create-egregore 0.19.19 → 0.19.21

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.19
+// egregore-launcher-version: 0.19.21
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.19";
+const VERSION = "0.19.21";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -629,7 +629,14 @@ async function renderCodexStartupCard(egregoreDir) {
       const result = await runCapturedWithSpinner("bash", [script], {
         cwd: egregoreDir,
       }, "Preparing Codex startup");
-      if (result.stdout) process.stdout.write(result.stdout);
+      let output = result.stdout || "";
+      if (isConnectedPath(egregoreDir) && !output.includes("◆ CONNECTED")) {
+        const connectedLine = "  ◆ CONNECTED · hosted graph active\n";
+        output = output.includes("\nWhat are you working on?")
+          ? output.replace("\nWhat are you working on?", `\n${connectedLine}\nWhat are you working on?`)
+          : `${output}${output.endsWith("\n") || !output ? "" : "\n"}${connectedLine}`;
+      }
+      if (output) process.stdout.write(output);
       if (result.status !== 0 && result.stderr) process.stderr.write(result.stderr);
       if (result.status === 0) return true;
     } catch {}
@@ -749,6 +756,10 @@ async function launch(inst, runtimeOverride) {
   }
   const runtime = await chooseRuntimeForLaunch(inst, runtimeOverride);
   if (!runtime) return;
+  if (runtime === "claude-code") {
+    normalizeClaudeDenyRules(inst.path);
+    ensureClaudeModeStatusLine(inst.path);
+  }
   const binary = runtimeBinary(runtime);
   if (!commandExists(binary)) {
     die(`${runtimeLabel(runtime)} is not installed.\n  Install it with:\n    ${assistantInstallCommand(runtime)}\n  Then run: egregore`);
@@ -813,13 +824,17 @@ function cmdLs() {
   const slugW = Math.min(24, Math.max(...registry.map((r) => (r.slug || "").length)));
   const nameW = Math.min(24, Math.max(...registry.map((r) => (r.name || "").length)));
   const runtimeW = Math.max(9, ...registry.map((r) => runtimeShort(runtimeFor(r)).length));
+  const modeW = "◆ CONNECTED".length;
   console.log(`\n  ${BOLD}${registry.length}${RESET} egregore${registry.length === 1 ? "" : "s"} registered\n`);
-  console.log(`    ${DIM}${pad("SLUG", slugW)}  ${pad("NAME", nameW)}  ${pad("ASSISTANT", runtimeW)}  PATH${RESET}`);
+  console.log(`    ${DIM}${pad("SLUG", slugW)}  ${pad("NAME", nameW)}  ${pad("MODE", modeW)}  ${pad("ASSISTANT", runtimeW)}  PATH${RESET}`);
   for (const inst of registry) {
     const marker = inst.slug === def ? `${GREEN}●${RESET}` : " ";
     const slug = inst.slug === def ? `${BOLD}${pad(inst.slug, slugW)}${RESET}` : pad(inst.slug, slugW);
     const runtime = pad(runtimeShort(runtimeFor(inst)), runtimeW);
-    console.log(`  ${marker} ${slug}  ${pad(inst.name || "", nameW)}  ${runtime}  ${DIM}${inst.path}${RESET}`);
+    const mode = isConnectedInstance(inst)
+      ? `${CYAN}${pad("◆ CONNECTED", modeW)}${RESET}`
+      : `${DIM}${pad("◇ LOCAL", modeW)}${RESET}`;
+    console.log(`  ${marker} ${slug}  ${pad(inst.name || "", nameW)}  ${mode}  ${runtime}  ${DIM}${inst.path}${RESET}`);
   }
   if (def) console.log(`\n  ${GREEN}●${RESET} = default marker (used by non-interactive ${BOLD}egregore${RESET})\n`);
   else console.log("");
@@ -933,6 +948,22 @@ function readJsonFile(file) {
   }
 }
 
+function isConnectedConfig(config) {
+  return (
+    config?.mode === "connected" &&
+    typeof config.api_url === "string" &&
+    config.api_url.trim().length > 0
+  );
+}
+
+function isConnectedPath(instancePath) {
+  return isConnectedConfig(readJsonFile(path.join(instancePath, "egregore.json")));
+}
+
+function isConnectedInstance(inst) {
+  return !!inst?.path && isConnectedPath(inst.path);
+}
+
 function readEnvValues(file) {
   const values = {};
   if (!fs.existsSync(file)) return values;
@@ -1213,19 +1244,64 @@ function writeJsonFileAtomic(file, value) {
   atomicWrite(file, JSON.stringify(value, null, 2) + "\n", 0o644);
 }
 
