create-egregore 0.19.20 → 0.19.22

package/runtime/codex/bin/lib/context.sh

@@ -449,10 +449,16 @@ fi
 ) > "$CTX_DIR/graph_health" 2>/dev/null &
 
 # 8. Telegram health (background)
+# notify.sh test emits JSON, not prose: {"status":"ok"} connected,
+# {"status":"configured"} local, {"status":"offline"} otherwise. Match the
+# status field — an earlier grep for the word "connected" read a human sentence
+# that the consent rewrite removed, so the footer showed telegram ✗ while the
+# bot was answering.
 (
   if [ "$LOCAL_MODE" = "true" ]; then
     echo "skip"
-  elif bash "$SCRIPT_DIR/bin/notify.sh" test 2>/dev/null | grep -q "connected"; then
+  elif bash "$SCRIPT_DIR/bin/notify.sh" test 2>/dev/null \
+    | jq -e '.status == "ok" or .status == "configured"' >/dev/null 2>&1; then
     echo "ok"
   else
     echo "fail"

package/runtime/codex/bin/lib/ensure-develop.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # ensure-develop.sh — Ensure a repository has a develop branch.
 #
 # Usage:

package/runtime/codex/bin/lib/git-sync.sh

@@ -11,12 +11,26 @@
 #   - Managed repos sync
 #
 # Inputs:  SCRIPT_DIR, IS_WORKTREE, MAIN_PROJECT_DIR, STATE_FILE, ENV_FILE,
-#          HEALTH_GIT, MANAGED_REPOS (not yet set — read from config here)
+#          HEALTH_GIT, BASE_BRANCH (optional — resolved here if unset),
+#          MANAGED_REPOS (not yet set — read from config here)
 # Outputs: HEALTH_GIT, DEVELOP_SYNCED, COMMITS_AHEAD, ACTION, SAVED_BRANCH,
 #          BRANCH, MEMORY_SYNCED, REPOS_STATUS, MANAGED_REPOS, CURRENT_BRANCH,
-#          FRAMEWORK_UPDATED
+#          FRAMEWORK_UPDATED, FRAMEWORK_UPDATED_COUNT, FRAMEWORK_UPDATED_FILES,
+#          BASE_BRANCH, BASE_BRANCH_READY
 
 FRAMEWORK_UPDATED="false"
+FRAMEWORK_UPDATED_COUNT=0
+FRAMEWORK_UPDATED_FILES=""
+
+# The core repo's integration branch: "develop" unless egregore.json sets
+# base_branch. session-start.sh resolves this before sourcing; resolve it here
+# too so the lib stands alone for other callers.
+if [ -z "${BASE_BRANCH:-}" ]; then
+  if ! BASE_BRANCH=$(_get_base_branch); then
+    HEALTH_GIT="fail"
+    return 1 2>/dev/null || exit 1
+  fi
+fi
 
 # --- Ensure pull.rebase is set (prevents "divergent branches" errors) ---
 git config pull.rebase true 2>/dev/null || true
@@ -73,13 +87,59 @@ wait 2>/dev/null || true
 # --- Auto-update framework from upstream (deferred) ---
 # Moved AFTER setup_develop() so framework commits land on develop, not on
 # working branches. See _apply_framework_update() below.
-_AUTO_UPDATE=$(jq -r '.auto_update // true' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+
+# _read_auto_update — resolve the auto_update flag. Correct, and FAIL CLOSED.
+#
+# This flag is the only thing standing between a user's checkout and a blind
+# `git checkout upstream/main --` over every framework path, so it has to be
+# read exactly right. It was not.
+#
+# The bug: `jq -r '.auto_update // true'`. jq's `//` returns its right-hand
+# side when the left is null *or false* — so a config saying
+# {"auto_update": false} evaluated to the string "true", and the guard
+# `[ "$_AUTO_UPDATE" = "false" ]` could never fire. The documented opt-out
+# has never disabled anything for anyone. Do not reintroduce `// <bool>` for
+# a flag whose `false` is meaningful; read the raw value and map it.
+#
+# Second failure: jq prints nothing and exits non-zero on a missing or
+# malformed egregore.json, and an empty string is not "false" either — so an
+# unreadable config also read as consent. Absent key means "on" (the intended
+# default); everything else that is not a parsed `true` means "leave the
+# user's files alone".
+_read_auto_update() {
+  local _config="$SCRIPT_DIR/egregore.json"
+  local _val
+  [ -f "$_config" ] || { echo "false"; return; }
+  # `| tojson`, not a bare `-r` read: under -r a *string* "true" renders as bare
+  # true, indistinguishable from boolean true, so {"auto_update": "true"} would
+  # re-authorize the overwrite — a fail-open hole in the middle of a fail-closed
+  # resolver. tojson keeps the quotes, so the true arm matches only an absent key
+  # or a real boolean.
+  _val=$(jq -r '.auto_update | tojson' "$_config" 2>/dev/null) || { echo "false"; return; }
+  case "$_val" in
+    null|true) echo "true" ;;   # key absent, or explicitly enabled
+    *)         echo "false" ;;  # false, "false", "true", garbage, or unparseable
+  esac
+}
 
