create-egregore 0.19.21 → 0.19.23

package/runtime/pi/bin/person.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # One identity spine for .egregore-state.json, memory/people, Supabase, and

package/runtime/pi/bin/pi-product-workflows.mjs

@@ -199,14 +199,23 @@ function section(title, body) {
 }
 
 export function buildHandoffDocument(params, author, date = new Date().toISOString().slice(0, 10)) {
+  const topic = cleanArgs(params.topic);
+  const recipient = cleanArgs(params.recipient);
   const lines = [
-    `# Handoff: ${cleanArgs(params.topic)}`,
-    "",
-    `**Date**: ${date}`,
-    `**Author**: ${author}`,
+    "---",
+    "capture_schema: egregore-capture/v1",
+    "capture_mode: addressed",
+    "kind: addressed",
+    `from: ${author}`,
   ];
-  if (cleanArgs(params.recipient)) lines.push(`**To**: ${cleanArgs(params.recipient)}`);
+  if (recipient) lines.push(`addressed_to: ${recipient}`);
   lines.push(
+    `date: ${date}`,
+    `topic: ${topic}`,
+    "intent: action",
+    "---",
+    "",
+    `# Handoff: ${topic}`,
     "",
     section("Briefing", params.briefing),
     "",

package/runtime/pi/bin/pi-session-start.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o pipefail
 
 # Pi's project extension invokes this during session_start so direct `pi`

package/runtime/pi/bin/publish-artifact.sh

@@ -1,11 +1,13 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # publish-artifact.sh — Generate HTML artifact + upload to API
 # Usage: publish-artifact.sh <type> <file> [--title "..."] [--author "..."] [--description "..."] [--id "..."] [--raw-html] [--no-references]
 #
 # Connected mode (API key present): publishes to /api/artifacts/publish (permanent, org-scoped)
-# OSS mode (no API key): publishes to /api/artifacts/share (ephemeral, 7-day TTL)
+# OSS mode (no API key): publishes to /api/artifacts/share on a PUBLIC, UNAUTHENTICATED
+#   relay (ephemeral, 7-day TTL). OFF unless the instance opted in — see
+#   "Public-relay opt-in" below and `bin/settings.sh relay on`.
 #
 # --id <slug>: stable artifact ID — re-publishing with the same ID upserts the content
 #              at the same URL (e.g. egregore.xyz/view/{org}/board). Connected mode only;
@@ -18,8 +20,14 @@ set -euo pipefail
 #              Set automatically when publish-references.sh invokes us for a child,
 #              preventing recursion.
 #
-# Outputs artifact URL on success, exits silently on failure.
+# Outputs artifact URL on success, exits silently on soft failure.
 # Designed for fire-and-forget use: `bash bin/publish-artifact.sh handoff file.md &`
+#
+# Exit codes: 0 ok (or soft failure — no URL on stdout) · 1 usage/validation
+#             3 hosting turned off (features.publishing=false)
+#             4 nothing uploaded — public relay not enabled and no org API key,
+#               or egregore.json is missing/unreadable (fail closed)
+#             5 renderer/fidelity validation failed (nothing uploaded)
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
@@ -34,6 +42,8 @@ ARTIFACT_ID=""
 RAW_HTML=0
 SKIP_REFERENCES=0
 PAIR=""
+VERIFY_FIDELITY=0
+FIDELITY_SOURCE=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -42,6 +52,8 @@ while [[ $# -gt 0 ]]; do
     --description) DESCRIPTION="$2"; shift 2 ;;
     --id) ARTIFACT_ID="$2"; shift 2 ;;
     --pair) PAIR="$2"; shift 2 ;;
+    --verify-fidelity) VERIFY_FIDELITY=1; shift ;;
+    --source) FIDELITY_SOURCE="$2"; shift 2 ;;
     --raw-html) RAW_HTML=1; shift ;;
     --no-references) SKIP_REFERENCES=1; shift ;;
     *)
@@ -77,6 +89,15 @@ if [ -f "$SCRIPT_DIR/.env" ]; then
   EGREGORE_USE_PUBLISHED="${EGREGORE_USE_PUBLISHED:-$(grep '^EGREGORE_USE_PUBLISHED=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
 fi
 
+# A config we cannot parse is a config we cannot trust. Every routing decision
+# below — authenticated org upload vs. public relay, hosting on vs. off — is
+# read out of this file, so an unreadable one means we cannot tell those apart.
+if [ ! -f "$CONFIG" ] || ! jq -e 'type == "object"' "$CONFIG" >/dev/null 2>&1; then
+  echo "Not published — nothing left this machine." >&2
+  echo "egregore.json is missing or unreadable, so there is no way to tell an authenticated org upload from a public one." >&2
+  exit 4
+fi
+
 API_URL="${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
 API_KEY="${EGREGORE_API_KEY:-}"
 ORG_SLUG="$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)"
@@ -92,7 +113,8 @@ if [ -z "${EGREGORE_USE_PUBLISHED:-}" ]; then
   fi
 fi
 
-# Public relay for OSS share endpoint
+# Public relay for OSS share endpoint. Unauthenticated: anything posted here is
+# readable by anyone holding the URL, for 7 days, with nothing in front of it.
 RELAY_URL="https://egregore-production-55f2.up.railway.app"
 
 # --- Artifact hosting off-switch (compliance / privacy) ---
@@ -109,6 +131,24 @@ if [ "$PUBLISHING_ENABLED" = "false" ]; then
   exit 3
 fi
 
+# --- Public-relay opt-in (privacy) ---
+# Without BOTH an api_url and an org API key there is exactly one upload route
+# left: the unauthenticated public relay below. Content must not leave the
+# machine for that route unless a person explicitly enabled it. The gate sits
+# before rendering so the default path generates and uploads nothing.
+#
+# NOTE: use an explicit `== true` test, never jq's `// false`: `//` treats an
+# explicit false like null and silently replaces it with the default.
+if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
+  PUBLIC_RELAY_ENABLED="$(jq -r 'if .features.public_relay == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo "false")"
+  if [ "$PUBLIC_RELAY_ENABLED" != "true" ]; then
+    echo "Not published — nothing left this machine." >&2
+    echo "Without an org API key the only sharing route is a public relay: no auth, anyone with the link can read it, expires after 7 days. It is off unless you turn it on." >&2
+    echo "Turn it on with: bin/settings.sh relay on" >&2
+    exit 4
+  fi
+fi
+
 # --- Prepare HTML ---
 TMP_HTML="/tmp/egregore-artifacts/publish-$$.html"
 mkdir -p /tmp/egregore-artifacts
@@ -130,6 +170,16 @@ else
   if [ -n "$PAIR" ]; then
     RENDER_ARGS+=(--pair "$PAIR")
   fi
+  if [ "$VERIFY_FIDELITY" -eq 1 ]; then
+    RENDER_ARGS+=(--verify-fidelity)
+    if [ "$TYPE" = "composed" ]; then
+      [ -n "$FIDELITY_SOURCE" ] || {
+        echo "Handoff fidelity check requires --source <canonical-handoff.md>" >&2
+        exit 1
+      }
+      RENDER_ARGS+=(--source "$FIDELITY_SOURCE")
+    fi
+  fi
 