-function normalizeClaudeRegistryDenyRule(instancePath) {
-  const stale = "Write(~/.egregore/instances.json)";
-  const supported = "Edit(~/.egregore/instances.json)";
+function normalizeClaudeDenyRules(instancePath) {
   for (const relative of [".claude/settings.json", ".claude/settings.local.json"]) {
     const file = path.join(instancePath, relative);
     const settings = readJsonFile(file);
     const deny = settings?.permissions?.deny;
-    if (!Array.isArray(deny) || !deny.includes(stale)) continue;
-    settings.permissions.deny = [...new Set(deny.map((rule) => rule === stale ? supported : rule))];
+    if (!Array.isArray(deny)) continue;
+    const normalized = deny.map((rule) => (
+      typeof rule === "string" && /^Write\(.+\)$/.test(rule)
+        ? `Edit${rule.slice("Write".length)}`
+        : rule
+    ));
+    if (normalized.every((rule, index) => rule === deny[index])) continue;
+    settings.permissions.deny = [...new Set(normalized)];
     writeJsonFileAtomic(file, settings);
   }
 }
 
+const CLAUDE_MODE_STATUS_MARKER = "# egregore-connected-status-v1";
+const CLAUDE_DEFAULT_STATUS_COMMAND = "\"${CLAUDE_PROJECT_DIR}/bin/statusline.sh\"";
+
+function claudeModeStatusCommand(baseCommand) {
+  return [
+    CLAUDE_MODE_STATUS_MARKER,
+    "MODE=$(jq -r 'if (.mode == \"connected\" and ((.api_url // \"\") | length > 0)) then \"connected\" else \"local\" end' \"${CLAUDE_PROJECT_DIR}/egregore.json\" 2>/dev/null)",
+    `BASE=$( ( ${baseCommand} ) 2>/dev/null || true)`,
+    "if [ \"$MODE\" = \"connected\" ]; then",
+    "  case \"$BASE\" in",
+    "    *\"◆ CONNECTED\"*) printf '%s\\n' \"$BASE\" ;;",
+    "    \"\") printf '◆ CONNECTED\\n' ;;",
+    "    *) printf '◆ CONNECTED · %s\\n' \"$BASE\" ;;",
+    "  esac",
+    "else",
+    "  printf '%s\\n' \"$BASE\"",
+    "fi",
+  ].join("\n");
+}
+
+function ensureClaudeModeStatusLine(instancePath) {
+  if (!isConnectedPath(instancePath)) return false;
+  const file = path.join(instancePath, ".claude", "settings.local.json");
+  const settings = readJsonFile(file);
+  const current = settings?.statusLine;
+  if (current?.type === "command" && current?.command?.includes(CLAUDE_MODE_STATUS_MARKER)) {
+    return false;
+  }
+  const baseCommand = current?.type === "command" && current?.command?.trim()
+    ? current.command
+    : CLAUDE_DEFAULT_STATUS_COMMAND;
+  settings.statusLine = {
+    ...(current || {}),
+    type: "command",
+    command: claudeModeStatusCommand(baseCommand),
+  };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  writeJsonFileAtomic(file, settings);
+  return true;
+}
+
 function writeEnvValueAtomic(file, key, value) {
   const lines = fs.existsSync(file)
     ? fs.readFileSync(file, "utf-8").split(/\r?\n/)
@@ -1316,6 +1392,8 @@ async function cmdConnect(args) {
   }
   const activation = state.connected_activation || {};
   if (cfg.mode === "connected" && activation.status === "connected") {
+    normalizeClaudeDenyRules(inst.path);
+    ensureClaudeModeStatusLine(inst.path);
     console.log(`\n  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is already connected.\n`);
     return;
   }
@@ -1454,7 +1532,8 @@ async function cmdConnect(args) {
     api_url: claim.data.api_url,
   });
   writeEnvValueAtomic(envFile, "EGREGORE_API_KEY", claim.data.api_key);
-  normalizeClaudeRegistryDenyRule(inst.path);
+  normalizeClaudeDenyRules(inst.path);
+  ensureClaudeModeStatusLine(inst.path);
   persistConnectState(inst, {
     status: "backfilling",
     activation_protocol: claim.data.activation_protocol,
@@ -1931,7 +2010,8 @@ function loadPreview(inst) {
       data.telegram = !!(cfg.telegram_chat_id || cfg.telegram_group_link);
       data.org = cfg.org_name;
       data.githubOrg = cfg.github_org;
-      data.mode = cfg.mode;
+      data.connected = isConnectedConfig(cfg);
+      data.mode = data.connected ? "connected" : "local";
       data.flowVariant = cfg.flow_variant;
     }
   } catch {}
@@ -2004,7 +2084,8 @@ function renderHeroPanel({ selected, pv, width, height, countSuffix, filter, fil
   }
   lines.push(emptyBoxLine(innerWidth, margin));
   lines.push(updateBand || mid);
-  lines.push(boxLine(`${BOLD}${title}${RESET} ${DIM}· ${org} · ${runtime} · ${countSuffix} · ${filterText}${RESET}`, innerWidth, margin));
+  const connectedHero = pv?.connected ? ` · ${CYAN}◆ CONNECTED${RESET}` : "";
+  lines.push(boxLine(`${BOLD}${title}${RESET} ${DIM}· ${org} · ${runtime}${RESET}${connectedHero}${DIM} · ${countSuffix} · ${filterText}${RESET}`, innerWidth, margin));
   lines.push(boxLine(`${DIM}skills${RESET} ${skillStatus}`, innerWidth, margin));
   lines.push(emptyBoxLine(innerWidth, margin));
 
