create-egregore 0.19.2 → 0.19.5

package/assets/egregore-launcher.js

@@ -48,6 +48,8 @@ const NATIVE_CODEX_SKILLS = [
   "invite",
   "ask",
   "save",
+  "view",
+  "scroll",
 ];
 
 const PRIMARY_CODEX_SKILLS = [
@@ -1372,7 +1374,7 @@ function renderHeroPanel({ selected, pv, width, height, countSuffix, filter, fil
   const skillGroups = [
     `${DIM}core${RESET}: ${workflows}`,
     `${DIM}team${RESET}: ${joinShort(["/handoff", "/ask", "/invite", "/quest"], Math.max(16, bodyWidth - 8))}`,
-    `${DIM}deeper${RESET}: ${joinShort(["/announce", "/harvest", "/the-spiral", "/deep-reflect"], Math.max(16, bodyWidth - 10))}`,
+    `${DIM}deeper${RESET}: ${joinShort(["/announce", "/harvest", "/the-spiral", "/deep-reflect", "/view", "/scroll"], Math.max(16, bodyWidth - 10))}`,
     `${DIM}fallback${RESET}: ${adapterCount} adapter skills`,
   ];
 

package/bin/cli.js

@@ -36,6 +36,7 @@ const {
   registerInstance,
   installLauncherBinary,
   normalizeRuntime,
+  redactToken,
 } = require("../lib/setup");
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
 
@@ -888,6 +889,8 @@ async function joinFlow(api, githubToken, choice, ctx) {
 }
 
 main().catch((err) => {
-  ui.error(err.message);
+  // Last-resort net: never let a credential reach the terminal via an
+  // unhandled error message (cloneRepo already redacts at the source).
+  ui.error(redactToken(err && err.message));
   process.exit(1);
 });

package/lib/local.js

@@ -25,6 +25,7 @@ const {
   installLauncherBinary,
   launchOrInstruct,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   initMemoryDirs,
@@ -81,6 +82,19 @@ async function repoExists(token, owner, repo) {
   return status === 200;
 }
 