 _apply_framework_update() {
-  # Applies framework paths from upstream to the CURRENT branch (must be develop).
+  # Applies framework paths from upstream to the CURRENT branch, which must be
+  # the configured base branch.
   # Disable with "auto_update": false in egregore.json.
   # Dev repos (upstream_url: "none") skip this entirely.
-  if [ "$_UPSTREAM_URL" = "none" ] || [ "$_AUTO_UPDATE" = "false" ]; then
+  #
+  # The flag is read HERE, not at source time: callers reach this function
+  # after setup_develop() has switched branches, and egregore.json may differ
+  # between the branch the session opened on and the configured base. Reading
+  # late means the config that is actually checked out is the config that
+  # decides.
+  local _update_branch
+  _update_branch=$(git branch --show-current 2>/dev/null) || return 1
+  if [ "$_update_branch" != "$BASE_BRANCH" ]; then
+    return 1
+  fi
+  _AUTO_UPDATE=$(_read_auto_update)
+  if [ "$_UPSTREAM_URL" = "none" ] || [ "$_AUTO_UPDATE" != "true" ]; then
     return 0
   fi
   if ! git show-ref --verify --quiet refs/remotes/upstream/main 2>/dev/null; then
@@ -90,8 +150,14 @@ _apply_framework_update() {
   for _p in bin/ .claude/commands/ .claude/skills/ .claude/hooks/ .claude/context/ .claude/agents/ loom/ CLAUDE.md skills/; do
     git checkout upstream/main -- "$_p" 2>/dev/null || true
   done
-  # Only commit if there are actual changes
-  if [ -n "$(git status --porcelain bin/ .claude/ loom/ CLAUDE.md skills/ 2>/dev/null | head -1)" ]; then
+  # Only commit if there are actual changes. Record WHAT changed before
+  # committing — an overwrite of local edits is the one outcome the user has
+  # to be able to see afterwards, and the commit is the only other record.
+  local _changed
+  _changed=$(git status --porcelain bin/ .claude/ loom/ CLAUDE.md skills/ 2>/dev/null)
+  if [ -n "$_changed" ]; then
+    FRAMEWORK_UPDATED_COUNT=$(printf '%s\n' "$_changed" | grep -c . || echo 0)
+    FRAMEWORK_UPDATED_FILES=$(printf '%s\n' "$_changed" | awk '{print $NF}' | head -3 | tr '\n' ' ')
     git add bin/ .claude/ loom/ CLAUDE.md skills/ 2>/dev/null
     EGREGORE_FRAMEWORK_UPDATE=1 git commit -m "Auto-update Egregore framework" --quiet 2>/dev/null || true
     FRAMEWORK_UPDATED="true"
@@ -102,7 +168,7 @@ _apply_framework_update() {
 git worktree prune 2>/dev/null || true
 
 # --- Git health check ---
-if git show-ref --verify --quiet refs/remotes/origin/develop 2>/dev/null; then
+if git show-ref --verify --quiet "refs/remotes/origin/$BASE_BRANCH" 2>/dev/null; then
   HEALTH_GIT="ok"
 else
   HEALTH_GIT="fail"
@@ -118,54 +184,56 @@ if ! type git_add_guarded >/dev/null 2>&1; then
   git_add_guarded() { git add -A 2>/dev/null || true; }
 fi
 