@@ -2058,6 +2139,13 @@ function renderRuntimePanel({ inst, cursor, width, height }) {
     emptyBoxLine(innerWidth, margin),
     boxLine(`${BOLD}${CYAN}Launch ${title}${RESET}`, innerWidth, margin),
     boxLine(`${DIM}${inst.path}${RESET}`, innerWidth, margin),
+    boxLine(
+      isConnectedInstance(inst)
+        ? `${CYAN}◆ CONNECTED${RESET} ${DIM}· hosted graph active${RESET}`
+        : `${DIM}◇ LOCAL · Markdown + Git${RESET}`,
+      innerWidth,
+      margin,
+    ),
     emptyBoxLine(innerWidth, margin),
   ];
 
@@ -2374,10 +2462,13 @@ async function browser(args = {}) {
         ? `${DIM}${pad(e.name || "", nameW)}${RESET}`
         : pad(e.name || "", nameW);
       const pathAvail = Math.max(0, listAvail - slugW - nameW - 10);
+      const connected = isConnectedInstance(e);
+      const modeBadge = connected ? `${CYAN}◆ CONNECTED${RESET}` : "";
+      const adjustedPathAvail = Math.max(0, pathAvail - (connected ? "◆ CONNECTED  ".length : 0));
       const pathDim = isMissing
-        ? `${RED}✗${RESET} ${DIM}${truncate(e.path, Math.max(8, pathAvail - 12))}${RESET} ${RED}(missing)${RESET}`
-        : `${DIM}${truncate(e.path, pathAvail)}${RESET}`;
-      const line = ` ${cursorMark} ${defMark}  ${slug}  ${name}  ${pathDim}`;
+        ? `${RED}✗${RESET} ${DIM}${truncate(e.path, Math.max(8, adjustedPathAvail - 12))}${RESET} ${RED}(missing)${RESET}`
+        : `${DIM}${truncate(e.path, adjustedPathAvail)}${RESET}`;
+      const line = ` ${cursorMark} ${defMark}  ${slug}  ${name}  ${modeBadge}${modeBadge ? "  " : ""}${pathDim}`;
       out.push(M + " ".repeat(listPad - 3) + line + ANSI.clearLine + "\n");
     }
 
@@ -2404,6 +2495,9 @@ async function browser(args = {}) {
         ? `  ${label("path")} ${RED}✗${RESET} ${truncate(selected.path, Math.max(8, valW - 12))} ${RED}(missing)${RESET}`
         : `  ${label("path")} ${truncate(selected.path, valW)}`);
       if (pv.org) previewLines.push(`  ${label("org")} ${truncate(`${pv.org} ${DIM}(${pv.githubOrg || "?"})${RESET}`, valW)}`);
+      previewLines.push(pv.connected
+        ? `  ${label("mode")} ${CYAN}◆ CONNECTED${RESET} ${DIM}· hosted graph active${RESET}`
+        : `  ${label("mode")} ${DIM}◇ LOCAL · Markdown + Git${RESET}`);
       if (pv.branch) previewLines.push(`  ${label("branch")} ${BOLD}${pv.branch}${RESET}`);
       if (pv.lastCommit) previewLines.push(`  ${label("last")} ${DIM}${truncate(pv.lastCommit, valW)}${RESET}`);
       if (pv.repos && pv.repos.length) {
@@ -2417,7 +2511,6 @@ async function browser(args = {}) {
       }
       const modeBits = [];
       modeBits.push(runtimeShort(runtimeFor(selected, args.runtimeOverride)));
-      if (pv.mode) modeBits.push(pv.mode);
       if (pv.flowVariant && pv.flowVariant !== "legacy") modeBits.push(pv.flowVariant);
       if (pv.telegram) modeBits.push("telegram");
       if (selected.slug === def) modeBits.push("default");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.19",
+  "version": "0.19.21",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -12,7 +12,7 @@
   "scripts": {
     "build:runtime": "node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/bin/agent.sh

