create-egregore 0.19.23 → 0.19.24

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.23
+// egregore-launcher-version: 0.19.24
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.23";
+const VERSION = "0.19.24";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -670,6 +670,27 @@ async function renderCodexStartupCard(egregoreDir) {
   return false;
 }
 
+function renderClaudeGreetingCard(egregoreDir) {
+  // Claude Code counterpart of renderCodexStartupCard: prints the card the
+  // previous boot cached (bin/greeting-card.sh) instead of re-rendering —
+  // must stay instant. Never fatal: a miss (first boot, stale cache, old
+  // core) just means the session renders the full greeting itself.
+  const script = path.join(egregoreDir, "bin", "greeting-card.sh");
+  if (!fs.existsSync(script)) return false;
+  try {
+    const result = spawnSync("bash", [script], {
+      cwd: egregoreDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status === 0 && result.stdout) {
+      process.stdout.write(result.stdout);
+      return true;
+    }
+  } catch {}
+  return false;
+}
+
 function codexSupportMessage(egregoreDir) {
   return [
     "Codex harness support is missing from this Egregore checkout.",
@@ -802,16 +823,22 @@ async function launch(inst, runtimeOverride) {
   } else if (runtime === "pi") {
     if (!hasPiCoreSupport(inst.path)) die(piSupportMessage(inst.path));
   }
+  // Print the cached greeting card for Claude Code (instant; at most one
+  // session stale) and tell the session to skip the in-chat re-render.
+  const claudeCardShown =
+    runtime === "claude-code" && renderClaudeGreetingCard(inst.path);
   // Replace the current process with the selected assistant in the instance dir.
   // spawn + detached + exit-on-exit replicates exec() in Node.
+  const launchEnv = {
+    ...process.env,
+    EGREGORE_RUNTIME: runtime,
+    EGREGORE_CODEX_TRUSTED: runtime === "codex" ? "1" : process.env.EGREGORE_CODEX_TRUSTED,
+  };
+  if (claudeCardShown) launchEnv.EGREGORE_CARD_SHOWN = "1";
   const child = spawn(binary, runtimeLaunchArgs(runtime, inst.path), {
     cwd: inst.path,
     stdio: "inherit",
-    env: {
-      ...process.env,
-      EGREGORE_RUNTIME: runtime,
-      EGREGORE_CODEX_TRUSTED: runtime === "codex" ? "1" : process.env.EGREGORE_CODEX_TRUSTED,
-    },
+    env: launchEnv,
   });
   child.on("exit", (code, signal) => {
     process.exit(signal ? 1 : (code ?? 0));
@@ -1608,6 +1635,22 @@ async function cmdConnect(args) {
   for (const line of backfillSummaryLines(backfillSummary)) {
     console.log(`        ${DIM}${line}${RESET}`);
   }
+  const runtimeRefresh = spawnSync(
+    "npx",
+    ["-y", `${PUBLIC_NPX_PACKAGE}@latest`, "--refresh-launcher"],
+    {
+      cwd: inst.path,
+      encoding: "utf-8",
+      stdio: "pipe",
+      timeout: 3 * 60 * 1000,
+    },
+  );
+  if (runtimeRefresh.status === 0) {
+    console.log(`        ${GREEN}✓${RESET} Connect features installed`);
+  } else {
+    console.log(`        ${YELLOW}!${RESET} Connect features will retry on the next update`);
+    console.log(`          ${DIM}npx -y ${PUBLIC_NPX_PACKAGE}@latest --refresh-launcher${RESET}`);
+  }
   console.log("");
   console.log(`  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is connected. Local files remain the source of truth.`);
   console.log("");

package/assets/egregore-launcher.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# egregore-launcher-version: 0.4.10
+# egregore-launcher-version: 0.4.11
 # egregore — launch an Egregore instance in Claude Code.
 # Reads ~/.egregore/instances.json for the registry of installed egregores.
 #
@@ -22,7 +22,7 @@
 
 set -u
 
-VERSION="0.4.10"
+VERSION="0.4.11"
 REGISTRY="${HOME}/.egregore/instances.json"
 DEFAULT_FILE="${HOME}/.egregore/default"
 