+// Full repo metadata (or null). Used to detect `archived` when reclaiming a repo
+// that a prior egregore delete archived rather than hard-deleted.
+async function getRepoMeta(token, owner, repo) {
+  const { status, data } = await ghApi("GET", `/repos/${owner}/${repo}`, token);
+  return status === 200 ? data : null;
+}
+
+// Unarchive a repo so pushes/invites work again. Returns true on success.
+async function unarchiveRepo(token, owner, repo) {
+  const { status } = await ghApi("PATCH", `/repos/${owner}/${repo}`, token, { archived: false });
+  return status === 200;
+}
+
 async function createFromTemplate(token, owner, name, description) {
   const { status, data } = await ghApi(
     "POST",
@@ -342,12 +356,20 @@ function cloneRepo(url, dir, token, ui, label) {
     ui.warn(`${path.basename(dir)}/ already exists — pulling latest`);
     run("git pull", { cwd: dir });
   } else {
-    execFileSync("git", ["clone", embedToken(url, token), dir], {
-      stdio: "pipe",
-      encoding: "utf-8",
-      timeout: 60000,
-      env: gitCloneEnv(),
-    });
+    try {
+      execFileSync("git", ["clone", embedToken(url, token), dir], {
+        stdio: "pipe",
+        encoding: "utf-8",
+        timeout: 60000,
+        env: gitCloneEnv(),
+      });
+    } catch (err) {
+      // execFileSync puts the full command — including the embedded token — in
+      // err.message. Rethrow a redacted error that keeps git's stderr (the
+      // useful "remote: ..." lines) but never the credential.
+      const detail = [err.message, err.stderr].filter(Boolean).join("\n");
+      throw new Error(redactToken(detail, token));
+    }
     try {
       run(`git remote set-url origin ${url}`, { cwd: dir });
     } catch {}
@@ -1023,13 +1045,57 @@ async function localFounderFlow(ui, ctx = {}) {
     if (existingConfig) {
       s1.stop(`${githubOrg}/${repoName} already has Egregore set up`);
       console.log("");
-      ui.info("To join it:");
-      ui.info(`  ${ui.bold(joinCommand(githubOrg, repoName))}`);
-      console.log("");
-      ui.info("To set up a different one, choose a different team name.");
-      process.exit(0);
+
+      // The repo already carries an Egregore. You're legitimately here for one
+      // of three reasons: reclaim your own (e.g. the platform record was deleted
+      // but the repo survives), join someone else's, or you meant a fresh one.
+      // Reclaim reuses the repo in place — keeping its collaborators — so you
+      // don't get forced onto a new name and re-invite everyone.
+      const canPick = ui.canInteract && ui.canInteract();
+      const RECLAIM = { label: "Reuse this one — reconnect and finish setup", description: "Adopt the existing repo, keep its collaborators" };
+      const JOIN = { label: "Just join it", description: joinCommand(githubOrg, repoName) };
+      const RENAME = { label: "Set up a different Egregore", description: "Pick a different team name" };
+
+      let action = "join";
+      if (canPick) {
+        const picked = await ui.choose(
+          `${githubOrg}/${repoName} already exists — what do you want to do?`,
+          [RECLAIM, JOIN, RENAME],
+        );
+        action = picked.label === RECLAIM.label ? "reclaim"
+               : picked.label === RENAME.label ? "rename" : "join";
+      }
+
+      if (action === "join") {
+        ui.info("To join it:");
+        ui.info(`  ${ui.bold(joinCommand(githubOrg, repoName))}`);
+        console.log("");
+        ui.info("To set up a different one, choose a different team name.");
+        process.exit(0);
+      }
+      if (action === "rename") {
+        ui.info("Re-run setup and choose a different team name.");
+        process.exit(0);
+      }
+
+      // Reclaim: adopt the existing repo. If a prior delete archived it, unarchive
+      // so pushes/invites work. Fall through — the rest of the founder flow reuses
+      // the repo as-is and reconnects the platform record, preserving existing
+      // collaborators (so no redundant re-invite).
+      const meta = await getRepoMeta(githubToken, githubOrg, repoName);
+      if (meta && meta.archived) {
+        const s1b = ui.spinner(`Unarchiving ${githubOrg}/${repoName}...`);
+        if (await unarchiveRepo(githubToken, githubOrg, repoName)) {
+          s1b.stop(`Unarchived ${githubOrg}/${repoName}`);
+        } else {
+          s1b.fail(`Could not unarchive ${githubOrg}/${repoName} — unarchive it on GitHub, then re-run.`);
+          process.exit(1);
+        }
+      }
+      ui.success(`Reusing ${githubOrg}/${repoName} — reconnecting`);
+    } else {
+      s1.stop("Egregore repo exists but has no config — using it");
     }
-    s1.stop("Egregore repo exists but has no config — using it");
   } else {
     try {
       await createFromTemplate(githubToken, githubOrg, repoName, description);

package/lib/setup.js

@@ -596,6 +596,20 @@ function embedToken(url, token) {
   }
 }
 
+// Strip credentials from any text before it reaches the terminal. execFileSync
+// bakes the full argv into its thrown error message, so an authenticated
+// `git clone https://x-access-token:<pat>@github.com/...` leaks the token
+// verbatim if that error is printed. Redacts the known token, any userinfo in
+// an https URL, and bare GitHub token shapes as a backstop.
+function redactToken(text, token) {
+  let s = text == null ? "" : String(text);
+  if (token) s = s.split(token).join("***");
+  s = s.replace(/(https:\/\/)[^@/\s]+@/g, "$1***@"); // https://user:secret@host → https://***@host
+  s = s.replace(/gh[posru]_[A-Za-z0-9_]+/g, "***");  // ghp_/gho_/ghs_/ghu_/ghr_
+  s = s.replace(/github_pat_[A-Za-z0-9_]+/g, "***");
+  return s;
+}
+
 function toSSH(url) {
   const m = url.match(/https:\/\/github\.com\/(.+?)(?:\.git)?$/);
   return m ? `git@github.com:${m[1]}.git` : null;
@@ -1255,6 +1269,7 @@ module.exports = {
   ensurePersonOnboardingWitness,
   ensureInstallerMemberRole,
   embedToken,
+  redactToken,
   configureGitCredentials,
   gitCloneEnv,
   assistantInstallCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.2",
+  "version": "0.19.5",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {
@@ -30,7 +30,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/egregore-labs/egregore.git"
+    "url": "git+https://github.com/Curve-Labs/egregore.git"
   },
   "homepage": "https://github.com/egregore-labs/egregore"
 }