@@ -36,6 +36,7 @@ Runtime-neutral commands:
                                    Commit and push current repo + memory changes;
                                    PR body follows .claude/context/pr-format.md
                                    (auto-generated skeleton if not provided)
+  autosave [status|on|off|scope|publish|merge]  Personal ambient-save settings + consent
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
   handoff --from A --to B --topic T [--intent action|feedback|fyi]
       [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
@@ -732,6 +733,7 @@ case "${1:-}" in
   people) shift; cmd_people "$@" ;;
   branch) shift; cmd_branch "$@" ;;
   save) shift; cmd_save "$@" ;;
+  autosave) shift; bash "$SCRIPT_DIR/bin/autosave.sh" "$@" ;;
   wrap) shift; cmd_wrap "$@" ;;
   handoff) shift; cmd_handoff "$@" ;;
   ask) shift; cmd_ask "$@" ;;

package/runtime/codex/bin/autosave.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# autosave.sh — per-user autosave settings. The consent surface for ambient
+# session capture (see bin/session-autosave.sh, docs/autosave.md).
+#
+# Settings live in .egregore-state.json (gitignored, personal — same pattern
+# as the transcript_sharing consent flag):
+#   autosave_enabled  true|false   ambient capture on/off        (default FALSE — opt-in experiment)
+#   autosave_scope    all|handoffs what it touches               (default all)
+#                     all      = memory repo + core-repo non-coding work
+#                     handoffs = memory repo only; core repo never touched
+#                                ambiently
+#   autosave_publish  gate|auto    what happens to the PR        (default gate)
+#                     gate = PR opened, merge waits for your explicit word
+#                     auto = PR merged to develop automatically
+#
+# Usage:
+#   autosave.sh status
+#   autosave.sh on | off
+#   autosave.sh scope all|handoffs
+#   autosave.sh publish gate|auto
+#   autosave.sh merge          # the consent act: merge YOUR staged auto-save PRs
+#
+# Exposed to Claude via the /autosave skill and to Codex/Pi via
+# `bin/agent.sh autosave ...`.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+
+[ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
+
+# NB: jq's `//` swallows false — status would show "on" for enabled:false.
+# Test key presence instead.
+get() {
+  local v
+  v=$(jq -r "if ($1 != null) then ($1|tostring) else empty end" "$STATE_FILE" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+
+set_key() { # key value(json-encoded)
+  jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+}
+
+status() {
+  local enabled scope publish
+  enabled=$(get '.autosave_enabled' 'false')
+  scope=$(get '.autosave_scope' 'all')
+  publish=$(get '.autosave_publish' 'gate')
+  echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
+  echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
+  echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
+}
+
+case "${1:-status}" in
+  status) status ;;
+  on)  set_key autosave_enabled true  && echo "autosave: on" ;;
+  off) set_key autosave_enabled false && echo "autosave: off — nothing is captured ambiently; /save and /handoff still work" ;;
+  scope)
+    case "${2:-}" in
+      all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
+      *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
+    esac ;;
+  publish)
+    case "${2:-}" in
+      gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
+      *) echo "usage: autosave.sh publish gate|auto" >&2; exit 2 ;;
+    esac ;;
+  merge)
+    # The consent act under publish=gate: merge this user's own staged
+    # Auto-save PRs. Never touches anyone else's.
+    command -v gh >/dev/null 2>&1 || { echo "gh not available" >&2; exit 1; }
+    GH_SELF=$(get '.github_username' '')
+    [ -n "$GH_SELF" ] || { echo "no github_username in .egregore-state.json" >&2; exit 1; }
+    PRS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '.[] | select(.title | startswith("Auto-save:")) | .number' 2>/dev/null)
+    [ -n "$PRS" ] || { echo "no auto-saves waiting"; exit 0; }
+    for n in $PRS; do
+      if gh pr merge "$n" --merge >/dev/null 2>&1; then
+        echo "✓ merged auto-save PR #$n → develop"
+      else
+        echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
+      fi
+    done ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
+esac

package/runtime/codex/bin/codex-session-start.sh

@@ -183,15 +183,26 @@ render_card() {
     if [ "$total_as" -gt "$seen_as" ]; then
       new_as=$((total_as - seen_as))
       merged_as=$(grep '|autosave|' "$autosave_log" 2>/dev/null | tail -n "$new_as" | grep -c '|merged|' || echo 0)
-      if [ "$merged_as" -ge "$new_as" ]; then
-        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$new_as"
-      else
-        printf '  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n' "$new_as" "$merged_as"
+      if [ "$merged_as" -gt 0 ]; then
+        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$merged_as"
       fi
     fi
     printf '%s' "$total_as" > "$autosave_seen" 2>/dev/null || true
   fi
 
+  # Staged auto-saves awaiting the user's merge (the autosave consent gate).
+  # Live gh query so the line persists until the PRs actually merge.
+  if command -v gh >/dev/null 2>&1; then
+    gh_self=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+    if [ -n "$gh_self" ]; then
+      waiting_as=$(gh pr list --state open --author "$gh_self" --limit 20 \
+        --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+      if [ -n "$waiting_as" ]; then
+        printf '  ⟲ auto-saves awaiting your merge: PR #%s — \$autosave merge (or bin/agent.sh autosave merge)\n' "$waiting_as"
+      fi
+    fi
+  fi
+
   # Greeting links. Org config `pinned_links` in egregore.json replaces the
   # default board link — same contract as bin/lib/greeting.sh.
   pinned_links=$(jq -c '.pinned_links // []' "$CONFIG" 2>/dev/null || echo "[]")

package/runtime/codex/bin/handoff-save-egregore.sh

@@ -33,11 +33,13 @@ shift 2 2>/dev/null || true
 REPO_DIR=""
 KIND="handoff"
 BRANCH_SUFFIX=""
+PUBLISH="auto"
 while [ $# -gt 0 ]; do
   case "$1" in
     --repo-dir) REPO_DIR="${2:-}"; shift 2 ;;
     --kind) KIND="${2:-handoff}"; shift 2 ;;
     --branch-suffix) BRANCH_SUFFIX="${2:-}"; shift 2 ;;
+    --publish) PUBLISH="${2:-auto}"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -158,14 +160,18 @@ fi
 
 [ -n "$PR_NUMBER" ] || { ledger_write "-" "pushed"; exit 0; }
 
-# --- Auto-merge iff non-coding -------------------------------------------
+# --- Merge decision -------------------------------------------------------
+# Non-coding + publish=auto → merge now. publish=gate → the PR is staged and
+# the merge waits for the user's explicit word (the /autosave consent gate).
 # `--auto` only works when the repo allows auto-merge AND required checks are
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
 NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
-  if gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
+  if [ "$PUBLISH" = "gate" ]; then
+    OUTCOME="staged"
+  elif gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
      || gh pr merge "$PR_NUMBER" --merge >/dev/null 2>&1; then
     OUTCOME="merged"
   fi

package/runtime/codex/bin/lib/greeting.sh

@@ -164,15 +164,27 @@ if [ -f "$AUTOSAVE_LOG" ]; then
   if [ "$TOTAL_AS" -gt "$SEEN_AS" ]; then
     NEW_AS=$((TOTAL_AS - SEEN_AS))
     MERGED_AS=$(grep '|autosave|' "$AUTOSAVE_LOG" 2>/dev/null | tail -n "$NEW_AS" | grep -c '|merged|' || echo 0)
-    if [ "$MERGED_AS" -ge "$NEW_AS" ]; then
-      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$NEW_AS"
-    else
-      printf "  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n" "$NEW_AS" "$MERGED_AS"
+    if [ "$MERGED_AS" -gt 0 ]; then
+      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$MERGED_AS"
     fi
   fi
   printf '%s' "$TOTAL_AS" > "$AUTOSAVE_SEEN" 2>/dev/null || true
 fi
 
+# Staged auto-saves awaiting the user's merge (the /autosave consent gate).
+# Live gh query so the line persists until the PRs actually merge — the
+# ledger cursor above only reports once. Fail-soft when gh/network is out.
+if command -v gh >/dev/null 2>&1; then
+  GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+  if [ -n "$GH_SELF" ]; then
+    WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+    if [ -n "$WAITING_AS" ]; then
+      printf "  ⟲ auto-saves awaiting your merge: PR #%s — say \"merge my auto-saves\"\n" "$WAITING_AS"
+    fi
+  fi
+fi
+
 # Greeting links. Org config `pinned_links` in egregore.json replaces the
 # default dashboard + board links. Entries are strings or {url, label}.
 # (OSC 8 hyperlink — clickable text in supported terminals)

package/runtime/codex/bin/session-autosave.sh

@@ -87,6 +87,26 @@ touch "$STAMP" 2>/dev/null || true
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_ROOT/bin/lib/noncode.sh" 2>/dev/null || exit 0
 
+# --- Per-user consent settings (bin/autosave.sh / the /autosave skill) ----
+# enabled=false  → fully off, nothing captured ambiently
+# scope=handoffs → memory repo only; the core repo is never touched ambiently
+# publish=gate   → PR is opened but NEVER merged without the user's word
+# NB: jq's `//` swallows false (falsy) — `.k // empty` on k:false yields the
+# default, silently re-enabling autosave. Test key presence instead (this is
+# the same trap that broke auto_update:false).
+_as_conf() { # key default
+  local v
+  v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$DIR/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] || v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+# Autosave is an opt-in experiment: enabled defaults to FALSE. Nothing is
+# captured ambiently until the user runs `/autosave on` (or autosave.sh on).
+AS_ENABLED=$(_as_conf autosave_enabled false)
+AS_SCOPE=$(_as_conf autosave_scope all)
+AS_PUBLISH=$(_as_conf autosave_publish gate)
+[ "$AS_ENABLED" = "true" ] || exit 0
+
 if [ -z "$AUTHOR" ]; then
   AUTHOR=$(jq -r '.github_username // .name // empty' "$DIR/.egregore-state.json" 2>/dev/null || true)
   [ -n "$AUTHOR" ] || AUTHOR=$(jq -r '.github_username // .name // empty' "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null || true)
@@ -111,6 +131,10 @@ if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   fi
 fi
 
+# scope=handoffs: memory (above) is the handoff channel; stop before the
+# core repo — it is never captured ambiently under this scope.
+[ "$AS_SCOPE" = "handoffs" ] && exit 0
+
 # --- Core repo gate: everything pending must be non-coding ---------------
 # -uall expands untracked dirs to individual files: a collapsed "docs/" entry
 # would defeat both the classifier (code nested under a content dir) and the
@@ -144,7 +168,7 @@ ORIG_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 
 bash "$SCRIPT_ROOT/bin/handoff-save-egregore.sh" "$AUTHOR" \
   "session content $(date +%Y-%m-%d)" --kind autosave --repo-dir "$DIR" \
-  --branch-suffix "$DIR_HASH" \
+  --branch-suffix "$DIR_HASH" --publish "$AS_PUBLISH" \
   >/dev/null 2>&1 || true
 
 # Tell the user what just happened. Under the Stop hook this line surfaces in
@@ -162,6 +186,7 @@ if [ -n "$LAST" ]; then
   if [ $(( NOW_EPOCH - TS_EPOCH )) -lt 120 ]; then
     case "$RESULT" in
       merged) echo "⟲ auto-saved: $NF non-coding file(s) → develop (PR #$PR merged)" ;;
+      staged) echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR — yours to merge (say \"merge my auto-saves\" or /autosave)" ;;
       open)   echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR (merge pending)" ;;
       *)      echo "⟲ auto-saved: $NF non-coding file(s) → branch pushed (PR pending)" ;;
     esac

package/runtime/pi/bin/agent.sh

@@ -36,6 +36,7 @@ Runtime-neutral commands:
                                    Commit and push current repo + memory changes;
                                    PR body follows .claude/context/pr-format.md
                                    (auto-generated skeleton if not provided)
+  autosave [status|on|off|scope|publish|merge]  Personal ambient-save settings + consent
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
   handoff --from A --to B --topic T [--intent action|feedback|fyi]
       [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
@@ -732,6 +733,7 @@ case "${1:-}" in
   people) shift; cmd_people "$@" ;;
   branch) shift; cmd_branch "$@" ;;
   save) shift; cmd_save "$@" ;;
+  autosave) shift; bash "$SCRIPT_DIR/bin/autosave.sh" "$@" ;;
   wrap) shift; cmd_wrap "$@" ;;
   handoff) shift; cmd_handoff "$@" ;;
   ask) shift; cmd_ask "$@" ;;

package/runtime/pi/bin/autosave.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# autosave.sh — per-user autosave settings. The consent surface for ambient
+# session capture (see bin/session-autosave.sh, docs/autosave.md).
+#
+# Settings live in .egregore-state.json (gitignored, personal — same pattern
+# as the transcript_sharing consent flag):
+#   autosave_enabled  true|false   ambient capture on/off        (default FALSE — opt-in experiment)
+#   autosave_scope    all|handoffs what it touches               (default all)
+#                     all      = memory repo + core-repo non-coding work
+#                     handoffs = memory repo only; core repo never touched
+#                                ambiently
+#   autosave_publish  gate|auto    what happens to the PR        (default gate)
+#                     gate = PR opened, merge waits for your explicit word
+#                     auto = PR merged to develop automatically
+#
+# Usage:
+#   autosave.sh status
+#   autosave.sh on | off
+#   autosave.sh scope all|handoffs
+#   autosave.sh publish gate|auto
+#   autosave.sh merge          # the consent act: merge YOUR staged auto-save PRs
+#
+# Exposed to Claude via the /autosave skill and to Codex/Pi via
+# `bin/agent.sh autosave ...`.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+
+[ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
+
+# NB: jq's `//` swallows false — status would show "on" for enabled:false.
+# Test key presence instead.
+get() {
+  local v
+  v=$(jq -r "if ($1 != null) then ($1|tostring) else empty end" "$STATE_FILE" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+
+set_key() { # key value(json-encoded)
+  jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+}
+
+status() {
+  local enabled scope publish
+  enabled=$(get '.autosave_enabled' 'false')
+  scope=$(get '.autosave_scope' 'all')
+  publish=$(get '.autosave_publish' 'gate')
+  echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
+  echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
+  echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
+}
+
+case "${1:-status}" in
+  status) status ;;
+  on)  set_key autosave_enabled true  && echo "autosave: on" ;;
+  off) set_key autosave_enabled false && echo "autosave: off — nothing is captured ambiently; /save and /handoff still work" ;;
+  scope)
+    case "${2:-}" in
+      all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
+      *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
+    esac ;;
+  publish)
+    case "${2:-}" in
+      gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
+      *) echo "usage: autosave.sh publish gate|auto" >&2; exit 2 ;;
+    esac ;;
+  merge)
+    # The consent act under publish=gate: merge this user's own staged
+    # Auto-save PRs. Never touches anyone else's.
+    command -v gh >/dev/null 2>&1 || { echo "gh not available" >&2; exit 1; }
+    GH_SELF=$(get '.github_username' '')
+    [ -n "$GH_SELF" ] || { echo "no github_username in .egregore-state.json" >&2; exit 1; }
+    PRS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '.[] | select(.title | startswith("Auto-save:")) | .number' 2>/dev/null)
+    [ -n "$PRS" ] || { echo "no auto-saves waiting"; exit 0; }
+    for n in $PRS; do
+      if gh pr merge "$n" --merge >/dev/null 2>&1; then
+        echo "✓ merged auto-save PR #$n → develop"
+      else
+        echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
+      fi
+    done ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
+esac

package/runtime/pi/bin/codex-session-start.sh

@@ -183,15 +183,26 @@ render_card() {
     if [ "$total_as" -gt "$seen_as" ]; then
       new_as=$((total_as - seen_as))
       merged_as=$(grep '|autosave|' "$autosave_log" 2>/dev/null | tail -n "$new_as" | grep -c '|merged|' || echo 0)
-      if [ "$merged_as" -ge "$new_as" ]; then
-        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$new_as"
-      else
-        printf '  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n' "$new_as" "$merged_as"
+      if [ "$merged_as" -gt 0 ]; then
+        printf '  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n' "$merged_as"
       fi
     fi
     printf '%s' "$total_as" > "$autosave_seen" 2>/dev/null || true
   fi
 
+  # Staged auto-saves awaiting the user's merge (the autosave consent gate).
+  # Live gh query so the line persists until the PRs actually merge.
+  if command -v gh >/dev/null 2>&1; then
+    gh_self=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+    if [ -n "$gh_self" ]; then
+      waiting_as=$(gh pr list --state open --author "$gh_self" --limit 20 \
+        --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+      if [ -n "$waiting_as" ]; then
+        printf '  ⟲ auto-saves awaiting your merge: PR #%s — \$autosave merge (or bin/agent.sh autosave merge)\n' "$waiting_as"
+      fi
+    fi
+  fi
+
   # Greeting links. Org config `pinned_links` in egregore.json replaces the
   # default board link — same contract as bin/lib/greeting.sh.
   pinned_links=$(jq -c '.pinned_links // []' "$CONFIG" 2>/dev/null || echo "[]")

package/runtime/pi/bin/handoff-save-egregore.sh

@@ -33,11 +33,13 @@ shift 2 2>/dev/null || true
 REPO_DIR=""
 KIND="handoff"
 BRANCH_SUFFIX=""
+PUBLISH="auto"
 while [ $# -gt 0 ]; do
   case "$1" in
     --repo-dir) REPO_DIR="${2:-}"; shift 2 ;;
     --kind) KIND="${2:-handoff}"; shift 2 ;;
     --branch-suffix) BRANCH_SUFFIX="${2:-}"; shift 2 ;;
+    --publish) PUBLISH="${2:-auto}"; shift 2 ;;
     *) shift ;;
   esac
 done
@@ -158,14 +160,18 @@ fi
 
 [ -n "$PR_NUMBER" ] || { ledger_write "-" "pushed"; exit 0; }
 
-# --- Auto-merge iff non-coding -------------------------------------------
+# --- Merge decision -------------------------------------------------------
+# Non-coding + publish=auto → merge now. publish=gate → the PR is staged and
+# the merge waits for the user's explicit word (the /autosave consent gate).
 # `--auto` only works when the repo allows auto-merge AND required checks are
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
 NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
-  if gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
+  if [ "$PUBLISH" = "gate" ]; then
+    OUTCOME="staged"
+  elif gh pr merge "$PR_NUMBER" --auto --merge >/dev/null 2>&1 \
      || gh pr merge "$PR_NUMBER" --merge >/dev/null 2>&1; then
     OUTCOME="merged"
   fi

package/runtime/pi/bin/lib/greeting.sh

@@ -164,15 +164,27 @@ if [ -f "$AUTOSAVE_LOG" ]; then
   if [ "$TOTAL_AS" -gt "$SEEN_AS" ]; then
     NEW_AS=$((TOTAL_AS - SEEN_AS))
     MERGED_AS=$(grep '|autosave|' "$AUTOSAVE_LOG" 2>/dev/null | tail -n "$NEW_AS" | grep -c '|merged|' || echo 0)
-    if [ "$MERGED_AS" -ge "$NEW_AS" ]; then
-      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$NEW_AS"
-    else
-      printf "  ⟲ auto-saved %s non-coding save(s) — %s merged, rest in open PRs\n" "$NEW_AS" "$MERGED_AS"
+    if [ "$MERGED_AS" -gt 0 ]; then
+      printf "  ⟲ auto-saved %s non-coding save(s) → develop while you were away\n" "$MERGED_AS"
     fi
   fi
   printf '%s' "$TOTAL_AS" > "$AUTOSAVE_SEEN" 2>/dev/null || true
 fi
 
+# Staged auto-saves awaiting the user's merge (the /autosave consent gate).
+# Live gh query so the line persists until the PRs actually merge — the
+# ledger cursor above only reports once. Fail-soft when gh/network is out.
+if command -v gh >/dev/null 2>&1; then
+  GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+  if [ -n "$GH_SELF" ]; then
+    WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \
+      --json number,title --jq '[.[] | select(.title | startswith("Auto-save:")) | .number] | join(", #")' 2>/dev/null || true)
+    if [ -n "$WAITING_AS" ]; then
+      printf "  ⟲ auto-saves awaiting your merge: PR #%s — say \"merge my auto-saves\"\n" "$WAITING_AS"
+    fi
+  fi
+fi
+
 # Greeting links. Org config `pinned_links` in egregore.json replaces the
 # default dashboard + board links. Entries are strings or {url, label}.
 # (OSC 8 hyperlink — clickable text in supported terminals)

package/runtime/pi/bin/session-autosave.sh

@@ -87,6 +87,26 @@ touch "$STAMP" 2>/dev/null || true
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_ROOT/bin/lib/noncode.sh" 2>/dev/null || exit 0
 
+# --- Per-user consent settings (bin/autosave.sh / the /autosave skill) ----
+# enabled=false  → fully off, nothing captured ambiently
+# scope=handoffs → memory repo only; the core repo is never touched ambiently
+# publish=gate   → PR is opened but NEVER merged without the user's word
+# NB: jq's `//` swallows false (falsy) — `.k // empty` on k:false yields the
+# default, silently re-enabling autosave. Test key presence instead (this is
+# the same trap that broke auto_update:false).
+_as_conf() { # key default
+  local v
+  v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$DIR/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] || v=$(jq -r "if (.$1 != null) then (.$1|tostring) else empty end" "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null)
+  [ -n "$v" ] && echo "$v" || echo "$2"
+}
+# Autosave is an opt-in experiment: enabled defaults to FALSE. Nothing is
+# captured ambiently until the user runs `/autosave on` (or autosave.sh on).
+AS_ENABLED=$(_as_conf autosave_enabled false)
+AS_SCOPE=$(_as_conf autosave_scope all)
+AS_PUBLISH=$(_as_conf autosave_publish gate)
+[ "$AS_ENABLED" = "true" ] || exit 0
+
 if [ -z "$AUTHOR" ]; then
   AUTHOR=$(jq -r '.github_username // .name // empty' "$DIR/.egregore-state.json" 2>/dev/null || true)
   [ -n "$AUTHOR" ] || AUTHOR=$(jq -r '.github_username // .name // empty' "$SCRIPT_ROOT/.egregore-state.json" 2>/dev/null || true)
@@ -111,6 +131,10 @@ if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   fi
 fi
 
+# scope=handoffs: memory (above) is the handoff channel; stop before the
+# core repo — it is never captured ambiently under this scope.
+[ "$AS_SCOPE" = "handoffs" ] && exit 0
+
 # --- Core repo gate: everything pending must be non-coding ---------------
 # -uall expands untracked dirs to individual files: a collapsed "docs/" entry
 # would defeat both the classifier (code nested under a content dir) and the
@@ -144,7 +168,7 @@ ORIG_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 
 bash "$SCRIPT_ROOT/bin/handoff-save-egregore.sh" "$AUTHOR" \
   "session content $(date +%Y-%m-%d)" --kind autosave --repo-dir "$DIR" \
-  --branch-suffix "$DIR_HASH" \
+  --branch-suffix "$DIR_HASH" --publish "$AS_PUBLISH" \
   >/dev/null 2>&1 || true
 
 # Tell the user what just happened. Under the Stop hook this line surfaces in
@@ -162,6 +186,7 @@ if [ -n "$LAST" ]; then
   if [ $(( NOW_EPOCH - TS_EPOCH )) -lt 120 ]; then
     case "$RESULT" in
       merged) echo "⟲ auto-saved: $NF non-coding file(s) → develop (PR #$PR merged)" ;;
+      staged) echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR — yours to merge (say \"merge my auto-saves\" or /autosave)" ;;
       open)   echo "⟲ auto-saved: $NF non-coding file(s) → PR #$PR (merge pending)" ;;
       *)      echo "⟲ auto-saved: $NF non-coding file(s) → branch pushed (PR pending)" ;;
     esac