-# --- Setup develop (wrapped — failures set HEALTH_GIT but don't crash) ---
+# --- Setup base branch (wrapped — failures set HEALTH_GIT but don't crash) ---
+# Named setup_develop for continuity; it operates on $BASE_BRANCH, which is
+# "develop" by default and whatever egregore.json's base_branch says otherwise.
 setup_develop() {
-  # Ensure develop branch exists locally
-  if ! git show-ref --verify --quiet refs/heads/develop 2>/dev/null; then
-    if git show-ref --verify --quiet refs/remotes/origin/develop 2>/dev/null; then
-      git checkout -b develop origin/develop --quiet 2>/dev/null
+  # Ensure the base branch exists locally
+  if ! git show-ref --verify --quiet "refs/heads/$BASE_BRANCH" 2>/dev/null; then
+    if git show-ref --verify --quiet "refs/remotes/origin/$BASE_BRANCH" 2>/dev/null; then
+      git checkout -b "$BASE_BRANCH" "origin/$BASE_BRANCH" --quiet 2>/dev/null || return 1
     else
-      # No develop on remote either — create from main
-      git checkout -b develop --quiet 2>/dev/null
-      git push -u origin develop --quiet 2>/dev/null
+      # Not on the remote either — create it and publish it
+      git checkout -b "$BASE_BRANCH" --quiet 2>/dev/null || return 1
+      git push -u origin "$BASE_BRANCH" --quiet 2>/dev/null || return 1
     fi
   fi
 
-  # Sync develop (without checkout — safe for concurrent sessions)
-  CURRENT_BRANCH=$(git branch --show-current)
+  # Sync the base branch (without checkout — safe for concurrent sessions)
+  CURRENT_BRANCH=$(git branch --show-current 2>/dev/null) || return 1
 
-  # Update local develop ref from remote without switching branches
+  # Update the local ref from remote without switching branches
   # Use fetch + force-update to handle divergence (e.g., from auto-update commits)
-  git fetch origin develop --quiet 2>/dev/null || true
-  if [[ "$CURRENT_BRANCH" != "develop" ]]; then
+  git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+  if [[ "$CURRENT_BRANCH" != "$BASE_BRANCH" ]]; then
     # Safe to force-update when not checked out
-    git branch -f develop origin/develop 2>/dev/null || true
+    git branch -f "$BASE_BRANCH" "origin/$BASE_BRANCH" 2>/dev/null || true
   else
-    # On develop — try ff merge, fall back to reset only if no unpushed work
-    git merge --ff-only origin/develop --quiet 2>/dev/null || {
-      # Only reset if there are no unpushed commits on develop
-      LOCAL_AHEAD=$(git rev-list origin/develop..develop --count 2>/dev/null || echo "0")
-      if [ "$LOCAL_AHEAD" = "0" ]; then
-        git reset --hard origin/develop --quiet 2>/dev/null || true
+    # On the base branch — try ff merge, fall back to reset only if no unpushed work
+    git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || {
+      # Only reset if there are no unpushed commits and no dirty tracked work.
+      # A reset here runs before autosave and must never discard local changes.
+      LOCAL_AHEAD=$(git rev-list "origin/$BASE_BRANCH..$BASE_BRANCH" --count 2>/dev/null || echo "0")
+      if [ "$LOCAL_AHEAD" = "0" ] && [ -z "$(git status --porcelain 2>/dev/null)" ]; then
+        git reset --hard "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
       fi
     }
   fi
-  DEVELOP_SYNCED="true"
-
-  # Count commits on develop ahead of main
+  # Count commits on the base branch ahead of main. Meaningless in
+  # single-branch mode, where the base branch IS main.
   COMMITS_AHEAD=0
-  if git show-ref --verify --quiet refs/remotes/origin/main 2>/dev/null; then
-    COMMITS_AHEAD=$(git rev-list origin/main..develop --count 2>/dev/null || echo "0")
+  if [ "$BASE_BRANCH" != "main" ] && git show-ref --verify --quiet refs/remotes/origin/main 2>/dev/null; then
+    COMMITS_AHEAD=$(git rev-list "origin/main..$BASE_BRANCH" --count 2>/dev/null || echo "0")
   fi
 
-  # Always start from develop
-  # Every session begins on develop. Claude creates a fresh topic branch
+  # Always start from the base branch
+  # Every session begins there. Claude creates a fresh topic branch
   # (dev/{author}/{topic-slug}) when the user says what they're working on.
   # If we're on a working branch with uncommitted work, save it first.
   ACTION="ready"
   SAVED_BRANCH=""
 