@@ -97,6 +97,14 @@ launch() {
   if [ -d "$target_path/memory" ]; then
     claude_args+=("--add-dir" "$target_path/memory")
   fi
+  # Print the cached greeting card (instant; at most one session stale) and
+  # tell the session to skip the in-chat re-render. greeting-card.sh exits
+  # non-zero silently on a miss (first boot, stale cache, old core) — the
+  # session then renders the full greeting itself, exactly as before.
+  if [ -f "$target_path/bin/greeting-card.sh" ] \
+    && bash "$target_path/bin/greeting-card.sh" 2>/dev/null; then
+    export EGREGORE_CARD_SHOWN=1
+  fi
   exec claude "${claude_args[@]}"
 }
 

package/bin/cli.js

@@ -35,6 +35,12 @@ const {
   installPiRuntime,
   reportPiRuntimeSummary,
 } = require("../lib/pi-runtime");
+const {
+  connectEligibility,
+  fetchConnectRuntimePack,
+  installConnectRuntime,
+  reportConnectRuntimeSummary,
+} = require("../lib/connect-runtime");
 const {
   install,
   ghApi,
@@ -108,10 +114,17 @@ function assistantLabel(runtime) {
   return "Claude Code";
 }
 
-function upgradePortableRuntimesForExisting(instances) {
+async function upgradePortableRuntimesForExisting(instances) {
   for (const inst of instances) {
     if (!inst || !inst.path || !fs.existsSync(inst.path)) continue;
     try {
+      // Fetch and validate the private overlay before pruning the old public
+      // bundle. During the one-time ownership migration, an API outage must
+      // leave an existing Connect installation untouched.
+      const eligibility = connectEligibility(inst.path);
+      const connectPack = eligibility.eligible
+        ? await fetchConnectRuntimePack(inst.path)
+        : null;
       const summary = installCodexRuntime(inst.path);
       const ready = hasCodexRuntimeSupport(inst.path);
       reportCodexRuntimeSummary(summary, ui, {
@@ -124,6 +137,10 @@ function upgradePortableRuntimesForExisting(instances) {
         label: `Pi meta-harness for ${inst.slug || inst.name || path.basename(inst.path)}`,
         includeConflicts: !piReady,
       });
+      const connectSummary = await installConnectRuntime(inst.path, { validatedPack: connectPack });
+      reportConnectRuntimeSummary(connectSummary, ui, {
+        label: `Connect features for ${inst.slug || inst.name || path.basename(inst.path)}`,
+      });
     } catch (err) {
       ui.warn(`Could not refresh shell-runtime support for ${inst.path}: ${err.message}`);
     }
@@ -169,7 +186,7 @@ async function chooseRuntime(args) {
 }
 
 async function upgradeLauncherFromExisting(instances) {
-  upgradePortableRuntimesForExisting(instances);
+  await upgradePortableRuntimesForExisting(instances);
   const inst = instances.find((entry) => entry && entry.path && fs.existsSync(entry.path));
   if (!inst) return null;
   try {
@@ -398,7 +415,7 @@ function showHelp() {
   ui.info("  --force           Skip the in-repo detection check");
   ui.info("  --no-autolaunch   Don't launch the harness at the end (for CI)");
   ui.info("  --no-screens      Skip the full-screen welcome/ready bookends");
-  ui.info("  --refresh-launcher Refresh only the Egregore CLI, then exit");
+  ui.info("  --refresh-launcher Refresh the Egregore CLI and runtime packs, then exit");
   ui.info("  -h, --help        Show this help");
   ui.info("");
 }
@@ -451,6 +468,7 @@ async function main() {
       ui.error("No installed Egregore instance was found. Run create-egregore without --refresh-launcher.");
       process.exit(1);
     }
+    await upgradePortableRuntimesForExisting(instances);
     const alias = await installLauncherBinary(instances[0].path, ui);
     if (!alias || !alias.binaryPath) {
       ui.error("Could not refresh the Egregore CLI.");

package/lib/codex-runtime.js

@@ -151,6 +151,7 @@ function installCodexRuntime(egregoreDir) {
   const summary = {
     installed: 0,
     updated: 0,
+    removed: 0,
     skipped: 0,
     conflicted: 0,
     conflicts: [],
@@ -172,8 +173,29 @@ function installCodexRuntime(egregoreDir) {
     files: {},
   };
   const previousFiles = previous.files || {};
+  const currentBundleFiles = bundleFiles();
+  const currentBundleSet = new Set(currentBundleFiles);
 
-  for (const rel of bundleFiles()) {
+  // Remove installer-owned files that moved to queued, Connect, or internal.
+  // Preserve anything the user modified and keep its ownership record.
+  for (const [rel, record] of Object.entries(previousFiles)) {
+    if (currentBundleSet.has(rel)) continue;
+    const dest = path.join(egregoreDir, rel);
+    if (!pathExistsOrSymlink(dest)) continue;
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch { continue; }
+    if (stat.isFile() && hashBuffer(fs.readFileSync(dest)) === record.hash) {
+      fs.unlinkSync(dest);
+      try { fs.rmdirSync(path.dirname(dest)); } catch {}
+      summary.removed += 1;
+    } else {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      next.files[rel] = { hash: record.hash };
+    }
+  }
+
+  for (const rel of currentBundleFiles) {
     const src = path.join(BUNDLE_DIR, rel);
     const dest = path.join(egregoreDir, rel);
     const sourceBuffer = fs.readFileSync(src);
@@ -240,10 +262,10 @@ function reportCodexRuntimeSummary(summary, ui, opts = {}) {
   if (!summary || !ui) return;
   const label = opts.label || "Codex runtime";
   const includeConflicts = opts.includeConflicts !== false;
-  const changed = summary.installed + summary.updated;
+  const changed = summary.installed + summary.updated + (summary.removed || 0);
   if (changed > 0) {
     ui.success(
-      `${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.skipped} unchanged)`,
+      `${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.removed || 0} removed, ${summary.skipped} unchanged)`,
     );
   }
   if (includeConflicts && summary.conflicted > 0) {

package/lib/connect-runtime.js

@@ -0,0 +1,329 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const http = require("node:http");
+const https = require("node:https");
+const path = require("node:path");
+const { URL } = require("node:url");
+
+const PACKAGE = require("../package.json");
+const LOCAL_MANIFEST = path.join(".egregore", "connect-runtime-manifest.json");
+const PACK_PATH = "/api/runtime/connect-pack";
+const MAX_PACK_BYTES = 12 * 1024 * 1024;
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_FILES = 500;
+
+function hashBuffer(buffer) {
+  return crypto.createHash("sha256").update(buffer).digest("hex");
+}
+
+function readJson(file, fallback) {
+  try { return JSON.parse(fs.readFileSync(file, "utf8")); }
+  catch { return fallback; }
+}
+
+function pathExists(file) {
+  try { fs.lstatSync(file); return true; }
+  catch { return false; }
+}
+
+function gitDirFor(egregoreDir) {
+  const gitPath = path.join(egregoreDir, ".git");
+  try {
+    const stat = fs.lstatSync(gitPath);
+    if (stat.isDirectory()) return gitPath;
+    if (stat.isFile()) {
+      const match = fs.readFileSync(gitPath, "utf8").trim().match(/^gitdir:\s*(.+)$/);
+      if (match) return path.isAbsolute(match[1]) ? match[1] : path.resolve(egregoreDir, match[1]);
+    }
+  } catch {}
+  return null;
+}
+
+function installManifestPath(egregoreDir) {
+  const gitDir = gitDirFor(egregoreDir);
+  return gitDir
+    ? path.join(gitDir, "info", "egregore-connect-runtime.json")
+    : path.join(egregoreDir, LOCAL_MANIFEST);
+}
+
+function readApiKey(egregoreDir) {
+  try {
+    const env = fs.readFileSync(path.join(egregoreDir, ".env"), "utf8");
+    const match = env.match(/^EGREGORE_API_KEY=(.*)$/m);
+    return match && match[1].trim() ? match[1].trim() : "";
+  } catch { return ""; }
+}
+
+function connectCredentials(egregoreDir) {
+  const config = readJson(path.join(egregoreDir, "egregore.json"), null);
+  if (!config || config.mode !== "connected" || !config.api_url) {
+    return { eligible: false, reason: "not-connected" };
+  }
+  const apiKey = readApiKey(egregoreDir);
+  if (!apiKey) return { eligible: false, reason: "missing-api-key" };
+  return {
+    eligible: true,
+    reason: "connected",
+    apiUrl: String(config.api_url).replace(/\/$/, ""),
+    apiKey,
+  };
+}
+
+function connectEligibility(egregoreDir) {
+  const { eligible, reason } = connectCredentials(egregoreDir);
+  return { eligible, reason };
+}
+
+function validateConnectPack(pack) {
+  if (!pack || typeof pack !== "object" || Array.isArray(pack)) {
+    throw new Error("Connect API returned an invalid runtime pack");
+  }
+  if (pack.schemaVersion !== 1 || pack.availability !== "connect") {
+    throw new Error(`Unsupported Connect runtime pack schema: ${pack.schemaVersion}`);
+  }
+  if (!Array.isArray(pack.skills) || pack.skills.length === 0) {
+    throw new Error("Connect runtime pack has no skill inventory");
+  }
+  const skills = [...new Set(pack.skills)];
+  if (skills.length !== pack.skills.length || skills.some((name) => !/^[a-z0-9-]+$/.test(name))) {
+    throw new Error("Connect runtime pack has an invalid skill inventory");
+  }
+  if (!Array.isArray(pack.files) || pack.files.length === 0 || pack.files.length > MAX_FILES) {
+    throw new Error("Connect runtime pack has an invalid file inventory");
+  }
+  if (!/^[a-f0-9]{64}$/.test(pack.packVersion || "")) {
+    throw new Error("Connect runtime pack has an invalid version");
+  }
+
+  const skillSet = new Set(skills);
+  const seen = new Set();
+  let totalBytes = 0;
+  const files = pack.files.map((entry) => {
+    if (!entry || typeof entry !== "object" || typeof entry.path !== "string") {
+      throw new Error("Connect runtime pack contains an invalid file record");
+    }
+    const rel = entry.path;
+    const match = rel.match(/^\.(claude|codex)\/skills\/([^/]+)\/(.+)$/);
+    if (!match || !skillSet.has(match[2]) || rel.includes("\\") || path.posix.normalize(rel) !== rel || seen.has(rel)) {
+      throw new Error(`Connect runtime pack contains an unsafe path: ${rel}`);
+    }
+    seen.add(rel);
+    if (!Number.isInteger(entry.mode) || entry.mode < 0 || entry.mode > 0o777) {
