create-egregore 0.19.21 → 0.19.23

package/runtime/codex/bin/handoff-save-egregore.sh

@@ -1,13 +1,14 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # handoff-save-egregore.sh — background save+auto-merge for the core repo after a handoff.
 #
 # /handoff renders its card first, then fires this detached. The user never waits on git.
 #
 # Behavior:
 #   - If nothing to save (clean working tree + up-to-date with origin) → exit silently.
-#   - If on develop/main/master → create dev/{author}/handoff-{YYYY-MM-DD} branch from origin/develop.
-#   - Commit all changes, rebase onto origin/develop, push.
-#   - If push succeeds: create PR to develop (or reuse existing), then:
+#   - If on the configured base (or another protected branch) → create a
+#     dev/{author}/handoff-{YYYY-MM-DD} branch from origin/{base}.
+#   - Commit all changes, rebase onto origin/{base}, push.
+#   - If push succeeds: create a PR to the configured base (or reuse existing), then:
 #     - Markdown-only diff → `gh pr merge --auto --merge` (auto-merges when checks pass).
 #     - Code/config present → leave PR open for review (no auto-merge).
 #
@@ -45,9 +46,19 @@ while [ $# -gt 0 ]; do
 done
 
 case "$KIND" in
-  autosave) MSG_PREFIX="Auto-save" ; PR_BODY="Auto-saved session content (non-coding). No explicit /save needed." ;;
-  *)        MSG_PREFIX="Handoff"   ; PR_BODY="Auto-created by /handoff. Session work for:" ;;
+  autosave)
+    MSG_PREFIX="Auto-save"
+    PR_WHAT="Save session content captured by the opted-in autosave workflow."
+    PR_WHY="This preserves unattended non-coding work without requiring an explicit /save."
+    ;;
+  *)
+    MSG_PREFIX="Handoff"
+    PR_WHAT="Save core-repository session work captured when the handoff was created."
+    PR_WHY="The handoff records shared context immediately; this companion PR keeps the originating checkout's work from remaining only local."
+    ;;
 esac
+PR_BODY=$(printf '## What\n\n- %s\n\n## Why\n\n%s Topic: `%s`.\n\n## Verification\n\nNot verified — background %s save; review code or configuration changes before merging.\n\n🤖 Saved via `bin/handoff-save-egregore.sh`\n' \
+  "$PR_WHAT" "$PR_WHY" "$TOPIC" "$KIND")
 
 [ -n "$AUTHOR" ] || { echo "handoff-save-egregore: missing author" >&2; exit 1; }
 
@@ -56,6 +67,22 @@ SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 [ -z "$REPO_DIR" ] && REPO_DIR="$SCRIPT_DIR"
 cd "$REPO_DIR" || exit 1
 
+# Resolve the target checkout's configured integration branch. SCRIPT_DIR points
+# at the framework that owns this helper, while CONFIG must follow --repo-dir so
+# sandboxed and installed instances read their own egregore.json.
+CONFIG="$REPO_DIR/egregore.json"
+[ -f "$SCRIPT_DIR/bin/lib/config.sh" ] || {
+  echo "handoff-save-egregore: base-branch resolver is unavailable" >&2
+  exit 1
+}
+# shellcheck source=bin/lib/config.sh
+. "$SCRIPT_DIR/bin/lib/config.sh" 2>/dev/null || exit 1
+if ! BASE_BRANCH=$(_get_base_branch); then
+  echo "handoff-save-egregore: could not resolve the configured base branch" >&2
+  exit 1
+fi
+BASE_REF="origin/$BASE_BRANCH"
+
 # Shared safe-staging guard — never auto-commit stray sibling-repo gitlinks.
 # shellcheck source=bin/lib/git-safe.sh
 . "$SCRIPT_DIR/bin/lib/git-safe.sh" 2>/dev/null || true
@@ -65,7 +92,7 @@ type git_add_guarded >/dev/null 2>&1 || git_add_guarded() { git add -A 2>/dev/nu
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_DIR/bin/lib/noncode.sh" 2>/dev/null || true
 type noncode_blockers >/dev/null 2>&1 || noncode_blockers() {
-  git -C "${2:-.}" diff "${1:-origin/develop}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
+  git -C "${2:-.}" diff "${1:-$BASE_REF}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
 }
 