-  if [[ "$CURRENT_BRANCH" != "develop" ]]; then
+  if [[ "$CURRENT_BRANCH" != "$BASE_BRANCH" ]]; then
     # Check for uncommitted work (staged + unstaged + untracked in tracked dirs)
     if [ -n "$(git status --porcelain 2>/dev/null | head -1)" ]; then
       # Save uncommitted work so nothing is lost (guarded: never auto-commit
@@ -184,14 +252,26 @@ setup_develop() {
       fi
     fi
 
-    # Switch to develop (already updated by fetch origin develop:develop above)
-    git checkout develop --quiet 2>/dev/null || true
+    # Switch to the base branch (already updated by the fetch above)
+    if ! git checkout "$BASE_BRANCH" --quiet 2>/dev/null; then
+      BRANCH=$(git branch --show-current 2>/dev/null || echo "?")
+      return 1
+    fi
   else
-    # Already on develop — fetch couldn't update it (checked-out branch), so pull
-    git merge --ff-only origin/develop --quiet 2>/dev/null || true
+    # Already on it — fetch couldn't update a checked-out branch, so pull
+    git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
   fi
 
-  BRANCH="develop"
+  # Never report the intended branch as the actual branch. A checkout can fail
+  # when the base is held by another worktree or the index blocks the switch.
+  # setup_develop must fail in that case so callers cannot apply framework files
+  # to the user's working branch.
+  BRANCH=$(git branch --show-current 2>/dev/null || echo "?")
+  if [ "$BRANCH" != "$BASE_BRANCH" ]; then
+    return 1
+  fi
+  DEVELOP_SYNCED="true"
+  return 0
 }
 
 # Initialize defaults used by setup_develop
@@ -200,25 +280,26 @@ DEVELOP_SYNCED="false"
 COMMITS_AHEAD=0
 ACTION="ready"
 SAVED_BRANCH=""
-BRANCH="${CURRENT_BRANCH:-develop}"
+BRANCH="${CURRENT_BRANCH:-$BASE_BRANCH}"
+BASE_BRANCH_READY="false"
 
 if [ "$IS_WORKTREE" = "true" ]; then
-  # Inside a worktree — skip develop checkout and framework update.
-  # Worktrees are isolated working copies; framework updates belong on develop.
+  # Inside a worktree — skip the base-branch checkout and framework update.
+  # Worktrees are isolated working copies; framework updates belong on the base.
   BRANCH=$(git branch --show-current 2>/dev/null || echo "?")
   DEVELOP_SYNCED="true"
 
   # --- Worktree branch health check ---
-  # Detect if the branch was already merged into develop (e.g., PR merged
-  # but worktree not cleaned up). This prevents working on a stale branch
-  # whose commits are already in develop.
+  # Detect if the branch was already merged into the base branch (e.g., PR
+  # merged but worktree not cleaned up). This prevents working on a stale
+  # branch whose commits already landed.
   WORKTREE_STALE="false"
-  if [ "$BRANCH" != "?" ] && [ "$BRANCH" != "develop" ] && [ "$BRANCH" != "main" ]; then
+  if [ "$BRANCH" != "?" ] && [ "$BRANCH" != "$BASE_BRANCH" ] && [ "$BRANCH" != "main" ]; then
     # Check if remote branch still exists
     if ! git ls-remote --heads origin "$BRANCH" 2>/dev/null | grep -q "$BRANCH"; then
-      # Remote branch gone — check if it was merged into develop
-      if git branch -r --merged origin/develop 2>/dev/null | grep -q "origin/$BRANCH" 2>/dev/null || \
-         git merge-base --is-ancestor HEAD origin/develop 2>/dev/null; then
+      # Remote branch gone — check if it was merged into the base branch
+      if git branch -r --merged "origin/$BASE_BRANCH" 2>/dev/null | grep -q "origin/$BRANCH" 2>/dev/null || \
+         git merge-base --is-ancestor HEAD "origin/$BASE_BRANCH" 2>/dev/null; then
         WORKTREE_STALE="merged"
       else
         WORKTREE_STALE="remote_deleted"
@@ -228,16 +309,16 @@ if [ "$IS_WORKTREE" = "true" ]; then
 
   if [ "$WORKTREE_STALE" = "merged" ]; then
     echo ""
-    echo "WARNING: Branch '$BRANCH' was already merged into develop."
-    echo "This worktree is stale — your work here is already in develop."
+    echo "WARNING: Branch '$BRANCH' was already merged into $BASE_BRANCH."
+    echo "This worktree is stale — your work here is already in $BASE_BRANCH."
     echo "Start a new session in the main project to get a fresh branch."
     echo ""
     HEALTH_GIT="fail"
   elif [ "$WORKTREE_STALE" = "remote_deleted" ]; then
     echo ""
-    echo "WARNING: Remote branch '$BRANCH' was deleted but NOT merged into develop."
+    echo "WARNING: Remote branch '$BRANCH' was deleted but NOT merged into $BASE_BRANCH."
     echo "This worktree may contain unique local commits. Check before discarding:"
-    echo "  git log origin/develop..HEAD --oneline"
+    echo "  git log origin/$BASE_BRANCH..HEAD --oneline"
     echo ""
   fi
 
@@ -245,12 +326,14 @@ if [ "$IS_WORKTREE" = "true" ]; then
   if [ ! -f "$SCRIPT_DIR/.env" ] && [ -f "$MAIN_PROJECT_DIR/.env" ]; then
     export ENV_FILE="$MAIN_PROJECT_DIR/.env"
   fi
-elif ! setup_develop 2>/dev/null; then
+elif setup_develop 2>/dev/null; then
+  BASE_BRANCH_READY="true"
+else
   HEALTH_GIT="fail"
 fi
 
-# Apply framework update now — we're on develop (or worktree skipped above)
-if [ "$IS_WORKTREE" != "true" ]; then
+# Apply a framework update only after setup verified the configured base branch.
+if [ "$IS_WORKTREE" != "true" ] && [ "$BASE_BRANCH_READY" = "true" ]; then
   _apply_framework_update 2>/dev/null || true
 fi
 
@@ -272,7 +355,10 @@ for REPO in $MANAGED_REPOS; do
   REPO_DIR="$SCRIPT_DIR/../$REPO"
   if [ -d "$REPO_DIR/.git" ]; then
     # Resolve base branch for this repo (from egregore.json or auto-detect)
-    REPO_BASE=$(_get_base_branch "$REPO")
+    if ! REPO_BASE=$(_get_base_branch "$REPO"); then
+      HEALTH_GIT="fail"
+      continue
+    fi
     # Sync base branch with remote (if not checked out)
     R_BRANCH=$(git -C "$REPO_DIR" branch --show-current 2>/dev/null || echo "?")
     if [ "$R_BRANCH" != "$REPO_BASE" ]; then

package/runtime/codex/bin/lib/greeting.sh

@@ -152,6 +152,20 @@ else
   fi
 fi
 
+# Framework update trail — an auto-update overwrites every framework path from
+# upstream, local edits included. It used to surface as the footer word
+# "updated" in local mode and as nothing at all in connected mode, which is not
+# enough notice for files being replaced under you. Name the count, name the
+# first few, and point at the commit that did it.
+if [ "${FRAMEWORK_UPDATED:-false}" = "true" ] && [ "${FRAMEWORK_UPDATED_COUNT:-0}" -gt 0 ]; then
+  FU_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo "")
+  printf "  ◆ framework updated from upstream — %s file(s) replaced: %s\n" \
+    "$FRAMEWORK_UPDATED_COUNT" "${FRAMEWORK_UPDATED_FILES% }"
+  if [ -n "$FU_SHA" ]; then
+    printf "    local edits to framework paths are replaced by design — git show %s\n" "$FU_SHA"
+  fi
+fi
+
 # Autosave trail — background saves (Stop-hook, sweep, SessionEnd) since the
 # last greeting. The ledger is machine-scoped; this is where sweep rescues of
 # abandoned sessions become visible to the user.

package/runtime/codex/bin/lib/hash.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Cross-platform hash helpers — sourced by scripts that need hashing.
 
 # Compute MD5 hash of a string (macOS + Linux compatible)

package/runtime/codex/bin/lib/noncode.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # noncode.sh — shared "non-coding change" classifier for auto-merge decisions.
 #
 # The org rule: non-coding PRs auto-merge to develop; code goes to review.

package/runtime/codex/bin/lib/time.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Cross-platform time helpers — sourced by scripts that need time formatting.
 
 # Convert ISO timestamp to epoch seconds (macOS + Linux compatible)