package/runtime/codex/.codex/hooks/search-hint.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+"use strict";
+// search-hint.js — UserPromptSubmit hook (Codex runtime).
+//
+// Mirror of .claude/hooks/search-hint.sh: when the user's prompt is
+// recall-shaped ("find the handoff about…", "did we decide…"), inject a
+// routing hint toward `bin/agent.sh search` — one ranked call over
+// memory/ — instead of improvised ls/grep/graph exploration.
+//
+// Advisory only, never blocks, rate-limited once per session, exits 0.
+// If the Codex runtime does not fire UserPromptSubmit, this file is inert.
+
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+
+function readStdin() {
+  try { return fs.readFileSync(0, "utf-8"); } catch { return ""; }
+}
+function parseJson(raw) {
+  try { return JSON.parse(raw || "{}"); } catch { return {}; }
+}
+
+const input = parseJson(readStdin());
+const prompt = String(input.prompt || input.user_prompt || "");
+if (!prompt) process.exit(0);
+
+const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+if (!fs.existsSync(path.join(root, "bin", "search.sh"))) process.exit(0);
+
+// Already oriented toward search.
+if (/(\/search\b|search\.sh|\bsearch (the )?memory\b)/i.test(prompt)) process.exit(0);
+
+const RECALL = new RegExp(
+  [
+    "\\b(find|locate|dig up|look up|pull up)\\b.*\\b(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\\b",
+    "\\bdid we (decide|discuss|agree|say|talk about|cover)\\b",
+    "\\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\\b",
+    "\\bwhat did we (decide|say|agree|discuss)\\b",
+    "\\bhave we (discussed|decided|covered|talked about|looked at)\\b",
+    "\\bnotes on\\b",
+    "\\bhandoff (from|about)\\b",
+    "\\bwho worked on\\b",
+    "\\bdidn.?t (someone|we) already\\b",
+    "\\bwas there (a|any) (handoff|decision|discussion|meeting)\\b",
+  ].join("|"),
+  "i"
+);
+if (!RECALL.test(prompt)) process.exit(0);
+
+// Rate-limit once per session.
+let sid = "default";
+try { sid = fs.readFileSync(path.join(root, ".egregore-session-id"), "utf-8").trim() || "default"; } catch {}
+const flag = path.join(os.tmpdir(), `egregore-search-hint-${sid}`);
+if (fs.existsSync(flag)) process.exit(0);
+try { fs.writeFileSync(flag, "1"); } catch {}
+
+process.stdout.write(JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: "UserPromptSubmit",
+    additionalContext:
+      "Routing hint: this prompt asks for recall from org memory. FIRST action: `bin/agent.sh search \"<the concept, not the literal sentence>\"` — one ranked call over all of memory/ (hybrid keyword+semantic; graph-state annotations attach automatically in connected mode). Read the top hits and cite paths. Do NOT improvise ls/grep/graph exploration first — hand-written graph queries against invented labels (e.g. :Handoff — handoffs are :Session nodes) return empty. Full spec: the search skill.",
+  },
+}) + "\n");
+process.exit(0);

package/runtime/codex/.codex/hooks.json

@@ -1,5 +1,18 @@
 {
   "hooks": {
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/search-hint.js\"",
+            "timeout": 5,
+            "statusMessage": "Checking recall routing"
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
       {
         "matcher": "Bash|apply_patch|Edit|Write",

package/runtime/codex/.codex/skills/deep-reflect/SKILL.md

@@ -23,28 +23,32 @@ signals outside the lens.
 1. Check `egregore.json` mode first. In local mode, do a lightweight reflection
    from memory files and do not call graph, batch graph, or notification
    scripts.
-2. In connected mode, gather graph context with `bin/graph.sh` and suppress raw
-   JSON. Query recent sessions, active quests, recent artifacts, decisions,
-   the topic landscape, and the full artifact landscape.
-3. If the graph is unavailable or has fewer than about ten artifacts, fall back
+2. In all modes, run `bin/agent.sh search "$TOPIC" -n 6` — hybrid content
+   recall over the whole memory repo. Feed strong hits into the candidate
+   set; in local mode this is the primary context source.
+3. In connected mode, additionally gather graph context with `bin/graph.sh`
+   and suppress raw JSON. Query recent sessions, active quests, recent
+   artifacts, decisions, the topic landscape, and the full artifact
+   landscape.
+4. If the graph is unavailable or has fewer than about ten artifacts, fall back
    to lightweight reflection and say why in one line.
-4. Select candidate artifacts. Prefer title, type, topics, quest, author, and
+5. Select candidate artifacts. Prefer title, type, topics, quest, author, and
    date metadata first; fetch file contents only for the selected subset.
-5. Use Codex multi-agent or subagent tooling only if it is available in the
+6. Use Codex multi-agent or subagent tooling only if it is available in the
    current session. If not, run a single-model staged analysis:
    - candidate selection summary
    - evidence extraction summary
    - signal analysis
    - final synthesis
-6. Classify signals as tension, convergence, gap, dependency, phase shift,
+7. Classify signals as tension, convergence, gap, dependency, phase shift,
    redundancy, emergence, reinforcement, or a named custom type.
-7. Write a markdown artifact under `memory/knowledge/deep-reflect/` with
+8. Write a markdown artifact under `memory/knowledge/deep-reflect/` with
    frontmatter for run id, mode, lens, author, created time, and selected
    evidence paths.
-8. In connected mode, write best-effort graph edges with `bin/graph.sh` or
+9. In connected mode, write best-effort graph edges with `bin/graph.sh` or
    `bin/graph-batch.sh`. Use `TENSION_WITH` for conflict signals and
    `RELATES_TO` for other signals.
-9. Save memory and repo changes with `bin/agent.sh save --message "Deep reflect: $TOPIC" --topic "$TOPIC"`.
+10. Save memory and repo changes with `bin/agent.sh save --message "Deep reflect: $TOPIC" --topic "$TOPIC"`.
 