   # Prefer the in-repo package copy when it's present AND its dependencies
   # have been installed — that way local edits to packages/egregore-artifacts
@@ -139,15 +189,21 @@ else
   # when a local install is present — useful in the upstream dev repo to
   # dogfood what teammates and OSS users actually run.
   LOCAL_CLI="$SCRIPT_DIR/packages/egregore-artifacts/bin/cli.js"
+  RENDER_ERROR="/tmp/egregore-artifacts/render-error-$$.log"
   if [ "${EGREGORE_USE_PUBLISHED:-0}" != "1" ] && [ -f "$LOCAL_CLI" ] && [ -d "$SCRIPT_DIR/packages/egregore-artifacts/node_modules/react" ]; then
-    if ! node "$LOCAL_CLI" "${RENDER_ARGS[@]}" >/dev/null 2>&1; then
-      exit 0
+    if ! node "$LOCAL_CLI" "${RENDER_ARGS[@]}" >/dev/null 2>"$RENDER_ERROR"; then
+      sed -n '1,4p' "$RENDER_ERROR" >&2
+      rm -f "$RENDER_ERROR"
+      exit 5
     fi
   else
-    if ! npx egregore-artifacts@latest "${RENDER_ARGS[@]}" >/dev/null 2>&1; then
-      exit 0
+    if ! npx -y egregore-artifacts@latest "${RENDER_ARGS[@]}" >/dev/null 2>"$RENDER_ERROR"; then
+      sed -n '1,4p' "$RENDER_ERROR" >&2
+      rm -f "$RENDER_ERROR"
+      exit 5
     fi
   fi
+  rm -f "$RENDER_ERROR"
 fi
 
 if [ ! -f "$TMP_HTML" ]; then

package/runtime/pi/bin/publish-references.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -uo pipefail
 
 # publish-references.sh — Depth-1 auto-publish for referenced memory files.

package/runtime/pi/bin/repo-state.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # repo-state.sh — Capture current branch state across all repos.
 # Outputs a markdown table (## Repo State) for handoff files.
 # Only includes repos on non-base branches or with uncommitted changes.
@@ -71,21 +71,18 @@ check_repo() {
 }
 
 # Check core repo
-CORE_BASE="develop"
-if [ -f "$CONFIG" ]; then
-  # Core repo base: check if develop exists, otherwise main
-  if git -C "$SCRIPT_DIR" show-ref --verify --quiet refs/remotes/origin/develop 2>/dev/null; then
-    CORE_BASE="develop"
-  else
-    CORE_BASE="main"
-  fi
+if ! CORE_BASE=$(_get_base_branch); then
+  echo "repo-state: could not resolve the configured base branch" >&2
+  exit 1
 fi
 check_repo "$CORE_REPO" "$SCRIPT_DIR" "$CORE_BASE"
 
 # Check managed repos
 for REPO in $MANAGED_REPOS; do
   REPO_DIR="$PARENT_DIR/$REPO"
-  BASE=$(_get_base_branch "$REPO" 2>/dev/null || echo "develop")
+  if ! BASE=$(_get_base_branch "$REPO"); then
+    continue
+  fi
   check_repo "$REPO" "$REPO_DIR" "$BASE"
 done
 

package/runtime/pi/bin/search.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Hybrid search over shared memory — powered by qmd (BM25 + vector + rerank, fully local).
 # Usage:
 #   bash bin/search.sh query "text" [-n N] [--fast|--semantic] [--all]

package/runtime/pi/bin/session-autosave.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # session-autosave.sh — save non-coding session work without an explicit /save.
 #
 # Terminal-close is the design constraint: no single "session end" event is

package/runtime/pi/bin/session-log.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Graceful session-end adapter: write a structured session log to memory/sessions/.
 # Receives runtime-neutral JSON on stdin from Claude Code or Pi.
 # Runs BEFORE transcript-archive.sh (needs obs buffer + worktree intact).

package/runtime/pi/bin/settings.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # settings.sh — deterministic config verbs for an Egregore instance.
@@ -10,6 +10,7 @@ set -euo pipefail
 #
 # Usage:
 #   settings.sh hosting status|on|off
+#   settings.sh relay status|on|off
 #   settings.sh repo list | add <name> [description] | remove <name>
 #   settings.sh admin list | add <github-handle> | remove <github-handle>
 #   settings.sh dump                 # full settings snapshot as JSON (for the launcher)
@@ -51,6 +52,7 @@ usage() {
 settings.sh — Egregore instance settings
 
   settings.sh hosting status|on|off
+  settings.sh relay  status|on|off
   settings.sh repo   list | add <name> [description] | remove <name>
   settings.sh admin  list | add <github-handle> | remove <github-handle>
   settings.sh people list | add <github-handle> | remove <github-handle>
@@ -86,6 +88,32 @@ cmd_hosting() {
   esac
 }
 
+# The public share relay is the only upload route when there is no org API
+# key. It is unauthenticated, readable by anyone with the URL, and expires
+# after 7 days, so it is OFF unless explicitly enabled.
+cmd_relay() {
+  local action="${1:-status}"
+  local enabled; enabled="$(jq -r 'if .features.public_relay == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo "false")"
+  case "$action" in
+    status)
+      if [ "$JSON" = 1 ]; then
+        jq -n --argjson on "$enabled" '{domain:"relay", public_relay:$on}'
+      elif [ "$enabled" = "true" ]; then
+        echo "Public share relay: ON — artifacts published without an org API key upload to a public, unauthenticated URL (expires after 7 days)"
+      else
+        echo "Public share relay: OFF — without an org API key, nothing uploads anywhere"
+      fi ;;
+    on)
+      _save '.features.public_relay = true'
+      echo "Public share relay: ON"
+      echo "  Artifacts published without an org API key now upload to a public, unauthenticated URL that anyone with the link can read for 7 days." ;;
+    off)
+      _save '.features.public_relay = false'
+      echo "Public share relay: OFF — without an org API key, nothing uploads anywhere" ;;
+    *) _die "usage: settings.sh relay status|on|off" 1 ;;
+  esac
+}
+
 cmd_repo() {
   local action="${1:-list}"; shift || true
   case "$action" in
@@ -244,6 +272,7 @@ cmd_dump() {
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    public_relay: (.features.public_relay == true),
     repos: [.repos[]? | if type=="object" then . else {name:.} end],
     admins: (.admins // []),
     people: $people
@@ -265,10 +294,11 @@ set -- "${_args[@]+"${_args[@]}"}"
 DOMAIN="${1:-}"; shift || true
 case "$DOMAIN" in
   hosting) cmd_hosting "$@" ;;
+  relay)   cmd_relay "$@" ;;
   repo)    cmd_repo "$@" ;;
   admin)   cmd_admin "$@" ;;
   people)  cmd_people "$@" ;;
   dump)    cmd_dump ;;
   ""|-h|--help|help) usage 0 ;;
-  *) _die "unknown settings domain: '$DOMAIN' (try: hosting, repo, admin, people, dump)" 1 ;;
+  *) _die "unknown settings domain: '$DOMAIN' (try: hosting, relay, repo, admin, people, dump)" 1 ;;
 esac

package/runtime/pi/bin/telemetry.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Egregore telemetry — privacy-respecting product analytics.
 # Mirrors bin/graph.sh and bin/notify.sh patterns.
 #

package/runtime/pi/bin/worktree-create.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # WorktreeCreate hook — replaces EnterWorktree's default behavior.
 # Receives {"name": "<slug>"} on stdin. Must print absolute worktree path to stdout.
 # All diagnostic output goes to stderr or /dev/null — stdout is ONLY for the path.
@@ -33,12 +33,22 @@ AUTHOR=$(jq -r '.github_username // .display_name // "unknown"' "$STATE_FILE" 2>
 BRANCH="dev/${AUTHOR}/${SLUG}"
 WT_PATH="$REPO_ROOT/.claude/worktrees/${SLUG}"
 
-# --- Ensure origin/develop is available ---
-git -C "$REPO_ROOT" fetch origin develop --quiet 2>/dev/null || true
+# --- Resolve and fetch the configured base branch ---
+SCRIPT_DIR="$REPO_ROOT"
+CONFIG="$REPO_ROOT/egregore.json"
+if [ -f "$REPO_ROOT/bin/lib/config.sh" ]; then
+  # shellcheck source=bin/lib/config.sh
+  source "$REPO_ROOT/bin/lib/config.sh"
+fi
+if ! BASE_BRANCH=$(_get_base_branch); then
+  echo "Error: could not resolve the configured base branch" >&2
+  exit 1
+fi
+git -C "$REPO_ROOT" fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
 
 # --- Create branch (idempotent — skip if exists) ---
 if ! git -C "$REPO_ROOT" show-ref --verify --quiet "refs/heads/$BRANCH" 2>/dev/null; then
-  git -C "$REPO_ROOT" branch "$BRANCH" origin/develop >/dev/null 2>&1 || {
+  git -C "$REPO_ROOT" branch "$BRANCH" "origin/$BASE_BRANCH" >/dev/null 2>&1 || {
     echo "Error: failed to create branch $BRANCH" >&2
     exit 1
   }

package/runtime/pi/bin/worktree-remove.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # WorktreeRemove hook — handles cleanup when a worktree is removed.
 # Receives {"worktree_path": "<path>"} on stdin. Best-effort, always exit 0.
 

package/runtime/pi/bin/worktree.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Worktree lifecycle management for Egregore sessions.
 # Each session gets an isolated worktree so parallel sessions don't conflict.
 #

package/runtime/pi/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-pi-meta-harness",
   "policy": "Pi-native lifecycle layer over the public-safe portable Codex skill corpus",
-  "skillCount": 58,
+  "skillCount": 65,
   "skills": [
     "activity",
     "add",
@@ -9,6 +9,8 @@
     "answer",
     "archive",
     "ask",
+    "audit",
+    "autosave",
     "branch",
     "checkup",
     "commit",
@@ -17,7 +19,9 @@
     "dashboard",
     "deep-reflect",
     "delete-user",
+    "demo-mode",
     "deploy-bridge",
+    "design",
     "egregore-voice",
     "emissary",
     "env",
@@ -31,9 +35,11 @@
     "me",
     "meeting",
     "minion",
+    "mock",
     "note",
     "onboarding",
     "pr",
+    "product-voice",
     "project",
     "pull",
     "push",
@@ -49,6 +55,7 @@
     "summon",
     "sync-repos",
     "task",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -63,6 +70,7 @@
     "wrap"
   ],
   "files": [
+    ".claude/context/notification-consent.md",
     ".codex/config.toml",
     ".codex/hooks.json",
     ".codex/hooks/branch-guard.js",
@@ -73,6 +81,8 @@
     ".codex/skills/answer/SKILL.md",
     ".codex/skills/archive/SKILL.md",
     ".codex/skills/ask/SKILL.md",
+    ".codex/skills/audit/SKILL.md",
+    ".codex/skills/autosave/SKILL.md",
     ".codex/skills/branch/SKILL.md",
     ".codex/skills/checkup/SKILL.md",
     ".codex/skills/commit/SKILL.md",
@@ -81,11 +91,14 @@
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",
     ".codex/skills/delete-user/SKILL.md",
+    ".codex/skills/demo-mode/SKILL.md",
     ".codex/skills/deploy-bridge/SKILL.md",
+    ".codex/skills/design/SKILL.md",
     ".codex/skills/egregore-voice/SKILL.md",
     ".codex/skills/emissary/SKILL.md",
     ".codex/skills/env/SKILL.md",
     ".codex/skills/handoff/SKILL.md",
+    ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
     ".codex/skills/ingest-google/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
@@ -95,9 +108,11 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/minion/SKILL.md",
+    ".codex/skills/mock/SKILL.md",
     ".codex/skills/note/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
+    ".codex/skills/product-voice/SKILL.md",
     ".codex/skills/project/SKILL.md",
     ".codex/skills/pull/SKILL.md",
     ".codex/skills/push/SKILL.md",
@@ -115,6 +130,7 @@
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
     ".codex/skills/task/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -138,6 +154,7 @@
     "bin/activity-data.sh",
     "bin/agent.sh",
     "bin/attendant.sh",
+    "bin/autosave.sh",
     "bin/capture-reconcile.sh",
     "bin/capture-run.sh",
     "bin/codex-install-skills.sh",