsed "docs/" entry
 # would defeat both the classifier (code nested under a content dir) and the
@@ -144,7 +168,7 @@ ORIG_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 
 bash "$SCRIPT_ROOT/bin/handoff-save-egregore.sh" "$AUTHOR" \
   "session content $(date +%Y-%m-%d)" --kind autosave --repo-dir "$DIR" \
-  --branch-suffix "$DIR_HASH" \
+  --branch-suffix "$DIR_HASH" --publish "$AS_PUBLISH" \
   >/dev/null 2>&1 || true
 
 # Tell the user what just happened. Under the Stop hook this line surfaces in
@@ -162,6 +186,7 @@ if [ -n "$LAST" ]; then
   if [ $(( NOW_EPOCH - TS_EPOCH )) -lt 120 ]; then
     case "$RESULT" in
       merged) echo "⟲ auto-saved: $NF non-coding file(s) → develop (PR #$PR merged)" ;;
+      staged) echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR — yours to merge (say \"merge my auto-saves\" or /autosave)" ;;
       open)   echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR (merge pending)" ;;
       *)      echo "⟲ auto-saved: $NF non-coding file(s) → branch pushed (PR pending)" ;;
     esac

package/runtime/pi/bin/agent.sh

@@ -36,6 +36,7 @@ Runtime-neutral commands:
                                    Commit and push current repo + memory changes;
                                    PR body follows .claude/context/pr-format.md
                                    (auto-generated skeleton if not provided)
+  autosave [status|on|off|scope|publish|merge]  Personal ambient-save settings + consent
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
   handoff --from A --to B --topic T [--intent action|feedback|fyi]
       [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
@@ -732,6 +733,7 @@ case "${1:-}" in
   people) shift; cmd_people "$@" ;;
   branch) shift; cmd_branch "$@" ;;
   save) shift; cmd_save "$@" ;;
+  autosave) shift; bash "$SCRIPT_DIR/bin/autosave.sh" "$@" ;;
   wrap) shift; cmd_wrap "$@" ;;
   handoff) shift; cmd_handoff "$@" ;;
   ask) shift; cmd_ask "$@" ;;

package/runtime/pi/bin/autosave.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# autosave.sh — per-user autosave settings. The consent surface for ambient
+# session capture (see bin/session-autosave.sh, docs/autosave.md).
+#
+# Settings live in .egregore-state.json (gitignored, personal — same pattern
+# as the transcript_sharing consent flag):
+#   autosave_enabled  true|false   ambient capture on/off        (default FALSE — opt-in experiment)
+#   autosave_scope    all|handoffs what it touches               (default all)
+#                     all      = memory repo + core-repo non-coding work
+#                     handoffs = memory repo only; core repo never touched
+#                                ambiently
+#   autosave_publish  gate|auto    what happens to the PR        (default gate)
+#                     gate = PR opened, merge waits for your explicit word
+#                     auto = PR merged to develop automatically
+#
+# Usage:
+#   autosave.sh status
+#   autosave.sh on | off
+#   autosave.sh scope all|handoffs
+#   autosave.sh publish gate|auto
+#   autosave.sh merge          # the consent act: merge YOUR staged auto-save PRs
+#
+# Exposed to Claude via the /autosave skill and to Codex/Pi via
+# `bin/agent.sh autosave ...`.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+
+[ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
+
+# NB: jq's `//` swallows false — status would show "on" for enabled:false.
+# Test key presence instead.
+get() {
+  local v
+  v=$(jq -r "if ($1 != null) then ($1|tostring) else empty end" "$STATE_FILE" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+
+set_key() { # key value(json-encoded)
+  jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+}
+
+status() {
+  local enabled scope publish
+  enabled=$(get '.autosave_enabled' 'false')
+  scope=$(get '.autosave_scope' 'all')
+  publish=$(get '.autosave_publish' 'gate')
+  echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
+  echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
+  echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
+}
+
+case "${1:-status}" in
+  status) status ;;
+  on)  set_key autosave_enabled true  && echo "autosave: on" ;;
+  off) set_key autosave_enabled false && echo "autosave: off — nothing is captured ambiently; /save and /handoff still work" ;;
+  scope)
+    case "${2:-}" in
+      all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
+      *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
+    esac ;;
+  publish)
+    case "${2:-}" in
+      gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
+      *) echo "usage: autosave.sh publish gate|auto" >&2; exit 2 ;;
+    esac ;;
+  merge)
+    # The consent act under publish=gate: merge this user's own staged
+    # Auto-save PRs. Never touches anyone else's.
+    command -v gh >/dev/null 2>&1 || { echo "gh not available" >&2; exit 1; }
+    GH_SELF=$(get '.github_username' '')
+    [ -n "$GH_SELF" ] || { echo "no github_username in .egregore-state.json" >&2; exit 1; }
+    PRS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '.[] | select(.title | startswith("Auto-save:")) | .number' 2>/dev/null)
+    [ -n "$PRS" ] || { echo "no auto-saves waiting"; exit 0; }
+    for n in $PRS; do
+      if gh pr merge "$n" --merge >/dev/null 2>&1; then
+        echo "✓ merged auto-save PR #$n → develop"
+      else
+        echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
+      fi
+    done ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
+esac

package/runtime/pi/bin/codex-session-start.sh

@@ -183,15 +183,26 @@ render_card() {
     if [ "$total_as" -gt "$seen_as" ]; then
       new_as=$((total_as - seen_as))
       merged_as=$(grep '|autosave|' "$autosave_log" 2>/dev/null | tail -n "$new_as" | grep -c '|merged|' || echo 0)
-      if [ "$merged_as" -ge "$new_as" ]; then
-        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$new_as"
-      else
-        printf '  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n' "$new_as" "$merged_as"
+      if [ "$merged_as" -gt 0 ]; then
+        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$merged_as"
       fi
     fi
     printf '%s' "$total_as" > "$autosave_seen" 2>/dev/null || true
   fi
 
+  # Staged auto-saves awaiting the user's merge (the autosave consent gate).
+  # Live gh query so the line persists until the PRs actually merge.
+  if command -v gh >/dev/null 2>&1; then
+    gh_self=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+    if [ -n "$gh_self" ]; then
+      waiting_as=$(gh pr list --state open --author "$gh_self" --limit 20 \
+        --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+      if [ -n "$waiting_as" ]; then
+        printf '  ⟲ auto-saves awaiting your merge: PR #%s — \$autosave merge (or bin/agent.sh autosave merge)\n' "$waiting_as"
+      fi
+    fi
+  fi
+
   # Greeting links. Org config `pinned_links` in egregore.json replaces the
   # default board link — same contract as bin/lib/greeting.sh.
   pinned_links=$(jq -c '.pinned_links // []' "$CONFIG" 2>/dev/null || echo "[]")

package/runtime/pi/bin/handoff-save-egregore.sh

@@ -33,11 +33,13 @@ shift 2 2>/dev/null || true
 REPO_DIR=""
 KIND="handoff"
 BRANCH_SUFFIX=""
+PUBLISH="auto"
 while [ $# -gt 0 ]; do
   case "$1" in
     --repo-dir) REPO_DIR="${2:-}"; shift 2 ;;
     --kind) KIND="${2:-handoff}"; shift 2 ;;
     --branch-suffix) BRANCH_SUFFIX="${2:-}"; shift 2 ;;
+    --publish) PUBLISH="${2:-auto}"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -158,14 +160,18 @@ fi
 
 [ -n "$PR_NUMBER" ] || { ledger_write "-" "pushed"; exit 0; }
 
-# --- Auto-merge iff non-coding -------------------------------------------
+# --- Merge decision -------------------------------------------------------
+# Non-coding + publish=auto → merge now. publish=gate → the PR is staged and
+# the merge waits for the user's explicit word (the /autosave consent gate).
 # `--auto` only works when the repo allows auto-merge AND required checks are
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
 NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
-  if gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
+  if [ "$PUBLISH" = "gate" ]; then
+    OUTCOME="staged"
+  elif gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
      || gh pr merge "$PR_NUMBER" --merge >/dev/null 2>&1; then
     OUTCOME="merged"
   fi

package/runtime/pi/bin/lib/greeting.sh

@@ -164,15 +164,27 @@ if [ -f "$AUTOSAVE_LOG" ]; then
   if [ "$TOTAL_AS" -gt "$SEEN_AS" ]; then
     NEW_AS=$((TOTAL_AS - SEEN_AS))
     MERGED_AS=$(grep '|autosave|' "$AUTOSAVE_LOG" 2>/dev/null | tail -n "$NEW_AS" | grep -c '|merged|' || echo 0)
-    if [ "$MERGED_AS" -ge "$NEW_AS" ]; then
-      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$NEW_AS"
-    else
-      printf "  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n" "$NEW_AS" "$MERGED_AS"
+    if [ "$MERGED_AS" -gt 0 ]; then
+      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$MERGED_AS"
     fi
   fi
   printf '%s' "$TOTAL_AS" > "$AUTOSAVE_SEEN" 2>/dev/null || true
 fi
 
+# Staged auto-saves awaiting the user's merge (the /autosave consent gate).
+# Live gh query so the line persists until the PRs actually merge — the
+# ledger cursor above only reports once. Fail-soft when gh/network is out.
+if command -v gh >/dev/null 2>&1; then
+  GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+  if [ -n "$GH_SELF" ]; then
+    WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+    if [ -n "$WAITING_AS" ]; then
+      printf "  ⟲ auto-saves awaiting your merge: PR #%s — say \"merge my auto-saves\"\n" "$WAITING_AS"
+    fi
+  fi
+fi
+
 # Greeting links. Org config `pinned_links` in egregore.json replaces the
 # default dashboard + board links. Entries are strings or {url, label}.
 # (OSC 8 hyperlink — clickable text in supported terminals)

package/runtime/pi/bin/session-autosave.sh

@@ -87,6 +87,26 @@ touch "$STAMP" 2>/dev/null || true
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_ROOT/bin/lib/noncode.sh" 2>/dev/null || exit 0
 
+# --- Per-user consent settings (bin/autosave.sh / the /autosave skill) ----
+# enabled=false  → fully off, nothing captured ambiently
+# scope=handoffs → memory repo only; the core repo is never touched ambiently
+# publish=gate   → PR is opened but NEVER merged without the user's word
+# NB: jq's `//` swallows false (falsy) — `.k // empty` on k:false yields the
+# default, silently re-enabling autosave. Test key presence instead (this is
+# the same trap that broke auto_update:false).
+_as_conf() { # key default
+  local v
+  v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$DIR/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] || v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+# Autosave is an opt-in experiment: enabled defaults to FALSE. Nothing is
+# captured ambiently until the user runs `/autosave on` (or autosave.sh on).
+AS_ENABLED=$(_as_conf autosave_enabled false)
+AS_SCOPE=$(_as_conf autosave_scope all)
+AS_PUBLISH=$(_as_conf autosave_publish gate)
+[ "$AS_ENABLED" = "true" ] || exit 0
+
 if [ -z "$AUTHOR" ]; then
   AUTHOR=$(jq -r '.github_username // .name // empty' "$DIR/.egregore-state.json" 2>/dev/null || true)
   [ -n "$AUTHOR" ] || AUTHOR=$(jq -r '.github_username // .name // empty' "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null || true)
@@ -111,6 +131,10 @@ if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   fi
 fi
 
+# scope=handoffs: memory (above) is the handoff channel; stop before the
+# core repo — it is never captured ambiently under this scope.
+[ "$AS_SCOPE" = "handoffs" ] && exit 0
+
 # --- Core repo gate: everything pending must be non-coding ---------------
 # -uall expands untracked dirs to individual files: a collapsed "docs/" entry
 # would defeat both the classifier (code nested under a content dir) and the
@@ -144,7 +168,7 @@ ORIG_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 
 bash "$SCRIPT_ROOT/bin/handoff-save-egregore.sh" "$AUTHOR" \
   "session content $(date +%Y-%m-%d)" --kind autosave --repo-dir "$DIR" \
-  --branch-suffix "$DIR_HASH" \
+  --branch-suffix "$DIR_HASH" --publish "$AS_PUBLISH" \
   >/dev/null 2>&1 || true
 
 # Tell the user what just happened. Under the Stop hook this line surfaces in
@@ -162,6 +186,7 @@ if [ -n "$LAST" ]; then
   if [ $(( NOW_EPOCH - TS_EPOCH )) -lt 120 ]; then
     case "$RESULT" in
       merged) echo "⟲ auto-saved: $NF non-coding file(s) → develop (PR #$PR merged)" ;;
+      staged) echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR — yours to merge (say \"merge my auto-saves\" or /autosave)" ;;
       open)   echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR (merge pending)" ;;
       *)      echo "⟲ auto-saved: $NF non-coding file(s) → branch pushed (PR pending)" ;;
     esac