 ## Output
 

package/runtime/codex/.codex/skills/minion/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: minion
+description: '>'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore minion Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/minion/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph, publish, and notify steps as best-effort unless that workflow
+   explicitly says they are required.
+4. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/scroll/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: scroll
+description: 'Compose and tend an Egregore living paper with an explanatory face, embedded decision harvest, stable published URL, and versioned paste-back update loop. Use when the user invokes /scroll or $scroll, asks for a living paper or a spec with questions inside, presents a proposal/architecture/product/feature with open forks, or pastes a versioned scroll decisions return block.'
+---
+
+# Egregore Scroll
+
+Native Codex Egregore skill. Use only inside an Egregore checkout.
+
+A scroll is one self-contained Meridian HTML artifact with two linked views:
+the readable paper and the open decisions living inside it. Every return block
+updates the same artifact at the same stable id.
+
+Use `$view` for a static document with no pending decisions, `$harvest` for
+elicitation without a published explaining face, and a concise question for one
+small fork. A scroll requires all three legs: face, harvest, and update loop.
+
+## Structured UX parity
+
+The browser artifact is the primary output. Preserve both tabs, deep links from
+honest costs into decisions, the versioned copydock fence, stable URL, and local
+source path. Do not substitute a prose-only summary or expose raw publish output.
+
+## Route the invocation
+
+- A normal request creates version 1.
+- A pasted block matching `#<slug>-decisions:v<N>` runs the update loop.
+- If a pasted version is stale, absorb still-applicable answers and state which
+  forks moved after that version.
+
+Run inline with shell and filesystem tools. Do not invoke Claude Code commands
+or Loom delegation.
+
+## Build a new scroll
+
+1. Read the source design, relevant memory, code, and quest context in full.
+2. Derive a stable kebab-case slug of at most 50 characters. Create:
+   - surface id `ds-<date>-<slug>`;
+   - harvest id `harvest-<date>-<slug>`;
+   - a short unique `<prefix>.harvest` browser storage key.
+3. Copy `.codex/skills/scroll/assets/shell.html` into `tmp/<slug>/index.html`.
+   Keep this build source in the worktree so future turns can tend it.
+4. Inject the canonical design-system CSS at build time from
+   `packages/egregore-artifacts/lib/vendor/design-system/dist/egregore-design.css`
+   into `/*__MERIDIAN_CSS__*/`. If the packages tree is unavailable, extract the
+   same path from `egregore-artifacts@latest` rather than freezing tokens.
+5. Fill every placeholder and replace the `__FACE__` and `__HARVEST__` slot
+   comments using the grammar documented in the shell.
+
+### Write the face
+
+Create a light paper, not a transcript dump:
+
+- A paper header with kicker, title, italic subtitle, grounds, date, and
+  `Version vN — updates in place at this URL`.
+- The setting: current reality, load-bearing verified numbers, the gap, and a
+  thesis reframe.
+- Two to four genuinely different mental models that stress-test the design.
+- The machine: concrete anatomy and protocol, using layers, steps, and
+  tokenized SVG figures. Mark illustrative charts `shapes, not measurements`.
+- Consequences for product or practice.
+- Honest costs as cards. Every cost must call `goFork('<fork-id>')` and link to
+  the harvest decision that prices it.
+
+### Write the harvest
+
+Create two to four bands of decision cards. Each card needs:
+
+- a stable fork id, grounded framing, and a reference back into the face;
+- two to four real options, each with one credible advantage and disadvantage;
+- at most one starred lean, presented as a position to challenge;
+- a why textarea whose note returns with the pick.
+
+Add open prompts for material that is not a fork. Prefer questions grounded in
+the work over meta-prompts asking what to ask next. The copydock must emit:
+
+```text
+#<slug>-decisions:v<N>
+surface: <surface-id>
+harvest: <harvest-id>
+date: <date>
+
+Q1 <fork-id>: <key>  ("<label>")   | UNDECIDED
+   note: <why, verbatim>
+O1 <prompt-id>: <text | UNDECIDED>
+```
+
+## Theme and asset constraints
+
+Choose the default theme pair from the primary reader's recorded preference
+when available: `sovereign`/`bedrock`, `meridian`/`nocturne`, or
+`agronomic`/`soil`. Record a newly stated preference in that person's memory
+profile.
+
+Keep theme state on `<html data-theme>` and restore it before paint. In authored
+body content and SVGs, every theme-sensitive fill, stroke, background, border,
+and text color must use `var(--token)`. Do not emit inline hex colors. Preserve
+the shell's persisted palette picker and print/mobile behavior.
+
+Before publishing:
+
+1. Confirm no `__[A-Z_]*__` placeholders remain.
+2. Check tag balance and that every `goFork()` id has one matching
+   `data-decision` card.
+3. Grep authored content for raw hex and resolved inline palette values.
+4. Capture both `file://...` and `file://...#harvest` views and inspect them.
+5. Confirm headings use the intended display face rather than a system serif.
+
+## Publish and record
+
+Publish connected configurations to the permanent slug:
+
+```bash
+bash bin/publish-artifact.sh document tmp/<slug>/index.html --raw-html \
+  --id <slug> --title "<title>" --author "<author>" \
+  --description "<description>"
+```
+
+Verify the returned URL, open it, and report it. Every later version must reuse
+the same `--id`; never mint a new URL for an update. In local mode, publishing
+is unavailable: open the file locally and report the source path without
+suggesting configuration changes.
+
+Add the URL or local path, source location, version, and fence tag to the
+relevant quest's log/artifacts tables. If no quest is relevant, keep the source
+path as the durable record and state it.
+
+## Update loop
+
+On a returned fence:
+
+1. **Absorb.** Parse Q/O lines and notes. Write durable decisions with their
+   reasoning to `memory/knowledge/decisions/`, update the underlying spec or
+   plan, and add connected HarvestTurn records when available. `UNDECIDED` is a
+   valid answer.
+2. **Rewrite the face.** Weave settled answers and reasoning into fresh prose,
+   mark them `decided v<N> · <date>`, and update linked cost cards to accepted,
+   mitigated, or remaining residuals.
+3. **Regenerate the harvest.** Retire answered cards. Carry an undecided fork
+   once at most; after two undecided returns, reframe it or demote it to an open
+   prompt. If its note actually resolves it, absorb the note as the decision.
+   Mint new forks from newly unlocked consequences, respondent requests, and
+   new ground truth.
+4. **Show, then ask.** When abstract forks run dry or the respondent asks for
+   something concrete, place the draft under discussion directly in the
+   harvest view with in-place reaction prompts.
+5. **Version.** Bump every version marker, update the copydock, and append a
+   one-line changelog with absorbed and newly opened forks.
+6. **Republish.** Publish to the same stable id, update the quest record, open
+   the refreshed URL, and state what changed and what the new version asks.
+
+Multiple returns against one version are separate turns. Merge compatible
+answers; turn conflicting choices into a new explicit fork instead of silently
+resolving them.
+
+## Voice and telemetry
+
+Write the face as external-grade Egregore prose: declarative, precise, grounded
+in real numbers, and honest about costs. Put metaphor in visuals rather than
+labels; prefer established terms over coinages.
+
+After completion, emit telemetry best-effort:
+
+```bash
+bash bin/telemetry.sh emit "command" '{"command":"scroll"}' 2>/dev/null &
+```
+
+Never call the deprecated `egregore-handoff` CLI.

package/runtime/codex/.codex/skills/scroll/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Egregore Scroll"
+  short_description: "Compose and tend a living design paper"
+  default_prompt: "Use $scroll to turn this design into a living paper with an embedded decision harvest."