 # --- Early exit if nothing to do -----------------------------------------
@@ -75,9 +102,12 @@ DIRTY=0
 CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 AHEAD=0
 if [ -n "$CURRENT_BRANCH" ]; then
-  # Count commits ahead of origin/develop on the current branch (works from any
-  # dev/* branch or from develop itself).
-  AHEAD=$(git rev-list --count "origin/develop..HEAD" 2>/dev/null || echo 0)
+  # A missing remote base is not evidence that there is nothing to save. The
+  # former `|| echo 0` made a main-only instance silently discard clean,
+  # committed topic work because origin/develop did not exist.
+  if ! AHEAD=$(git rev-list --count "$BASE_REF..HEAD" 2>/dev/null); then
+    AHEAD=1
+  fi
 fi
 
 if [ "$DIRTY" = "0" ] && [ "$AHEAD" = "0" ]; then
@@ -85,18 +115,18 @@ if [ "$DIRTY" = "0" ] && [ "$AHEAD" = "0" ]; then
 fi
 
 # --- Protect the protected branches: create a working branch if needed --
-case "$CURRENT_BRANCH" in
-  develop|main|master|"")
-    SLUG_DATE=$(date +%Y-%m-%d)
-    # --branch-suffix keeps concurrent rescues distinct (e.g. per-checkout
-    # hash from the autosave sweep) — same-name pushes wedge on non-FF.
-    NEW_BRANCH="dev/${AUTHOR}/${KIND}-${SLUG_DATE}${BRANCH_SUFFIX:+-$BRANCH_SUFFIX}"
-    git fetch origin develop --quiet 2>/dev/null || true
-    git checkout -b "$NEW_BRANCH" origin/develop --quiet 2>/dev/null || \
-      git checkout "$NEW_BRANCH" --quiet 2>/dev/null || exit 0
-    CURRENT_BRANCH="$NEW_BRANCH"
-    ;;
-esac
+if [ -z "$CURRENT_BRANCH" ] || [ "$CURRENT_BRANCH" = "$BASE_BRANCH" ] \
+   || [ "$CURRENT_BRANCH" = "develop" ] || [ "$CURRENT_BRANCH" = "main" ] \
+   || [ "$CURRENT_BRANCH" = "master" ]; then
+  SLUG_DATE=$(date +%Y-%m-%d)
+  # --branch-suffix keeps concurrent rescues distinct (e.g. per-checkout
+  # hash from the autosave sweep) — same-name pushes wedge on non-FF.
+  NEW_BRANCH="dev/${AUTHOR}/${KIND}-${SLUG_DATE}${BRANCH_SUFFIX:+-$BRANCH_SUFFIX}"
+  git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+  git checkout -b "$NEW_BRANCH" "$BASE_REF" --quiet 2>/dev/null || \
+    git checkout "$NEW_BRANCH" --quiet 2>/dev/null || exit 0
+  CURRENT_BRANCH="$NEW_BRANCH"
+fi
 
 # --- Commit whatever is uncommitted --------------------------------------
 if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
@@ -104,11 +134,11 @@ if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
   git commit -m "${MSG_PREFIX}: ${TOPIC}" --quiet 2>/dev/null || true
 fi
 
-# --- Rebase onto develop, fall back to merge if rebase conflicts ---------
-git fetch origin develop --quiet 2>/dev/null || true
-if ! git rebase origin/develop --quiet 2>/dev/null; then
+# --- Rebase onto the configured base, fall back to merge on conflicts ----
+git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+if ! git rebase "$BASE_REF" --quiet 2>/dev/null; then
   git rebase --abort 2>/dev/null || true
-  if ! git merge origin/develop --quiet -m "Sync with develop" 2>/dev/null; then
+  if ! git merge "$BASE_REF" --quiet -m "Sync with $BASE_BRANCH" 2>/dev/null; then
     # Conflicts we can't auto-resolve. Leave the branch as-is; the user will see it
     # next session or when they run /save explicitly.
     git merge --abort 2>/dev/null || true
@@ -128,7 +158,7 @@ fi
 LEDGER="${EGREGORE_AUTOSAVE_LOG:-$HOME/.egregore/autosave.log}"
 ledger_write() { # pr outcome
   local n_files
-  n_files=$(git diff origin/develop...HEAD --name-only 2>/dev/null | grep -c . || echo 0)
+  n_files=$(git diff "$BASE_REF...HEAD" --name-only 2>/dev/null | grep -c . || echo 0)
   mkdir -p "$(dirname "$LEDGER")" 2>/dev/null || true
   printf '%s|%s|%s|%s|%s|%s|%s\n' \
     "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$KIND" "$REPO_DIR" "$CURRENT_BRANCH" \
@@ -145,15 +175,15 @@ EXISTING_BASE=$(echo "$EXISTING" | jq -r '.baseRefName // empty' 2>/dev/null)
 
 if [ -n "$EXISTING_NUMBER" ]; then
   PR_NUMBER="$EXISTING_NUMBER"
-  if [ "$EXISTING_BASE" != "develop" ]; then
-    gh pr edit "$PR_NUMBER" --base develop >/dev/null 2>&1 || true
+  if [ "$EXISTING_BASE" != "$BASE_BRANCH" ]; then
+    gh pr edit "$PR_NUMBER" --base "$BASE_BRANCH" >/dev/null 2>&1 || true
   fi
 else
   PR_URL=$(gh pr create \
-    --base develop \
+    --base "$BASE_BRANCH" \
     --head "$CURRENT_BRANCH" \
     --title "${MSG_PREFIX}: ${TOPIC}" \
-    --body "${PR_BODY} ${TOPIC}" \
+    --body "$PR_BODY" \
     2>/dev/null || echo "")
   PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$' || echo "")
 fi
@@ -167,7 +197,7 @@ fi
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
-NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
+NON_CODE_BLOCKER=$(noncode_blockers "$BASE_REF" .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
   if [ "$PUBLISH" = "gate" ]; then
     OUTCOME="staged"

package/runtime/codex/bin/index-handoff.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Index a single handoff file into the Neo4j graph.
@@ -119,11 +119,12 @@ AUTHOR="$(md_field 'Author')"
 AUTHOR_HANDLE="$(echo "$AUTHOR" | sed 's/[[:space:]]*→.*//' | awk '{print tolower($1)}')"
 [ -z "$AUTHOR_HANDLE" ] && AUTHOR_HANDLE="unknown"
 
-# Recipients: try markdown header (To or For), then YAML (to or for)
+# Recipients: try markdown header, then canonical/legacy YAML names.
 RECIPIENTS_RAW="$(md_field 'To')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(md_field 'For')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'to')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'for')"
+[ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'addressed_to')"
 # Also extract from "From: author → recipient" pattern
 if [ -z "$RECIPIENTS_RAW" ] && echo "$AUTHOR" | grep -q '→' 2>/dev/null; then
   RECIPIENTS_RAW="$(echo "$AUTHOR" | sed 's/.*→[[:space:]]*//')"

package/runtime/codex/bin/ingest-graph.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Validate, plan, or apply a durable ingestion manifest to the organization graph.

package/runtime/codex/bin/ingest.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Org-scoped intake plane. Shared manifests live in memory/; normalized bodies

package/runtime/codex/bin/lib/artifact-id.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # artifact-id.sh — Deterministic artifact IDs for memory files.
 #
 # Emits `{prefix}-{12 hex}` where prefix is derived from the file extension

package/runtime/codex/bin/lib/config.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Shared config helpers — sourced by session-start.sh and other scripts.
 # Expects SCRIPT_DIR to be set by the caller.
 
@@ -25,35 +25,71 @@ _config_val() {
   fi
 }
 
-# Get base branch for a repo. Reads base_branch from egregore.json repos[] config.
-# Defaults to "develop" for backwards compatibility (existing egregores use develop).
-# Only returns something other than "develop" when base_branch is explicitly set
-# (e.g., for teams who added existing repos with a different default branch).
+# Get base branch for a repo. Reads base_branch from egregore.json — top-level
+# for the core egregore repo, per-entry under repos[] for managed repos.
+# Defaults to "develop" for backwards compatibility only when a valid config
+# omits the setting. Missing, unreadable, malformed, or invalid config fails:
+# callers must never turn a config read failure into a remote branch mutation.
+#
+# Setting a top-level "base_branch": "main" is single-branch mode: the whole
+# develop layer disappears and everything (session start, sync, the branch
+# guard, PR bases) targets main instead. Solo operators who never wanted the
+# develop/main split had no way to say so — the core repo used to be hardcoded
+# even though managed repos were already configurable.
+#
 # Usage: _get_base_branch "repo-name"   (omit for core repo)
 _get_base_branch() {
   local repo_name="${1:-}"
   local config="${CONFIG:-$SCRIPT_DIR/egregore.json}"
+  local base=""
 
-  # Core egregore repo — always develop
-  if [ -z "$repo_name" ]; then
-    echo "develop"
-    return
+  if [ ! -r "$config" ]; then
+    echo "config: cannot read $config" >&2
+    return 1
+  fi
+  if ! jq -e 'type == "object"' "$config" >/dev/null 2>&1; then
+    echo "config: invalid JSON object in $config" >&2
+    return 1
   fi
 
-  # Managed repo — check egregore.json for explicit base_branch
-  if [ -f "$config" ]; then
-    local base
-    base=$(jq -r --arg name "$repo_name" \
-      '(.repos[]? // empty) | select((if type == "object" then .name else . end) == $name) | if type == "object" then .base_branch // empty else empty end' \
-      "$config" 2>/dev/null || true)
-    if [ -n "$base" ]; then
-      echo "$base"
-      return
+  if [ -z "$repo_name" ]; then
+    # Core egregore repo — top-level base_branch. An absent value preserves
+    # the historical develop default; an explicitly invalid value is an error.
+    if jq -e 'has("base_branch")' "$config" >/dev/null 2>&1; then
+      if ! base=$(jq -er '.base_branch | select(type == "string")' "$config" 2>/dev/null); then
+        echo "config: base_branch must be a valid branch name" >&2
+        return 1
+      fi
+    else
+      base="develop"
+    fi
+  else
+    # Managed repo — its own entry under repos[]. Unknown/string-form entries
+    # retain the historical develop default.
+    local repo_json
+    repo_json=$(jq -c --arg name "$repo_name" \
+      'first(.repos[]? | select((if type == "object" then .name else . end) == $name)) // null' \
+      "$config" 2>/dev/null) || {
+        echo "config: cannot resolve managed repo $repo_name" >&2
+        return 1
+      }
+    if [ "$repo_json" != "null" ] \
+       && [ "$(printf '%s' "$repo_json" | jq -r 'type')" = "object" ] \
+       && printf '%s' "$repo_json" | jq -e 'has("base_branch")' >/dev/null 2>&1; then
+      if ! base=$(printf '%s' "$repo_json" | jq -er '.base_branch | select(type == "string")' 2>/dev/null); then
+        echo "config: base_branch for $repo_name must be a valid branch name" >&2
+        return 1
+      fi
+    else
+      base="develop"
     fi
   fi
 
-  # No explicit config — default to develop (backwards compatible)
-  echo "develop"
+  if [ -z "$base" ] || ! git check-ref-format --branch "$base" >/dev/null 2>&1; then
+    echo "config: base_branch must be a valid branch name" >&2
+    return 1
+  fi
+  echo "$base"
 }
 
 # Detect local vs connected mode

package/runtime/codex/bin/lib/context.sh

@@ -449,10 +449,16 @@ fi
 ) > "$CTX_DIR/graph_health" 2>/dev/null &
 
 # 8. Telegram health (background)
+# notify.sh test emits JSON, not prose: {"status":"ok"} connected,
+# {"status":"configured"} local, {"status":"offline"} otherwise. Match the
+# status field — an earlier grep for the word "connected" read a human sentence
+# that the consent rewrite removed, so the footer showed telegram ✗ while the
+# bot was answering.
 (
   if [ "$LOCAL_MODE" = "true" ]; then
     echo "skip"
-  elif bash "$SCRIPT_DIR/bin/notify.sh" test 2>/dev/null | grep -q "connected"; then
+  elif bash "$SCRIPT_DIR/bin/notify.sh" test 2>/dev/null \
+    | jq -e '.status == "ok" or .status == "configured"' >/dev/null 2>&1; then
     echo "ok"
   else
     echo "fail"

package/runtime/codex/bin/lib/ensure-develop.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # ensure-develop.sh — Ensure a repository has a develop branch.
 #
 # Usage: