create-egregore 0.19.3 → 0.19.6

package/runtime/codex/bin/settings.sh

@@ -0,0 +1,274 @@
+#!/bin/bash
+set -euo pipefail
+
+# settings.sh — deterministic config verbs for an Egregore instance.
+#
+# Edits egregore.json atomically. No agent, no network, no session. Idempotent:
+# re-adding an existing item is a no-op success; removing a missing one is too.
+# This is the deterministic core the launcher settings screen (and slash
+# commands) call — the reliability lives here, the surfaces are thin callers.
+#
+# Usage:
+#   settings.sh hosting status|on|off
+#   settings.sh repo list | add <name> [description] | remove <name>
+#   settings.sh admin list | add <github-handle> | remove <github-handle>
+#   settings.sh dump                 # full settings snapshot as JSON (for the launcher)
+#
+# Add --json to a read verb (status/list) for machine-readable output.
+#
+# Exit codes: 0 ok · 1 usage/validation error · 2 config not found.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+CONFIG="$SCRIPT_DIR/egregore.json"
+
+# ── helpers ──────────────────────────────────────────────────────────────
+
+_die() { echo "$1" >&2; exit "${2:-1}"; }
+
+_valid_token() {
+  # non-empty, GitHub-handle / repo-name safe charset
+  [ -n "${1:-}" ] && printf '%s' "$1" | grep -qE '^[A-Za-z0-9._-]+$'
+}
+
+_save() {
+  # _save '<jq-filter>' [jq-args...] — apply filter to CONFIG, write atomically.
+  local filter="$1"; shift
+  local tmp
+  tmp="$(mktemp "$CONFIG.XXXXXX")" || _die "cannot create temp file" 1
+  if jq "$@" "$filter" "$CONFIG" > "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
+    mv "$tmp" "$CONFIG"
+  else
+    rm -f "$tmp"
+    _die "failed to update $CONFIG (invalid jq filter or unwritable file)" 1
+  fi
+}
+
+_has_repo() { jq -e --arg n "$1" 'any(.repos[]?; (if type=="object" then .name else . end) == $n)' "$CONFIG" >/dev/null; }
+_has_admin() { jq -e --arg h "$1" 'any(.admins[]?; . == $h)' "$CONFIG" >/dev/null; }
+
+usage() {
+  cat >&2 <<'EOF'
+settings.sh — Egregore instance settings
+
+  settings.sh hosting status|on|off
+  settings.sh repo   list | add <name> [description] | remove <name>
+  settings.sh admin  list | add <github-handle> | remove <github-handle>
+  settings.sh people list | add <github-handle> | remove <github-handle>
+  settings.sh dump                         full snapshot (JSON)
+
+  --json    machine-readable output for status/list
+EOF
+  exit "${1:-1}"
+}
+
+# ── verbs ────────────────────────────────────────────────────────────────
+
+cmd_hosting() {
+  local action="${1:-status}"
+  # NEVER use jq's `// "true"` here: `//` treats an explicit `false` as empty and
+  # would return the default, silently defeating the off-switch. Test `!= false`
+  # so absent/true => enabled, explicit false => disabled. `enabled` is the
+  # resolved boolean string ("true"/"false").
+  local enabled; enabled="$(jq -r '.features.publishing != false' "$CONFIG" 2>/dev/null || echo "true")"
+  case "$action" in
+    status)
+      if [ "$JSON" = 1 ]; then
+        jq -n --argjson on "$enabled" '{domain:"hosting", publishing:$on}'
+      elif [ "$enabled" = "false" ]; then echo "Hosting (egregore.xyz): OFF"
+      else echo "Hosting (egregore.xyz): ON"; fi ;;
+    on)
+      _save '.features.publishing = true'
+      echo "Hosting (egregore.xyz): ON" ;;
+    off)
+      _save '.features.publishing = false'
+      echo "Hosting (egregore.xyz): OFF — artifacts will no longer upload to egregore.xyz" ;;
+    *) _die "usage: settings.sh hosting status|on|off" 1 ;;
+  esac
+}
+
+cmd_repo() {
+  local action="${1:-list}"; shift || true
+  case "$action" in
+    list)
+      if [ "$JSON" = 1 ]; then
+        jq '[.repos[]? | if type=="object" then . else {name:.} end]' "$CONFIG"
+      else
+        jq -r '.repos[]? | if type=="object" then "  " + .name + (if .description then " — " + .description else "" end) else "  " + . end' "$CONFIG"
+      fi ;;
+    add)
+      local name="${1:-}"; shift || true
+      local desc="${*:-}"
+      _valid_token "$name" || _die "usage: settings.sh repo add <name> [description]" 1
+      if _has_repo "$name"; then echo "repo '$name' already managed"; return 0; fi
+      if [ -n "$desc" ]; then
+        _save '.repos = ((.repos // []) + [{name:$n, description:$d}])' --arg n "$name" --arg d "$desc"
+      else
+        _save '.repos = ((.repos // []) + [{name:$n}])' --arg n "$name"
+      fi
+      echo "added repo '$name'"
+      echo "  clone it with: /sync-repos  (or reopen the egregore)" ;;
+    remove)
+      local name="${1:-}"
+      _valid_token "$name" || _die "usage: settings.sh repo remove <name>" 1
+      if ! _has_repo "$name"; then echo "repo '$name' is not managed"; return 0; fi
+      _save '.repos = [.repos[]? | select((if type=="object" then .name else . end) != $n)]' --arg n "$name"
+      echo "removed repo '$name' from config"
+      echo "  note: the local ../$name checkout is left untouched" ;;
+    *) _die "usage: settings.sh repo list|add|remove" 1 ;;
+  esac
+}
+
+cmd_admin() {
+  local action="${1:-list}"; shift || true
+  case "$action" in
+    list)
+      if [ "$JSON" = 1 ]; then jq '{admins:(.admins // [])}' "$CONFIG"
+      else jq -r '.admins[]? | "  " + .' "$CONFIG"; fi ;;
+    add)
+      local h="${1:-}"
+      _valid_token "$h" || _die "usage: settings.sh admin add <github-handle>" 1
+      if _has_admin "$h"; then echo "'$h' is already an admin"; return 0; fi
+      _save '.admins = ((.admins // []) + [$h])' --arg h "$h"
+      echo "added admin '$h'" ;;
+    remove)
+      local h="${1:-}"
+      _valid_token "$h" || _die "usage: settings.sh admin remove <github-handle>" 1
+      if ! _has_admin "$h"; then echo "'$h' is not an admin"; return 0; fi
+      local count; count="$(jq '(.admins // []) | length' "$CONFIG")"
+      [ "$count" -le 1 ] && _die "refusing to remove the last admin ('$h') — add another admin first" 1
+      _save '.admins = [.admins[]? | select(. != $h)]' --arg h "$h"
+      echo "removed admin '$h'" ;;
+    *) _die "usage: settings.sh admin list|add|remove" 1 ;;
+  esac
+}
+
+# ── people ───────────────────────────────────────────────────────────────
+# People live as files in memory/people/. add/remove manage that directory AND
+# GitHub repo access (the meaningful local grant). Connected-mode extras — the
+# invite link + Telegram (/invite) and Supabase/Neo4j teardown (/delete-user) —
+# are pointed to, not duplicated here.
+
+_people_dir() { echo "$SCRIPT_DIR/memory/people"; }
+
+_people_names() {
+  local pdir; pdir="$(_people_dir)"
+  [ -d "$pdir" ] || return 0
+  ls "$pdir"/*.md 2>/dev/null | while IFS= read -r f; do basename "$f" .md; done \
+    | grep -viE '^(index|readme)$' || true
+}
+
+_people_json() {
+  local names; names="$(_people_names)"
+  if [ -z "$names" ]; then echo '[]'; return; fi
+  printf '%s\n' "$names" | jq -R . | jq -sc 'map(select(length>0))'
+}
+
+_has_person() { [ -f "$(_people_dir)/$1.md" ]; }
+
+# add|remove a GitHub push-collaborator across the instance's repos. Best-effort:
+# no token/org => skip with a note; per-repo failures never abort.
+_people_github() {
+  local user="$1" op="$2" token org repos r
+  token="$(grep '^GITHUB_TOKEN=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d= -f2- || true)"
+  org="$(jq -r '.github_org // empty' "$CONFIG" 2>/dev/null)"
+  if [ -z "$token" ] || [ -z "$org" ]; then
+    echo "  (no GitHub token/org — skipped repo access; run bin/github-auth.sh)" >&2
+    return 0
+  fi
+  repos="$(jq -r '[.repo_name, (.memory_repo // "" | split("/") | last | sub("\\.git$";"")), (.repos[]? | if type=="object" then .name else . end)] | map(select(. != null and . != "")) | unique | .[]' "$CONFIG" 2>/dev/null)"
+  for r in $repos; do
+    if [ "$op" = "add" ]; then
+      curl -s -o /dev/null -X PUT -H "Authorization: Bearer $token" -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/$org/$r/collaborators/$user" -d '{"permission":"push"}' 2>/dev/null || true
+    else
+      curl -s -o /dev/null -X DELETE -H "Authorization: Bearer $token" -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/$org/$r/collaborators/$user" 2>/dev/null || true
+    fi
+  done
+}
+
+# create|remove memory/people/<user>.md, committing ONLY the people dir.
+_people_file() {
+  local user="$1" op="$2" pdir f inviter today
+  pdir="$(_people_dir)"
+  [ -d "$SCRIPT_DIR/memory" ] || { echo "  (no memory dir — skipped person file)" >&2; return 0; }
+  mkdir -p "$pdir"
+  f="$pdir/$user.md"
+  if [ "$op" = "add" ]; then
+    if [ ! -f "$f" ]; then
+      inviter="$(jq -r '.display_name // .github_username // "admin"' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null || echo admin)"
+      today="$(date -u +%Y-%m-%d)"
+      printf -- '---\nname: %s\ngithub: %s\ninvited_by: %s\njoined: %s\n---\n' "$user" "$user" "$inviter" "$today" > "$f"
+    fi
+  else
+    rm -f "$f"
+  fi
+  ( cd "$SCRIPT_DIR/memory" 2>/dev/null && git add -A people/ 2>/dev/null \
+      && git commit -q -m "settings: people $op $user" 2>/dev/null \
+      && git push -q 2>/dev/null ) || true
+}
+
+cmd_people() {
+  local action="${1:-list}"; shift || true
+  case "$action" in
+    list)
+      if [ "$JSON" = 1 ]; then _people_json
+      else
+        local names; names="$(_people_names)"
+        if [ -n "$names" ]; then printf '  %s\n' $names; else echo "    (none)"; fi
+      fi ;;
+    add)
+      local h="${1:-}"
+      _valid_token "$h" || _die "usage: settings.sh people add <github-handle>" 1
+      if _has_person "$h"; then echo "'$h' is already in people"; return 0; fi
+      _people_github "$h" "add"
+      _people_file "$h" "add"
+      echo "added '$h' (repo access + person file)"
+      [ -n "$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)" ] && echo "  connected org: for the invite link + Telegram, run /invite $h" ;;
+    remove)
+      local h="${1:-}"
+      _valid_token "$h" || _die "usage: settings.sh people remove <github-handle>" 1
+      if ! _has_person "$h"; then echo "'$h' is not in people"; return 0; fi
+      _people_github "$h" "remove"
+      _people_file "$h" "remove"
+      echo "removed '$h' (repo access + person file)"
+      [ -n "$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)" ] && echo "  connected org: for full deprovision (Supabase/Neo4j), run /delete-user $h" ;;
+    *) _die "usage: settings.sh people list|add|remove" 1 ;;
+  esac
+}
+
+cmd_dump() {
+  # Always JSON — the launcher calls this once to render the whole settings screen.
+  local people; people="$(_people_json)"
+  jq --argjson people "$people" '{
+    org: .org_name,
+    slug: .slug,
+    hosting: (.features.publishing != false),
+    repos: [.repos[]? | if type=="object" then . else {name:.} end],
+    admins: (.admins // []),
+    people: $people
+  }' "$CONFIG"
+}
+
+# ── dispatch ─────────────────────────────────────────────────────────────
+
+[ -f "$CONFIG" ] || _die "egregore.json not found at $CONFIG" 2
+
+# Pull out --json (bash 3.2-safe array handling), leave the rest as positionals.
+JSON=0
+_args=()
+for _a in "$@"; do
+  if [ "$_a" = "--json" ]; then JSON=1; else _args+=("$_a"); fi
+done
+set -- "${_args[@]+"${_args[@]}"}"
+
+DOMAIN="${1:-}"; shift || true
+case "$DOMAIN" in
+  hosting) cmd_hosting "$@" ;;
+  repo)    cmd_repo "$@" ;;
+  admin)   cmd_admin "$@" ;;
+  people)  cmd_people "$@" ;;
+  dump)    cmd_dump ;;
+  ""|-h|--help|help) usage 0 ;;
+  *) _die "unknown settings domain: '$DOMAIN' (try: hosting, repo, admin, people, dump)" 1 ;;
+esac

package/runtime/codex/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-runtime",
   "policy": "public-safe subset derived from .syncignore; built by scripts/build-runtime-bundle.mjs",
-  "skillCount": 51,
+  "skillCount": 56,
   "skills": [
     "activity",
     "add",
@@ -29,6 +29,7 @@
     "issue",
     "me",
     "meeting",
+    "minion",
     "note",
     "onboarding",
     "pr",
@@ -40,6 +41,9 @@
     "reflect",
     "review-pr",
     "save",
+    "scroll",
+    "search",
+    "session-view",
     "setup",
     "summon",
     "sync-repos",
@@ -47,6 +51,7 @@
     "telemetry",
     "test",
     "the-spiral",
+    "thread",
     "todo",
     "tui-design",
     "tutorial",
@@ -60,6 +65,7 @@
     ".codex/config.toml",
     ".codex/hooks.json",
     ".codex/hooks/branch-guard.js",
+    ".codex/hooks/search-hint.js",
     ".codex/skills/activity/SKILL.md",
     ".codex/skills/add/SKILL.md",
     ".codex/skills/announce/SKILL.md",
@@ -86,6 +92,7 @@
     ".codex/skills/issue/SKILL.md",
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
+    ".codex/skills/minion/SKILL.md",
     ".codex/skills/note/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
@@ -97,6 +104,11 @@
     ".codex/skills/reflect/SKILL.md",
     ".codex/skills/review-pr/SKILL.md",
     ".codex/skills/save/SKILL.md",
+    ".codex/skills/scroll/SKILL.md",
+    ".codex/skills/scroll/agents/openai.yaml",
+    ".codex/skills/scroll/assets/shell.html",
+    ".codex/skills/search/SKILL.md",
+    ".codex/skills/session-view/SKILL.md",
     ".codex/skills/setup/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
@@ -104,11 +116,14 @@
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
     ".codex/skills/the-spiral/SKILL.md",
+    ".codex/skills/thread/SKILL.md",
     ".codex/skills/todo/SKILL.md",
     ".codex/skills/tui-design/SKILL.md",
     ".codex/skills/tutorial/SKILL.md",
     ".codex/skills/update/SKILL.md",
     ".codex/skills/view/SKILL.md",
+    ".codex/skills/view/agents/openai.yaml",
+    ".codex/skills/view/assets/compose-scaffold.html",
     ".codex/skills/visual-explain/SKILL.md",
     ".codex/skills/wrap/SKILL.md",
     ".codex/spec-manifest.json",
@@ -138,6 +153,7 @@
     "bin/lib/greeting.sh",
     "bin/lib/hash.sh",
     "bin/lib/identity.sh",
+    "bin/lib/metrics.sh",
     "bin/lib/permissions.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
@@ -145,6 +161,7 @@
     "bin/publish-artifact.sh",
     "bin/publish-references.sh",
     "bin/repo-state.sh",
+    "bin/settings.sh",
     "bin/telemetry.sh",
     "bin/worktree-create.sh",
     "bin/worktree-remove.sh",

package/runtime/pi/.codex/config.toml

@@ -0,0 +1,15 @@
+[features]
+hooks = true
+
+[tui]
+status_line = [
+  "model-with-reasoning",
+  "git-branch",
+  "current-dir",
+  "context-remaining",
+  "five-hour-limit",
+  "weekly-limit",
+  "permissions",
+  "approval-mode",
+]
+status_line_use_colors = true

package/runtime/pi/.codex/hooks/branch-guard.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw || "{}");
+  } catch {
+    return {};
+  }
+}
+
+function run(cmd, args, cwd) {
+  const result = spawnSync(cmd, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  if (result.status !== 0) return "";
+  return String(result.stdout || "").trim();
+}
+
+function realish(filePath) {
+  const absolute = path.resolve(filePath);
+  let cursor = absolute;
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) return absolute;
+    cursor = parent;
+  }
+  try {
+    const resolved = fs.realpathSync(cursor);
+    return path.join(resolved, path.relative(cursor, absolute));
+  } catch {
+    return absolute;
+  }
+}
+
+function inside(child, parent) {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!!rel && !rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function findProjectDir(input) {
+  // Tool payload cwd is the operation location. Codex launchers may keep
+  // EGREGORE_CODEX_PROJECT_DIR pointed at the main checkout even after the
+  // model continues in a task worktree, so using the env var first can make
+  // legitimate worktree writes look like writes on protected develop.
+  const cwd = input.cwd || process.cwd() || process.env.EGREGORE_CODEX_PROJECT_DIR;
+  const top = run("git", ["-C", cwd, "rev-parse", "--show-toplevel"], cwd);
+  if (top) return realish(top);
+
+  const envDir = process.env.EGREGORE_CODEX_PROJECT_DIR || "";
+  if (envDir) {
+    const envTop = run("git", ["-C", envDir, "rev-parse", "--show-toplevel"], envDir);
+    return realish(envTop || envDir);
+  }
+
+  return realish(cwd);
+}
+
+function currentBranch(projectDir) {
+  return run("git", ["-C", projectDir, "rev-parse", "--abbrev-ref", "HEAD"], projectDir);
+}
+
+function currentAuthor(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, ".egregore-state.json"), "utf-8");
+    const state = JSON.parse(raw);
+    const value = state.handle || state.display_name || state.name || "dev";
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "dev";
+  } catch {
+    return "dev";
+  }
+}
+
+function isProtectedBranch(branch) {
+  return branch === "develop" || branch === "main" || branch === "master";
+}
+
+function isExemptPath(rawPath, projectDir, memoryDir) {
+  if (!rawPath) return false;
+  const absolute = path.isAbsolute(rawPath) ? rawPath : path.join(projectDir, rawPath);
+  const resolved = realish(absolute);
+
+  for (const dir of [".claude", ".codex", "memory"]) {
+    const target = realish(path.join(projectDir, dir));
+    if (inside(resolved, target)) return true;
+  }
+
+  for (const file of [".egregore-state.json", ".env"]) {
+    if (resolved === realish(path.join(projectDir, file))) return true;
+  }
+
+  if (memoryDir && inside(resolved, memoryDir)) return true;
+
+  return !inside(resolved, projectDir);
+}
+
+function extractApplyPatchPaths(command) {
+  const paths = [];
+  for (const line of String(command || "").split(/\r?\n/)) {
+    const match = line.match(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/) || line.match(/^\*\*\* Move to: (.+)$/);
+    if (match && match[1]) paths.push(match[1].trim());
+  }
+  return paths;
+}
+
+function commandTargetsOtherRepo(command, projectDir, memoryDir) {
+  const paths = [];
+  const patterns = [
+    /\bcd\s+["']?([^"';&|]+)["']?/g,
+    /\bgit\s+-C\s+["']?([^"';&|]+)["']?/g,
+  ];
+  for (const pattern of patterns) {
+    let match;
+    while ((match = pattern.exec(command))) paths.push(match[1]);
+  }
+
+  for (const raw of paths) {
+    const resolved = realish(path.isAbsolute(raw) ? raw : path.join(projectDir, raw));
+    if (memoryDir && inside(resolved, memoryDir)) return true;
+    if (!inside(resolved, projectDir)) return true;
+  }
+  return false;
+}
+
+function isBranchSetupCommand(command) {
+  return (
+    /\bbin\/agent\.sh\s+branch\b/.test(command) ||
+    /\bgit\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
+    /\bgit\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
+    /\bgit\s+worktree\s+add\b/.test(command) ||
+    /\bbin\/worktree\.sh\s+setup\b/.test(command)
+  );
+}
+
+function stagedOnlyFrameworkPaths(projectDir) {
+  const files = run("git", ["-C", projectDir, "diff", "--cached", "--name-only"], projectDir)
+    .split(/\r?\n/)
+    .filter(Boolean);
+  return files.length > 0 && files.every((file) => /^(bin\/|\.claude\/|\.codex\/|CLAUDE\.md$|AGENTS\.md$|skills\/)/.test(file));
+}
+
+function redirectLooksMutating(command, projectDir, memoryDir) {
+  const redirectPatterns = [
+    /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g,
+    /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g,
+  ];
+
+  for (const pattern of redirectPatterns) {
+    let match;
+    while ((match = pattern.exec(command))) {
+      const target = String(match[1] || "").replace(/^["']|["']$/g, "");
+      if (!target || target === "/dev/null" || target.startsWith("$")) continue;
+      if (!isExemptPath(target, projectDir, memoryDir)) return true;
+    }
+  }
+  return false;
+}
+
+function shellLooksMutating(command, projectDir, memoryDir) {
+  if (!command.trim()) return false;
+  if (isBranchSetupCommand(command)) return false;
+
+  const mutatingPatterns = [
+    /\bgit\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
+    /\b(apply_patch|touch|mkdir|rm|mv|cp|chmod|chown|ln)\b/,
+    /\b(sed|perl)\b[^;&|]*\s-i(\s|$)/,
+    /\b(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
+    /\b(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
+  ];
+
+  if (/\bgit\s+commit\b/.test(command) && stagedOnlyFrameworkPaths(projectDir)) return false;
+  return mutatingPatterns.some((pattern) => pattern.test(command)) || redirectLooksMutating(command, projectDir, memoryDir);
+}
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
+function main() {
+  const input = parseJson(readStdin());
+  const projectDir = findProjectDir(input);
+  const branch = currentBranch(projectDir);
+  if (!isProtectedBranch(branch)) return;
+
+  // Consent bypass: the user explicitly chose to work on this protected branch.
+  // Written only after they pick "Proceed on <branch>"; cleared on session start,
+  // so consent is asked once per session, not per write.
+  try {
+    const consent = fs.readFileSync(path.join(projectDir, ".egregore-branch-consent"), "utf-8").trim();
+    if (consent === branch) return;
+  } catch {}
+
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const memoryDir = realish(path.join(projectDir, "memory"));
+  const author = currentAuthor(projectDir);
+  const reason = [
+    `Protected branch (${branch}). Ask the user how to proceed — do NOT auto-branch silently.`,
+    "Offer a choice (numbered or structured): Branch off (default) / Proceed on this branch / Cancel.",
+    `  • Branch off:        bin/agent.sh branch --topic "<work topic>"  (prefix dev/${author}/...)`,
+    `  • Proceed on ${branch}: echo '${branch}' > .egregore-branch-consent  then retry`,
+    "Proceeding records consent for this branch for the rest of the session (cleared on next session start).",
+  ].join("\n");
+
+  if (toolName === "apply_patch") {
+    const changedPaths = extractApplyPatchPaths(toolInput.command || "");
+    if (changedPaths.length === 0 || changedPaths.some((p) => !isExemptPath(p, projectDir, memoryDir))) {
+      deny(reason);
+    }
+    return;
+  }
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (!target || !isExemptPath(target, projectDir, memoryDir)) deny(reason);
+    return;
+  }
+
+  if (toolName === "Bash") {
+    const command = String(toolInput.command || "");
+    if (commandTargetsOtherRepo(command, projectDir, memoryDir)) return;
+    if (shellLooksMutating(command, projectDir, memoryDir)) deny(reason);
+  }
+}
+
+main();