create-egregore 0.19.32 → 0.20.0

package/runtime/prime/bin/lib/permissions.sh

@@ -0,0 +1,106 @@
+# shellcheck shell=bash
+# permissions.sh — Soft-enforced admin-only access for Egregore content.
+#
+# Content can be marked admin-only via frontmatter:
+#
+#     ---
+#     admin: true
+#     ---
+#
+# Admins are listed in egregore.json under "admins": ["github1", "github2", ...].
+#
+# Two enforcement layers:
+#
+#  - Read-side (CLI listings, /view rendering) — soft, tag-not-hide:
+#    admin entries appear in /activity and /dashboard listings tagged so admins
+#    can identify them at a glance. For non-admins the title/topic/branch are
+#    replaced with an opaque "[admin]" placeholder — they see admin work
+#    exists but the topic doesn't leak. Anyone with git access still bypasses
+#    by `cat`-ing the file.
+#
+#  - Publish-side (egregore.xyz upload) — strict: publish-artifact.sh refuses
+#    to push admin-only files because egregore.xyz URLs are not auth-gated.
+#    Override with --allow-admin (set by /view after explicit user
+#    confirmation via AskUserQuestion).
+
+# Get list of admin GitHub usernames (newline-separated, lowercase)
+_get_admins() {
+  local config="${CONFIG:-${SCRIPT_DIR:-$(pwd)}/egregore.json}"
+  if [ -f "$config" ]; then
+    jq -r '.admins[]? // empty' "$config" 2>/dev/null | tr '[:upper:]' '[:lower:]'
+  fi
+}
+
+# Returns 0 if username is an admin, 1 otherwise. Empty username = not admin.
+_is_admin() {
+  local username="${1:-}"
+  [ -z "$username" ] && return 1
+  local lc
+  lc=$(printf '%s' "$username" | tr '[:upper:]' '[:lower:]')
+  _get_admins | grep -qx "$lc"
+}
+
+# Returns 0 if the file's frontmatter contains `admin: true`, 1 otherwise.
+# Tolerates whitespace and case in the value. Looks at the first ~60 lines
+# to keep the scan bounded.
+_is_admin_only_file() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  awk '
+    BEGIN { in_fm = 0; found = 0 }
+    NR == 1 && /^---[[:space:]]*$/ { in_fm = 1; next }
+    in_fm && /^---[[:space:]]*$/ { exit (found ? 0 : 1) }
+    in_fm && tolower($0) ~ /^admin:[[:space:]]*true[[:space:]]*$/ { found = 1 }
+    NR > 60 { exit (found ? 0 : 1) }
+    END { exit (found ? 0 : 1) }
+  ' "$path" 2>/dev/null
+}
+
+# Returns 0 if the file's frontmatter has the `admin:` key set at all (true or
+# false), 1 otherwise. Used by the admin-content-detector hook to skip files
+# whose admin status was already decided — including an explicit `admin: false`
+# meaning "reviewed, public on purpose". Without this, the hook would re-prompt
+# on every edit of a sensitive-keyword file the user has already cleared.
+_has_admin_decision() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  awk '
+    BEGIN { in_fm = 0; found = 0 }
+    NR == 1 && /^---[[:space:]]*$/ { in_fm = 1; next }
+    in_fm && /^---[[:space:]]*$/ { exit (found ? 0 : 1) }
+    in_fm && tolower($0) ~ /^admin:[[:space:]]*(true|false)[[:space:]]*$/ { found = 1 }
+    NR > 60 { exit (found ? 0 : 1) }
+    END { exit (found ? 0 : 1) }
+  ' "$path" 2>/dev/null
+}
+
+# Resolve current user's GitHub username (lowercase). Falls back through:
+#   $1 → .egregore-state.json → git user.name
+_current_user() {
+  local explicit="${1:-}"
+  if [ -n "$explicit" ]; then
+    printf '%s' "$explicit" | tr '[:upper:]' '[:lower:]'
+    return 0
+  fi
+  local state="${SCRIPT_DIR:-$(pwd)}/.egregore-state.json"
+  if [ -f "$state" ]; then
+    local u
+    u=$(jq -r '.github_username // empty' "$state" 2>/dev/null)
+    if [ -n "$u" ]; then
+      printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
+      return 0
+    fi
+  fi
+  git config user.name 2>/dev/null | tr '[:upper:]' '[:lower:]'
+}
+
+# Returns 0 if the file's body contains sensitive keywords (fundraising, legal,
+# personnel, strategic). Used by the admin-content-detector hook to flag files
+# that probably should be admin-only but aren't yet. Whole-word match on a
+# short curated list — easy to extend without retraining intuition.
+_looks_sensitive() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  # Word-boundary regex (case-insensitive). Keep this list curated, not exhaustive.
+  grep -qiE '\b(fundrais(e|ing)|term[ -]?sheet|cap[ -]?table|valuation|runway|investor|VC[s]?|raise|seed[ -]?round|series[ -][a-d]|board[ -]prep|equity[ -]grant|stock[ -]option|RSU|salary|compensation|payroll|severance|PIP|NDA|attorney|legal[ -]hold|lawsuit|acquisition|merger|due[ -]diligence)\b' "$path"
+}

package/runtime/prime/bin/lib/time.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Cross-platform time helpers — sourced by scripts that need time formatting.
+
+# Convert ISO timestamp to epoch seconds (macOS + Linux compatible)
+# Assumes input is UTC (Z or +00:00 suffix, or bare — treated as UTC)
+_iso_to_epoch() {
+  local iso="$1"
+  local clean
+  clean=$(echo "$iso" | sed 's/Z$//; s/+00:00$//; s/\.[0-9]*//')
+  # If date-only (no T), append midnight to avoid macOS date -j filling current time
+  [[ "$clean" != *T* ]] && clean="${clean}T00:00:00"
+  # macOS → date -j, Linux → date -d
+  TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%S" "$clean" "+%s" 2>/dev/null || \
+    TZ=UTC date -d "$clean" +%s 2>/dev/null || echo "0"
+}
+
+# Convert epoch to relative time string (e.g. "3h ago", "yesterday")
+# Uses calendar-day comparison for multi-day ranges (not raw delta)
+_epoch_to_relative() {
+  local epoch="$1"
+  local now="${2:-$(date +%s)}"
+  [ "$epoch" = "0" ] && echo "--" && return
+  local delta=$(( now - epoch ))
+  if [ "$delta" -lt 60 ]; then echo "just now"
+  elif [ "$delta" -lt 3600 ]; then echo "$(( delta / 60 ))m ago"
+  elif [ "$delta" -lt 86400 ]; then echo "$(( delta / 3600 ))h ago"
+  else
+    # Calendar-day based: compare local dates for accurate "yesterday" / "Xd ago"
+    local event_date today_date
+    event_date=$(date -r "$epoch" +%Y-%m-%d 2>/dev/null || \
+                 date -d "@$epoch" +%Y-%m-%d 2>/dev/null || echo "")
+    today_date=$(date +%Y-%m-%d)
+    if [ -z "$event_date" ] || [ "$event_date" = "$today_date" ]; then echo "today"
+    else
+      local today_e event_e
+      today_e=$(date -j -f "%Y-%m-%d" "$today_date" +%s 2>/dev/null || \
+                date -d "$today_date" +%s 2>/dev/null || echo "$now")
+      event_e=$(date -j -f "%Y-%m-%d" "$event_date" +%s 2>/dev/null || \
+                date -d "$event_date" +%s 2>/dev/null || echo "$epoch")
+      local days=$(( (today_e - event_e) / 86400 ))
+      [ "$days" -lt 1 ] && days=1
+      if [ "$days" -eq 1 ]; then echo "yesterday"
+      else echo "${days}d ago"
+      fi
+    fi
+  fi
+}
+
+# Millisecond timer (for latency measurement)
+_millis() {
+  if command -v gdate &>/dev/null; then
+    gdate +%s%3N
+  else
+    python3 -c "import time; print(int(time.time() * 1000))" 2>/dev/null || echo "0"
+  fi
+}

package/runtime/prime/bin/lib/worktree-links.sh

@@ -0,0 +1,79 @@
+# shellcheck shell=bash
+# worktree-links.sh - shared-state bootstrap for git worktrees.
+#
+# Claude Code worktrees are normally created through bin/worktree-create.sh,
+# which links memory/, .env, and local state from the main checkout. Portable
+# runtimes such as Codex can land in a plain git worktree, so startup and
+# agent.sh use this helper to self-heal those links before reading context.
+
+egregore_main_project_dir() {
+  local project_dir="${1:?project dir required}"
+  if [ -f "$project_dir/.git" ]; then
+    local wt_gitdir
+    wt_gitdir=$(sed 's/^gitdir: //' "$project_dir/.git" 2>/dev/null || true)
+    if [ -n "$wt_gitdir" ]; then
+      cd "$wt_gitdir/../../.." 2>/dev/null && pwd
+      return
+    fi
+  fi
+  cd "$project_dir" 2>/dev/null && pwd
+}
+
+egregore_link_shared_state() {
+  local worktree_dir="${1:?worktree dir required}"
+  local main_dir="${2:-}"
+  local file src dst resolved
+
+  [ -f "$worktree_dir/.git" ] || return 0
+  [ -n "$main_dir" ] || main_dir="$(egregore_main_project_dir "$worktree_dir")"
+  [ -n "$main_dir" ] || return 0
+  [ "$main_dir" != "$worktree_dir" ] || return 0
+
+  for file in memory .env .egregore-state.json .egregore-session-id; do
+    src="$main_dir/$file"
+    dst="$worktree_dir/$file"
+
+    if [ "$file" = "memory" ]; then
+      if [ -L "$src" ] || [ -d "$src" ]; then
+        resolved="$(realpath "$src" 2>/dev/null || true)"
+        [ -n "$resolved" ] && [ -d "$resolved" ] || continue
+        src="$resolved"
+      else
+        continue
+      fi
+    else
+      [ -f "$src" ] || continue
+    fi
+
+    if [ -L "$dst" ]; then
+      ln -sfn "$src" "$dst" 2>/dev/null || true
+    elif [ ! -e "$dst" ]; then
+      ln -s "$src" "$dst" 2>/dev/null || true
+    fi
+  done
+}
+
+# Resolve the .env that governs a checkout. A worktree can be missing its .env
+# symlink (created before .env existed, or by a runtime that skipped worktree
+# setup) — self-heal the links, then fall back to the main checkout's .env so
+# credential loading never silently comes up empty. Prints the usable path, or
+# nothing when neither checkout has one. Always returns 0.
+egregore_env_file() {
+  local project_dir="${1:?project dir required}"
+  if [ ! -f "$project_dir/.env" ] && [ -f "$project_dir/.git" ]; then
+    egregore_link_shared_state "$project_dir" 2>/dev/null || true
+  fi
+  if [ -f "$project_dir/.env" ]; then
+    echo "$project_dir/.env"
+    return 0
+  fi
+  if [ -f "$project_dir/.git" ]; then
+    local main_dir
+    main_dir="$(egregore_main_project_dir "$project_dir" 2>/dev/null || true)"
+    if [ -n "$main_dir" ] && [ -f "$main_dir/.env" ]; then
+      echo "$main_dir/.env"
+      return 0
+    fi
+  fi
+  return 0
+}