+      throw new Error(`Connect runtime pack contains an invalid mode: ${rel}`);
+    }
+    if (typeof entry.content !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(entry.content)) {
+      throw new Error(`Connect runtime pack contains invalid content: ${rel}`);
+    }
+    const buffer = Buffer.from(entry.content, "base64");
+    if (buffer.length > MAX_FILE_BYTES || buffer.toString("base64") !== entry.content) {
+      throw new Error(`Connect runtime pack file exceeds safety limits: ${rel}`);
+    }
+    totalBytes += buffer.length;
+    if (totalBytes > MAX_PACK_BYTES) throw new Error("Connect runtime pack exceeds safety limits");
+    if (!/^[a-f0-9]{64}$/.test(entry.sha256 || "") || hashBuffer(buffer) !== entry.sha256) {
+      throw new Error(`Connect runtime pack failed integrity validation: ${rel}`);
+    }
+    return { path: rel, mode: entry.mode, sha256: entry.sha256, buffer };
+  });
+
+  for (const skill of skills) {
+    for (const runtime of ["claude", "codex"]) {
+      if (!seen.has(`.${runtime}/skills/${skill}/SKILL.md`)) {
+        throw new Error(`Connect runtime pack is incomplete for ${skill}`);
+      }
+    }
+  }
+  const unsigned = {
+    schemaVersion: pack.schemaVersion,
+    availability: pack.availability,
+    skills: pack.skills,
+    files: pack.files,
+  };
+  if (hashBuffer(Buffer.from(JSON.stringify(unsigned))) !== pack.packVersion) {
+    throw new Error("Connect runtime pack version does not match its contents");
+  }
+  return { schemaVersion: pack.schemaVersion, availability: pack.availability, packVersion: pack.packVersion, skills, files };
+}
+
+function requestConnectPack(apiUrl, apiKey, timeout = 30000) {
+  return new Promise((resolve, reject) => {
+    let parsed;
+    try { parsed = new URL(`${apiUrl}${PACK_PATH}`); }
+    catch { reject(new Error("Connected instance has an invalid API URL")); return; }
+    const transport = parsed.protocol === "http:" ? http : https;
+    const request = transport.request(parsed, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${apiKey}`,
+        "User-Agent": `${PACKAGE.name}/${PACKAGE.version}`,
+      },
+      timeout,
+    }, (response) => {
+      const chunks = [];
+      let size = 0;
+      response.on("error", reject);
+      response.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_PACK_BYTES * 2) {
+          response.destroy(new Error("Connect runtime response exceeds safety limits"));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on("end", () => {
+        const body = Buffer.concat(chunks).toString("utf8");
+        if (response.statusCode !== 200) {
+          reject(new Error(`Connect runtime download failed (HTTP ${response.statusCode})`));
+          return;
+        }
+        try { resolve(JSON.parse(body)); }
+        catch { reject(new Error("Connect API returned an invalid runtime response")); }
+      });
+    });
+    request.on("error", reject);
+    request.on("timeout", () => request.destroy(new Error("Connect runtime download timed out")));
+    request.end();
+  });
+}
+
+async function fetchConnectRuntimePack(egregoreDir, opts = {}) {
+  const credentials = connectCredentials(egregoreDir);
+  if (!credentials.eligible) return null;
+  const raw = opts.pack || await (opts.requestPack || requestConnectPack)(
+    credentials.apiUrl, credentials.apiKey, opts.timeout,
+  );
+  return validateConnectPack(raw);
+}
+
+function copyPackFile(file, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.writeFileSync(dest, file.buffer, { mode: file.mode });
+  try { fs.chmodSync(dest, file.mode); } catch {}
+}
+
+function recordGitExcludes(egregoreDir, skills) {
+  const gitDir = gitDirFor(egregoreDir);
+  if (!gitDir) return;
+  const excludePath = path.join(gitDir, "info", "exclude");
+  fs.mkdirSync(path.dirname(excludePath), { recursive: true });
+  const current = fs.existsSync(excludePath) ? fs.readFileSync(excludePath, "utf8") : "";
+  const wanted = [];
+  for (const skill of skills) wanted.push(`/.claude/skills/${skill}/`, `/.codex/skills/${skill}/`);
+  const lines = current.split(/\r?\n/);
+  const missing = wanted.filter((line) => !lines.includes(line));
+  if (!missing.length) return;
+  const prefix = current && !current.endsWith("\n") ? "\n" : "";
+  const header = current.includes("# Egregore Connect feature pack")
+    ? ""
+    : "# Egregore Connect feature pack (authenticated local overlay)\n";
+  fs.appendFileSync(excludePath, `${prefix}${header}${missing.join("\n")}\n`);
+}
+
+async function installConnectRuntime(egregoreDir, opts = {}) {
+  const eligibility = connectEligibility(egregoreDir);
+  const summary = {
+    ...eligibility, installed: 0, updated: 0, removed: 0, skipped: 0,
+    conflicted: 0, conflicts: [], files: [], bundleSkills: [], bundleSkillCount: 0, packVersion: null,
+  };
+  if (!eligibility.eligible) return summary;
+
+  // Validate the complete response before touching the checkout. A failed
+  // refresh leaves the last known-good Connect overlay intact.
+  const pack = opts.validatedPack || await fetchConnectRuntimePack(egregoreDir, opts);
+  summary.bundleSkills = pack.skills;
+  summary.bundleSkillCount = pack.skills.length;
+  summary.packVersion = pack.packVersion;
+
+  const manifestPath = installManifestPath(egregoreDir);
+  const previous = readJson(manifestPath, { files: {} });
+  const previousFiles = previous.files || {};
+  const currentSet = new Set(pack.files.map((file) => file.path));
+  const next = {
+    package: PACKAGE.name, version: PACKAGE.version, schemaVersion: pack.schemaVersion,
+    packVersion: pack.packVersion, installedAt: new Date().toISOString(), skills: pack.skills, files: {},
+  };
+
+  for (const [rel, record] of Object.entries(previousFiles)) {
+    if (currentSet.has(rel)) continue;
+    const dest = path.join(egregoreDir, rel);
+    if (!pathExists(dest)) continue;
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch { continue; }
+    if (stat.isFile() && hashBuffer(fs.readFileSync(dest)) === record.hash) {
+      fs.unlinkSync(dest);
+      try { fs.rmdirSync(path.dirname(dest)); } catch {}
+      summary.removed += 1;
+    } else {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      next.files[rel] = { hash: record.hash };
+    }
+  }
+
+  for (const file of pack.files) {
+    const rel = file.path;
+    const dest = path.join(egregoreDir, rel);
+    const previousHash = previousFiles[rel] && previousFiles[rel].hash;
+    const record = () => {
+      next.files[rel] = { hash: file.sha256 };
+      summary.files.push(rel);
+    };
+    if (!pathExists(dest)) {
+      copyPackFile(file, dest);
+      summary.installed += 1;
+      record();
+      continue;
+    }
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch { stat = null; }
+    if (!stat || !stat.isFile()) {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      if (previousHash) next.files[rel] = { hash: previousHash };
+      continue;
+    }
+    const currentHash = hashBuffer(fs.readFileSync(dest));
+    if (currentHash === file.sha256) {
+      try { fs.chmodSync(dest, file.mode); } catch {}
+      summary.skipped += 1;
+      record();
+    } else if (previousHash && currentHash === previousHash) {
+      copyPackFile(file, dest);
+      summary.updated += 1;
+      record();
+    } else {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      if (previousHash) next.files[rel] = { hash: previousHash };
+    }
+  }
+  fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+  fs.writeFileSync(manifestPath, `${JSON.stringify(next, null, 2)}\n`);
+  recordGitExcludes(egregoreDir, pack.skills);
+  return summary;
+}
+
+function reportConnectRuntimeSummary(summary, ui, opts = {}) {
+  if (!summary || !ui || !summary.eligible) return;
+  const label = opts.label || "Connect features";
+  const changed = summary.installed + summary.updated + summary.removed;
+  if (changed > 0) {
+    ui.success(`${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.removed} removed)`);
+  }
+  if (summary.conflicted > 0) {
+    ui.warn(`${label}: kept ${summary.conflicted} locally modified file${summary.conflicted === 1 ? "" : "s"}.`);
+  }
+}
+
+module.exports = {
+  connectEligibility,
+  fetchConnectRuntimePack,
+  installConnectRuntime,
+  installManifestPath,
+  reportConnectRuntimeSummary,
+  requestConnectPack,
+  validateConnectPack,
+};

package/lib/pi-runtime.js

@@ -101,6 +101,7 @@ function installPiRuntime(egregoreDir) {
   const summary = {
     installed: 0,
     updated: 0,
+    removed: 0,
     skipped: 0,
     conflicted: 0,
     conflicts: [],
@@ -108,8 +109,27 @@ function installPiRuntime(egregoreDir) {
     bundleSkills: bundleManifest().skills || [],
     bundleSkillCount: bundleManifest().skillCount || 0,
   };
+  const currentBundleFiles = bundleFiles();
+  const currentBundleSet = new Set(currentBundleFiles);
 
-  for (const rel of bundleFiles()) {
+  for (const [rel, record] of Object.entries(previousFiles)) {
+    if (currentBundleSet.has(rel)) continue;
+    const dest = path.join(egregoreDir, rel);
+    if (!pathExists(dest)) continue;
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch { continue; }
+    if (stat.isFile() && hashBuffer(fs.readFileSync(dest)) === record.hash) {
+      fs.unlinkSync(dest);
+      try { fs.rmdirSync(path.dirname(dest)); } catch {}
+      summary.removed += 1;
+    } else {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      next.files[rel] = { hash: record.hash };
+    }
+  }
+
+  for (const rel of currentBundleFiles) {
     const src = path.join(BUNDLE_DIR, rel);
     const dest = path.join(egregoreDir, rel);
     const sourceHash = hashBuffer(fs.readFileSync(src));
@@ -163,9 +183,9 @@ function hasPiRuntimeSupport(egregoreDir) {
 function reportPiRuntimeSummary(summary, ui, opts = {}) {
   if (!summary || !ui) return;
   const label = opts.label || "Pi meta-harness";
-  const changed = summary.installed + summary.updated;
+  const changed = summary.installed + summary.updated + (summary.removed || 0);
   if (changed > 0) {
-    ui.success(`${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.skipped} unchanged)`);
+    ui.success(`${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.removed || 0} removed, ${summary.skipped} unchanged)`);
   }
   if (opts.includeConflicts !== false && summary.conflicted > 0) {
     const count = summary.conflicted;

package/lib/setup.js

@@ -17,6 +17,10 @@ const {
   installPiRuntime,
   reportPiRuntimeSummary,
 } = require("./pi-runtime");
+const {
+  installConnectRuntime,
+  reportConnectRuntimeSummary,
+} = require("./connect-runtime");
 const { commandExists } = require("./path-lookup");
 
 const https = require("node:https");
@@ -522,6 +526,15 @@ async function install(data, ui, targetDir, opts = {}) {
     reportPiRuntimeSummary(piRuntime, ui);
   }
 
+  // Connect is an authenticated additive overlay on the exact OSS runtime.
+  // Local instances return immediately; network failure never breaks setup.
+  try {
+    const connectRuntime = await installConnectRuntime(egregoreDir);
+    reportConnectRuntimeSummary(connectRuntime, ui);
+  } catch (err) {
+    ui.warn(`Connect features were not refreshed: ${err.message}`);
+  }
+
   // Reconcile the installer-captured identity through the same portable writer
   // used by /me and onboarding. Failure is recoverable: the state + person
   // profile already exist and the next session retries `bin/person.sh sync`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.23",
+  "version": "0.19.24",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -10,9 +10,9 @@
     "node": ">=18"
   },
   "scripts": {
-    "build:runtime": "node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs",
+    "build:runtime": "node ../../bin/capability-distribution.mjs generate-skill-view --root ../.. && node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs && node ../../api/scripts/build-connect-runtime-pack.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },