create-egregore 0.19.20 → 0.19.22

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.20
+// egregore-launcher-version: 0.19.22
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.20";
+const VERSION = "0.19.22";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -435,7 +435,33 @@ function piTrustArgs() {
 }
 
 function commandExists(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
+  if (typeof bin !== "string" || bin.length === 0) return false;
+  const pathValue = process.env.PATH || process.env.Path || process.env.path || "";
+  const separator = process.platform === "win32" ? ";" : ":";
+  const names =
+    process.platform === "win32" && !path.extname(bin)
+      ? (process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD")
+          .split(";")
+          .filter(Boolean)
+          .map((extension) => `${bin}${extension.toLowerCase()}`)
+      : [bin];
+
+  return pathValue.split(separator).some((entry) => {
+    const directory = entry ? entry.replace(/^"(.*)"$/, "$1") : process.cwd();
+    return names.some((name) => {
+      const candidate = path.join(directory, name);
+      try {
+        if (!fs.statSync(candidate).isFile()) return false;
+        fs.accessSync(
+          candidate,
+          process.platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK,
+        );
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  });
 }
 
 function runtimeChoiceDescription(runtime, inst, stored) {
@@ -629,7 +655,14 @@ async function renderCodexStartupCard(egregoreDir) {
       const result = await runCapturedWithSpinner("bash", [script], {
         cwd: egregoreDir,
       }, "Preparing Codex startup");
-      if (result.stdout) process.stdout.write(result.stdout);
+      let output = result.stdout || "";
+      if (isConnectedPath(egregoreDir) && !output.includes("◆ CONNECTED")) {
+        const connectedLine = "  ◆ CONNECTED · hosted graph active\n";
+        output = output.includes("\nWhat are you working on?")
+          ? output.replace("\nWhat are you working on?", `\n${connectedLine}\nWhat are you working on?`)
+          : `${output}${output.endsWith("\n") || !output ? "" : "\n"}${connectedLine}`;
+      }
+      if (output) process.stdout.write(output);
       if (result.status !== 0 && result.stderr) process.stderr.write(result.stderr);
       if (result.status === 0) return true;
     } catch {}
@@ -751,6 +784,7 @@ async function launch(inst, runtimeOverride) {
   if (!runtime) return;
   if (runtime === "claude-code") {
     normalizeClaudeDenyRules(inst.path);
+    ensureClaudeModeStatusLine(inst.path);
   }
   const binary = runtimeBinary(runtime);
   if (!commandExists(binary)) {
@@ -816,13 +850,17 @@ function cmdLs() {
   const slugW = Math.min(24, Math.max(...registry.map((r) => (r.slug || "").length)));
   const nameW = Math.min(24, Math.max(...registry.map((r) => (r.name || "").length)));
   const runtimeW = Math.max(9, ...registry.map((r) => runtimeShort(runtimeFor(r)).length));
+  const modeW = "◆ CONNECTED".length;
   console.log(`\n  ${BOLD}${registry.length}${RESET} egregore${registry.length === 1 ? "" : "s"} registered\n`);
-  console.log(`    ${DIM}${pad("SLUG", slugW)}  ${pad("NAME", nameW)}  ${pad("ASSISTANT", runtimeW)}  PATH${RESET}`);
+  console.log(`    ${DIM}${pad("SLUG", slugW)}  ${pad("NAME", nameW)}  ${pad("MODE", modeW)}  ${pad("ASSISTANT", runtimeW)}  PATH${RESET}`);
   for (const inst of registry) {
     const marker = inst.slug === def ? `${GREEN}●${RESET}` : " ";
     const slug = inst.slug === def ? `${BOLD}${pad(inst.slug, slugW)}${RESET}` : pad(inst.slug, slugW);
     const runtime = pad(runtimeShort(runtimeFor(inst)), runtimeW);
-    console.log(`  ${marker} ${slug}  ${pad(inst.name || "", nameW)}  ${runtime}  ${DIM}${inst.path}${RESET}`);
+    const mode = isConnectedInstance(inst)
+      ? `${CYAN}${pad("◆ CONNECTED", modeW)}${RESET}`
+      : `${DIM}${pad("◇ LOCAL", modeW)}${RESET}`;
+    console.log(`  ${marker} ${slug}  ${pad(inst.name || "", nameW)}  ${mode}  ${runtime}  ${DIM}${inst.path}${RESET}`);
   }
   if (def) console.log(`\n  ${GREEN}●${RESET} = default marker (used by non-interactive ${BOLD}egregore${RESET})\n`);
   else console.log("");
@@ -936,6 +974,22 @@ function readJsonFile(file) {
   }
 }
 
+function isConnectedConfig(config) {
+  return (
+    config?.mode === "connected" &&
+    typeof config.api_url === "string" &&
+    config.api_url.trim().length > 0
+  );
+}
+
+function isConnectedPath(instancePath) {
+  return isConnectedConfig(readJsonFile(path.join(instancePath, "egregore.json")));
+}
+
+function isConnectedInstance(inst) {
+  return !!inst?.path && isConnectedPath(inst.path);
+}
+
 function readEnvValues(file) {
   const values = {};
   if (!fs.existsSync(file)) return values;
@@ -1233,6 +1287,47 @@ function normalizeClaudeDenyRules(instancePath) {
   }
 }
 
+const CLAUDE_MODE_STATUS_MARKER = "# egregore-connected-status-v1";
+const CLAUDE_DEFAULT_STATUS_COMMAND = "\"${CLAUDE_PROJECT_DIR}/bin/statusline.sh\"";
+
+function claudeModeStatusCommand(baseCommand) {
+  return [
+    CLAUDE_MODE_STATUS_MARKER,
+    "MODE=$(jq -r 'if (.mode == \"connected\" and ((.api_url // \"\") | length > 0)) then \"connected\" else \"local\" end' \"${CLAUDE_PROJECT_DIR}/egregore.json\" 2>/dev/null)",
+    `BASE=$( ( ${baseCommand} ) 2>/dev/null || true)`,
+    "if [ \"$MODE\" = \"connected\" ]; then",
+    "  case \"$BASE\" in",
+    "    *\"◆ CONNECTED\"*) printf '%s\\n' \"$BASE\" ;;",
+    "    \"\") printf '◆ CONNECTED\\n' ;;",
+    "    *) printf '◆ CONNECTED · %s\\n' \"$BASE\" ;;",
+    "  esac",
+    "else",
+    "  printf '%s\\n' \"$BASE\"",
+    "fi",
+  ].join("\n");
+}
+
+function ensureClaudeModeStatusLine(instancePath) {
+  if (!isConnectedPath(instancePath)) return false;
+  const file = path.join(instancePath, ".claude", "settings.local.json");
+  const settings = readJsonFile(file);
+  const current = settings?.statusLine;
+  if (current?.type === "command" && current?.command?.includes(CLAUDE_MODE_STATUS_MARKER)) {
+    return false;
+  }
+  const baseCommand = current?.type === "command" && current?.command?.trim()
+    ? current.command
+    : CLAUDE_DEFAULT_STATUS_COMMAND;
+  settings.statusLine = {
+    ...(current || {}),
+    type: "command",
+    command: claudeModeStatusCommand(baseCommand),
+  };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  writeJsonFileAtomic(file, settings);
+  return true;
+}
+
 function writeEnvValueAtomic(file, key, value) {
   const lines = fs.existsSync(file)
     ? fs.readFileSync(file, "utf-8").split(/\r?\n/)
@@ -1323,6 +1418,8 @@ async function cmdConnect(args) {
   }
   const activation = state.connected_activation || {};
   if (cfg.mode === "connected" && activation.status === "connected") {
+    normalizeClaudeDenyRules(inst.path);
+    ensureClaudeModeStatusLine(inst.path);
     console.log(`\n  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is already connected.\n`);
     return;
   }
@@ -1462,6 +1559,7 @@ async function cmdConnect(args) {
   });
   writeEnvValueAtomic(envFile, "EGREGORE_API_KEY", claim.data.api_key);
   normalizeClaudeDenyRules(inst.path);
+  ensureClaudeModeStatusLine(inst.path);
   persistConnectState(inst, {
     status: "backfilling",
     activation_protocol: claim.data.activation_protocol,
@@ -1938,7 +2036,8 @@ function loadPreview(inst) {
       data.telegram = !!(cfg.telegram_chat_id || cfg.telegram_group_link);
       data.org = cfg.org_name;
       data.githubOrg = cfg.github_org;
-      data.mode = cfg.mode;
+      data.connected = isConnectedConfig(cfg);
+      data.mode = data.connected ? "connected" : "local";
       data.flowVariant = cfg.flow_variant;
     }
   } catch {}
@@ -2011,7 +2110,8 @@ function renderHeroPanel({ selected, pv, width, height, countSuffix, filter, fil
   }
   lines.push(emptyBoxLine(innerWidth, margin));
   lines.push(updateBand || mid);
-  lines.push(boxLine(`${BOLD}${title}${RESET} ${DIM}· ${org} · ${runtime} · ${countSuffix} · ${filterText}${RESET}`, innerWidth, margin));
+  const connectedHero = pv?.connected ? ` · ${CYAN}◆ CONNECTED${RESET}` : "";
+  lines.push(boxLine(`${BOLD}${title}${RESET} ${DIM}· ${org} · ${runtime}${RESET}${connectedHero}${DIM} · ${countSuffix} · ${filterText}${RESET}`, innerWidth, margin));
   lines.push(boxLine(`${DIM}skills${RESET} ${skillStatus}`, innerWidth, margin));
   lines.push(emptyBoxLine(innerWidth, margin));
 
@@ -2065,6 +2165,13 @@ function renderRuntimePanel({ inst, cursor, width, height }) {
     emptyBoxLine(innerWidth, margin),
     boxLine(`${BOLD}${CYAN}Launch ${title}${RESET}`, innerWidth, margin),
     boxLine(`${DIM}${inst.path}${RESET}`, innerWidth, margin),
+    boxLine(
+      isConnectedInstance(inst)
+        ? `${CYAN}◆ CONNECTED${RESET} ${DIM}· hosted graph active${RESET}`
+        : `${DIM}◇ LOCAL · Markdown + Git${RESET}`,
+      innerWidth,
+      margin,
+    ),
     emptyBoxLine(innerWidth, margin),
   ];
 
@@ -2381,10 +2488,13 @@ async function browser(args = {}) {
         ? `${DIM}${pad(e.name || "", nameW)}${RESET}`
         : pad(e.name || "", nameW);
       const pathAvail = Math.max(0, listAvail - slugW - nameW - 10);
+      const connected = isConnectedInstance(e);
+      const modeBadge = connected ? `${CYAN}◆ CONNECTED${RESET}` : "";
+      const adjustedPathAvail = Math.max(0, pathAvail - (connected ? "◆ CONNECTED  ".length : 0));
       const pathDim = isMissing
-        ? `${RED}✗${RESET} ${DIM}${truncate(e.path, Math.max(8, pathAvail - 12))}${RESET} ${RED}(missing)${RESET}`
-        : `${DIM}${truncate(e.path, pathAvail)}${RESET}`;
-      const line = ` ${cursorMark} ${defMark}  ${slug}  ${name}  ${pathDim}`;
+        ? `${RED}✗${RESET} ${DIM}${truncate(e.path, Math.max(8, adjustedPathAvail - 12))}${RESET} ${RED}(missing)${RESET}`
+        : `${DIM}${truncate(e.path, adjustedPathAvail)}${RESET}`;
+      const line = ` ${cursorMark} ${defMark}  ${slug}  ${name}  ${modeBadge}${modeBadge ? "  " : ""}${pathDim}`;
       out.push(M + " ".repeat(listPad - 3) + line + ANSI.clearLine + "\n");
     }
 
@@ -2411,6 +2521,9 @@ async function browser(args = {}) {
         ? `  ${label("path")} ${RED}✗${RESET} ${truncate(selected.path, Math.max(8, valW - 12))} ${RED}(missing)${RESET}`
         : `  ${label("path")} ${truncate(selected.path, valW)}`);
       if (pv.org) previewLines.push(`  ${label("org")} ${truncate(`${pv.org} ${DIM}(${pv.githubOrg || "?"})${RESET}`, valW)}`);
+      previewLines.push(pv.connected
+        ? `  ${label("mode")} ${CYAN}◆ CONNECTED${RESET} ${DIM}· hosted graph active${RESET}`
+        : `  ${label("mode")} ${DIM}◇ LOCAL · Markdown + Git${RESET}`);
       if (pv.branch) previewLines.push(`  ${label("branch")} ${BOLD}${pv.branch}${RESET}`);
       if (pv.lastCommit) previewLines.push(`  ${label("last")} ${DIM}${truncate(pv.lastCommit, valW)}${RESET}`);
       if (pv.repos && pv.repos.length) {
@@ -2424,7 +2537,6 @@ async function browser(args = {}) {
       }
       const modeBits = [];
       modeBits.push(runtimeShort(runtimeFor(selected, args.runtimeOverride)));
-      if (pv.mode) modeBits.push(pv.mode);
       if (pv.flowVariant && pv.flowVariant !== "legacy") modeBits.push(pv.flowVariant);
       if (pv.telegram) modeBits.push("telegram");
       if (selected.slug === def) modeBits.push("default");

package/bin/cli.js

@@ -44,6 +44,7 @@ const {
   redactToken,
 } = require("../lib/setup");
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
+const { commandExists } = require("../lib/path-lookup");
 
 const API_URL = process.env.EGREGORE_API_URL || "https://egregore-production-55f2.up.railway.app";
 const INSTANCES_FILE = path.join(os.homedir(), ".egregore", "instances.json");
@@ -97,7 +98,7 @@ function detectCwdEgregore(cwd) {
 }
 
 function binaryOnPath(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
+  return commandExists(bin);
 }
 
 function assistantLabel(runtime) {
@@ -406,7 +407,6 @@ async function preflight() {
   // Verify prerequisites before starting. Fast fail with specific fix hints
   // beats discovering missing tools mid-install. Claude Code is checked
   // separately at auto-exec time since users can install it after.
-  const { spawnSync } = require("node:child_process");
   const checks = [
     { bin: "git",    hint: "install Xcode command-line tools or https://git-scm.com" },
     { bin: "jq",     hint: "brew install jq  (or https://stedolan.github.io/jq/)" },
@@ -417,8 +417,7 @@ async function preflight() {
     missing.push({ bin: "node >=18", hint: `you're on Node ${process.versions.node}; upgrade at https://nodejs.org` });
   }
   for (const c of checks) {
-    const r = spawnSync("which", [c.bin], { stdio: "pipe" });
-    if (r.status !== 0) missing.push(c);
+    if (!commandExists(c.bin)) missing.push(c);
   }
   if (missing.length === 0) return;
 

package/lib/auth.js

@@ -5,6 +5,7 @@
 
 const https = require("node:https");
 const { spawnSync } = require("node:child_process");
+const { commandExists } = require("./path-lookup");
 
 /**
  * Try to get a token from the user's `gh` CLI, if installed and authenticated.
@@ -31,8 +32,7 @@ function envGhAuth() {
 
 function ghCliExists() {
   if (process.env.EGREGORE_SKIP_GH === "1") return false;
-  const which = spawnSync("which", ["gh"], { stdio: "pipe" });
-  return which.status === 0;
+  return commandExists("gh");
 }
 
 function canUseInteractiveBrowserFlow() {
@@ -46,8 +46,7 @@ const GH_INSTALL_URL = "https://cli.github.com";
 // and repos vary too much for a single command, so we point at the canonical
 // page there (and always print GH_INSTALL_URL alongside on every platform).
 function _has(b) {
-  try { return spawnSync("which", [b], { stdio: "pipe" }).status === 0; }
-  catch { return false; }
+  return commandExists(b);
 }
 
 // True on a machine with no way to open a browser (server / SSH). macOS and

package/lib/path-lookup.js

@@ -0,0 +1,59 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+function executableFile(candidate, platform) {
+  try {
+    if (!fs.statSync(candidate).isFile()) return false;
+    fs.accessSync(
+      candidate,
+      platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK,
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function executableNames(command, env, platform) {
+  if (platform !== "win32" || path.extname(command)) return [command];
+  const pathExt = env.PATHEXT || ".COM;.EXE;.BAT;.CMD";
+  return pathExt
+    .split(";")
+    .filter(Boolean)
+    .map((extension) => `${command}${extension.toLowerCase()}`);
+}
+
+/**
+ * Resolve a command from PATH without relying on the external `which` utility.
+ *
+ * NixOS provides declared executables through PATH but does not guarantee
+ * `which` is installed. Keeping this lookup in Node also avoids spawning a
+ * subprocess for every prerequisite and harness check.
+ */
+function commandExists(command, options = {}) {
+  if (typeof command !== "string" || command.length === 0) return false;
+
+  const env = options.env || process.env;
+  const platform = options.platform || process.platform;
+  const cwd = options.cwd || process.cwd();
+  const separator = platform === "win32" ? ";" : ":";
+  const pathValue = env.PATH || env.Path || env.path || "";
+  const names = executableNames(command, env, platform);
+  const hasPathSeparator =
+    path.isAbsolute(command) || command.includes("/") || command.includes("\\");
+
+  if (hasPathSeparator) {
+    return names.some((name) =>
+      executableFile(path.isAbsolute(name) ? name : path.resolve(cwd, name), platform),
+    );
+  }
+
+  return pathValue.split(separator).some((entry) => {
+    const directory = entry ? entry.replace(/^"(.*)"$/, "$1") : cwd;
+    return names.some((name) => executableFile(path.join(directory, name), platform));
+  });
+}
+
+module.exports = { commandExists };

package/lib/setup.js

@@ -17,6 +17,7 @@ const {
   installPiRuntime,
   reportPiRuntimeSummary,
 } = require("./pi-runtime");
+const { commandExists } = require("./path-lookup");
 
 const https = require("node:https");
 
@@ -154,6 +155,45 @@ function slugifyName(name) {
     .replace(/^-|-$/g, "");
 }
 
+/**
+ * Choose an install directory without ever adopting an unrelated checkout.
+ *
+ * Most Egregore forks are named "egregore", so deriving the target only from
+ * the fork basename makes different organizations collide in the same parent
+ * directory. If that default path is already a Git checkout with another
+ * origin, leave it untouched and use egregore-{org-slug}. The fallback must
+ * also be absent or point at the requested fork; otherwise stop rather than
+ * guessing at another path.
+ */
+function resolveEgregoreInstallDir(base, forkUrl, slug) {
+  const forkDirName = forkUrl.split("/").pop().replace(/\.git$/, "");
+  const requestedDir = path.join(base, forkDirName);
+  const requestedGitPath = path.join(requestedDir, ".git");
+
+  if (!fs.existsSync(requestedGitPath) || gitRemoteMatches(requestedDir, forkUrl)) {
+    return { egregoreDir: requestedDir, redirectedFrom: null };
+  }
+
+  const safeSlug = slugifyName(slug) || "instance";
+  const fallbackDir = path.join(base, `egregore-${safeSlug}`);
+  if (path.resolve(fallbackDir) === path.resolve(requestedDir)) {
+    throw new Error(
+      `Refusing to install into ${requestedDir}: its Git origin does not match ${forkUrl}`
+    );
+  }
+
+  if (fs.existsSync(fallbackDir)) {
+    const fallbackGitPath = path.join(fallbackDir, ".git");
+    if (!fs.existsSync(fallbackGitPath) || !gitRemoteMatches(fallbackDir, forkUrl)) {
+      throw new Error(
+        `Refusing to install into ${fallbackDir}: the fallback path already belongs to another checkout or directory`
+      );
+    }
+  }
+
+  return { egregoreDir: fallbackDir, redirectedFrom: requestedDir };
+}
+
 function normalizeUsageType(data = {}) {
   if (data.usage_type === "founder_group" || data.usage_type === "joiner_group") {
     return data.usage_type;
@@ -341,8 +381,17 @@ async function install(data, ui, targetDir, opts = {}) {
   const preferredRuntime = normalizeRuntime(opts.runtime);
 
   // Directory name from fork URL (what git clone would use), e.g. "egregore"
-  const forkDirName = fork_url.split("/").pop().replace(/\.git$/, "");
-  const egregoreDir = path.join(base, forkDirName);
+  let forkDirName = fork_url.split("/").pop().replace(/\.git$/, "");
+  const {
+    egregoreDir,
+    redirectedFrom,
+  } = resolveEgregoreInstallDir(base, fork_url, slug || github_org || org_name);
+  if (redirectedFrom) {
+    forkDirName = path.basename(egregoreDir);
+    ui.warn(
+      `${redirectedFrom} belongs to another Git origin — leaving it untouched and installing at ${egregoreDir}`
+    );
+  }
   const memoryDirName = memory_url
     .split("/")
     .pop()
@@ -953,10 +1002,6 @@ function installCodexSkills(egregoreDir) {
   return false;
 }
 
-function commandExists(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
-}
-
 function registerInstance(slug, name, egregoreDir, runtime) {
   const registryDir = path.join(os.homedir(), ".egregore");
   const registryFile = path.join(registryDir, "instances.json");
@@ -1433,5 +1478,6 @@ module.exports = {
   initMemoryDirs,
   ensureDevelop,
   ensureConnectedConfig,
+  resolveEgregoreInstallDir,
   run,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.20",
+  "version": "0.19.22",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -12,7 +12,7 @@
   "scripts": {
     "build:runtime": "node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/codex/.codex/hooks/branch-guard.js

@@ -145,8 +145,19 @@ function currentAuthor(projectDir) {
   }
 }
 
-function isProtectedBranch(branch) {
-  return branch === "develop" || branch === "main" || branch === "master";
+function configuredBaseBranch(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, "egregore.json"), "utf-8");
+    const value = JSON.parse(raw).base_branch;
+    return typeof value === "string" && value.trim() ? value.trim() : "develop";
+  } catch {
+    return "develop";
+  }
+}
+
+function isProtectedBranch(branch, projectDir) {
+  return branch === configuredBaseBranch(projectDir) ||
+    branch === "develop" || branch === "main" || branch === "master";
 }
 
 function isExemptPath(rawPath, projectDir, memoryDir) {
@@ -403,7 +414,7 @@ function main() {
   if (context.external) return;
   const projectDir = context.projectDir;
   const branch = currentBranch(projectDir);
-  if (!isProtectedBranch(branch)) return;
+  if (!isProtectedBranch(branch, projectDir)) return;
 
   // Consent bypass: the user explicitly chose to work on this protected branch.
   // Written only after they pick "Proceed on <branch>"; cleared on session start,

package/runtime/codex/.codex/skills/add/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/add/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/announce/SKILL.md

@@ -22,33 +22,46 @@ bash bin/publish-artifact.sh document "$FILE_PATH" --title "$TITLE" --author "$A
 Use `handoff`, `quest`, or `document` as the artifact type when appropriate.
 Never fabricate a URL.
 
-3. Preview the exact message. Confirm with structured Codex question tooling
-   when available; otherwise render:
+3. Follow `.claude/context/notification-consent.md`. Create a plan without
+   sending:
+
+```bash
+PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+```
+
+4. Preview the plan's exact organization, all deliveries/channels, and exact
+   final message. Confirm in a separate checkpoint with structured Codex
+   question tooling when available; otherwise render those fields followed by:
 
 ```text
 Send this announcement?
 1. Send
 2. Edit
-Other:
+3. Cancel
 ```
 
-4. If the user edits, redraft and preview again. If they approve, run:
+5. If the user edits, cancel the old plan, redraft, plan, and preview again.
+   If they cancel, cancel the plan and stop. Only after they select Send for
+   that exact preview, run:
 
 ```bash
-bash bin/notify.sh group "$MESSAGE"
+APPROVAL_JSON=$(bash bin/notify.sh approve "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
 ```
 
-5. Emit telemetry in the background:
+6. Emit telemetry in the background:
 
 ```bash
 bash bin/telemetry.sh emit "command" '{"command":"announce"}' >/dev/null 2>&1 &
 ```
 
-6. Confirm whether the group send succeeded.
+7. Confirm whether the exact approved group send succeeded.
 
 ## Rules
 
-- Always preview before sending.
+- The request to announce is not dispatch consent. Always use a dedicated
+  exact-delivery checkpoint.
 - Do not expose notification credentials.
 - Use `bin/notify.sh`; do not call Telegram directly.
 - Do not use Claude Code commands.