create-egregore 0.19.32 → 0.20.0

package/runtime/pi/bin/pi-product-workflows.mjs

@@ -2,6 +2,7 @@
 
 import {
   existsSync,
+  mkdirSync,
   mkdtempSync,
   readFileSync,
   readdirSync,
@@ -141,12 +142,37 @@ export async function renderView(pi, root, request, signal) {
   return { text, file, type: request.type };
 }
 
-export async function renderGreeting(pi, root, signal) {
-  const script = join(root, "bin", "pi-session-start.sh");
-  if (!existsSync(script)) throw new Error("Pi startup renderer is missing");
+export async function renderGreeting(pi, root, signal, startScript = "pi-session-start.sh") {
+  const script = join(root, "bin", startScript);
+  if (!existsSync(script)) throw new Error("Egregore startup renderer is missing");
   return checkedExec(pi, "bash", [script, "--card"], { signal, timeout: 45000 }, "Egregore startup");
 }
 
+// Raw JSON from the most recent activity-data.sh run, so follow-up focus
+// turns can receive the data inline instead of re-running the script inside
+// a harness surface that may cap command time (Prime's kernel kills execs at
+// ~5s, truncating the 10-20s data script to a partial fragment).
+let lastActivityData = "";
+export function lastActivityJson() {
+  return lastActivityData;
+}
+
+// Stable on-disk copy of the same data. Focus turns point the model at this
+// path instead of an inline excerpt: a file read is one fast kernel call,
+// never truncated, and removes any reason to re-run the data script.
+export function activityDataPath(root) {
+  return join(root, ".egregore", "activity-data.json");
+}
+
+function persistActivityData(root, json) {
+  try {
+    mkdirSync(join(root, ".egregore"), { recursive: true });
+    writeFileSync(activityDataPath(root), json);
+  } catch {
+    // Cache only — rendering proceeds from memory when the disk write fails.
+  }
+}
+
 export async function renderActivity(pi, root, signal, options = {}) {
   if (options.sync !== false) {
     await checkedExec(
@@ -177,6 +203,8 @@ export async function renderActivity(pi, root, signal, options = {}) {
     { signal, timeout: 120000 },
     "Activity refresh",
   );
+  lastActivityData = String(json || "");
+  persistActivityData(root, lastActivityData);
   const temp = mkdtempSync(join(tmpdir(), "egregore-pi-activity-"));
   const input = join(temp, "activity.json");
   try {
@@ -276,7 +304,7 @@ export async function createHandoff(pi, root, params, signal) {
   }
 }
 
-export async function captureSessionEnd(pi, root, sessionFile, signal) {
+export async function captureSessionEnd(pi, root, sessionFile, signal, runtime = "pi") {
   const sessionIdFile = join(root, ".egregore-session-id");
   if (!existsSync(sessionIdFile)) return false;
   const sessionId = cleanArgs(readFileSync(sessionIdFile, "utf8"));
@@ -287,7 +315,7 @@ export async function captureSessionEnd(pi, root, sessionFile, signal) {
   writeFileSync(input, JSON.stringify({
     session_id: sessionId,
     transcript_path: cleanArgs(sessionFile),
-    runtime: "pi",
+    runtime,
   }));
 
   try {
@@ -353,11 +381,11 @@ export async function publishScroll(pi, root, params, signal) {
   };
 }
 
-export function workflowPrompt(name, args, extra = "") {
+export function workflowPrompt(name, args, extra = "", spec = { runtimeName: "Pi", specPath: ".pi/APPEND_SYSTEM.md" }) {
   const userArgs = cleanArgs(args);
   return [
     `Run the Egregore /${name} workflow now.`,
-    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to Pi using .pi/APPEND_SYSTEM.md.`,
+    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to ${spec.runtimeName} using ${spec.specPath}.`,
     "Work quietly: do not narrate progress, expose raw command output, or repeat tool results.",
     "Use the fewest targeted reads and commands that preserve the workflow contract.",
     userArgs ? `User arguments: ${userArgs}` : "",

package/runtime/pi/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-pi-meta-harness",
   "policy": "Pi-native lifecycle layer over the available OSS Codex skill corpus",
-  "skillCount": 43,
+  "skillCount": 46,
   "skills": [
     "activity",
     "announce",
@@ -19,12 +19,14 @@
     "handoff",
     "harvest",
     "ingest",
+    "ingest-notion",
     "ingest-user-interview",
     "invite",
     "issue",
     "me",
     "meeting",
     "note",
+    "notion-connect",
     "onboarding",
     "pr",
     "pull",
@@ -36,6 +38,7 @@
     "slack-connect",
     "summon",
     "sync-repos",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -70,6 +73,7 @@
     ".codex/skills/handoff/SKILL.md",
     ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
+    ".codex/skills/ingest-notion/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
     ".codex/skills/ingest/SKILL.md",
     ".codex/skills/invite/SKILL.md",
@@ -77,6 +81,7 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/note/SKILL.md",
+    ".codex/skills/notion-connect/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
     ".codex/skills/pull/SKILL.md",
@@ -88,6 +93,7 @@
     ".codex/skills/slack-connect/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -117,6 +123,7 @@
     "bin/codex-session-start.sh",
     "bin/codex-skill-render.mjs",
     "bin/codex-sync-skills.sh",
+    "bin/connect-refresh.sh",
     "bin/dashboard-data.sh",
     "bin/graph-batch.sh",
     "bin/graph-op.sh",

package/runtime/prime/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/prime/.codex/config.toml

@@ -0,0 +1,17 @@
+[features]
+hooks = true
+
+[tui]
+# Codex currently accepts built-in footer item IDs only. Egregore's dynamic
+# ◆ CONNECTED / ◇ LOCAL identity is rendered by bin/codex-session-start.sh.
+status_line = [
+  "model-with-reasoning",
+  "git-branch",
+  "current-dir",
+  "context-remaining",
+  "five-hour-limit",
+  "weekly-limit",
+  "permissions",
+  "approval-mode",
+]
+status_line_use_colors = true

package/runtime/prime/.codex/hooks/branch-guard.js

@@ -0,0 +1,461 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw || "{}");
+  } catch {
+    return {};
+  }
+}
+
+function run(cmd, args, cwd) {
+  const result = spawnSync(cmd, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  if (result.status !== 0) return "";
+  return String(result.stdout || "").trim();
+}
+
+function realish(filePath) {
+  const absolute = path.resolve(filePath);
+  let cursor = absolute;
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) return absolute;
+    cursor = parent;
+  }
+  try {
+    const resolved = fs.realpathSync(cursor);
+    return path.join(resolved, path.relative(cursor, absolute));
+  } catch {
+    return absolute;
+  }
+}
+
+function inside(child, parent) {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!!rel && !rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function nearestExistingDirectory(candidate) {
+  let cursor = path.resolve(candidate);
+  try {
+    if (fs.existsSync(cursor) && !fs.statSync(cursor).isDirectory()) cursor = path.dirname(cursor);
+  } catch {}
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return cursor;
+}
+
+function gitContext(candidate) {
+  if (!candidate) return null;
+  const probe = nearestExistingDirectory(candidate);
+  const top = run("git", ["-C", probe, "rev-parse", "--show-toplevel"], probe);
+  if (!top) return null;
+  const commonRaw = run("git", ["-C", top, "rev-parse", "--git-common-dir"], top);
+  const common = commonRaw
+    ? realish(path.isAbsolute(commonRaw) ? commonRaw : path.join(top, commonRaw))
+    : realish(path.join(top, ".git"));
+  return { top: realish(top), common };
+}
+
+function shellRetarget(command) {
+  // Only retarget a single operation. Mixed command chains are evaluated from
+  // the hub context so one external `git -C` cannot mask a later project write.
+  if (shellSegments(command).length !== 1) return "";
+  const gitC = String(command || "").match(/(?:^|[;&|]\s*)git\s+-C\s+("[^"]*"|'[^']*'|[^\s;&|]+)/);
+  const cdAnd = String(command || "").match(/^\s*cd\s+("[^"]*"|'[^']*'|[^\s;&|]+)\s*&&/);
+  const raw = (gitC && gitC[1]) || (cdAnd && cdAnd[1]) || "";
+  const target = raw.replace(/^['"]|['"]$/g, "");
+  return /[$`*?]/.test(target) ? "" : target;
+}
+
+function operationCandidate(input, baseDir) {
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const explicitWorkdir = toolInput.workdir || toolInput.cwd || "";
+  let candidate = explicitWorkdir
+    ? (path.isAbsolute(explicitWorkdir) ? explicitWorkdir : path.join(baseDir, explicitWorkdir))
+    : baseDir;
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  } else if (toolName === "Bash") {
+    const target = shellRetarget(toolInput.command || "");
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  }
+
+  return candidate;
+}
+
+function findProjectContext(input) {
+  // The launcher keeps EGREGORE_CODEX_PROJECT_DIR on the hub checkout while
+  // individual tool calls can target a task worktree, memory, or a managed
+  // repo. Compare Git common dirs: a task worktree shares the hub common dir
+  // and must use its own branch; memory/managed repos are separate and exempt.
+  const fallback = input.cwd || process.cwd();
+  const hubSeed = process.env.EGREGORE_CODEX_PROJECT_DIR || fallback;
+  const hub = gitContext(hubSeed);
+  const baseDir = input.cwd || hub?.top || fallback;
+  const candidate = operationCandidate(input, baseDir);
+  const operation = gitContext(candidate);
+
+  if (!hub) return { projectDir: operation?.top || realish(baseDir), external: false };
+  if (operation && operation.common === hub.common) {
+    return { projectDir: operation.top, external: false };
+  }
+  if (operation && operation.common !== hub.common) {
+    return { projectDir: hub.top, external: true };
+  }
+
+  const resolvedCandidate = realish(candidate);
+  if (!inside(resolvedCandidate, hub.top)) {
+    return { projectDir: hub.top, external: true };
+  }
+  return { projectDir: hub.top, external: false };
+}
+
+function currentBranch(projectDir) {
+  return run("git", ["-C", projectDir, "rev-parse", "--abbrev-ref", "HEAD"], projectDir);
+}
+
+function currentAuthor(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, ".egregore-state.json"), "utf-8");
+    const state = JSON.parse(raw);
+    const value = state.handle || state.display_name || state.name || "dev";
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "dev";
+  } catch {
+    return "dev";
+  }
+}
+
+function configuredBaseBranch(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, "egregore.json"), "utf-8");
+    const value = JSON.parse(raw).base_branch;
+    return typeof value === "string" && value.trim() ? value.trim() : "develop";
+  } catch {
+    return "develop";
+  }
+}
+
+function isProtectedBranch(branch, projectDir) {
+  return branch === configuredBaseBranch(projectDir) ||
+    branch === "develop" || branch === "main" || branch === "master";
+}
+
+function isExemptPath(rawPath, projectDir, memoryDir) {
+  if (!rawPath) return false;
+  const absolute = path.isAbsolute(rawPath) ? rawPath : path.join(projectDir, rawPath);
+  const resolved = realish(absolute);
+
+  for (const dir of [".claude", ".codex", "memory"]) {
+    const target = realish(path.join(projectDir, dir));
+    if (inside(resolved, target)) return true;
+  }
+
+  for (const file of [".egregore-state.json", ".egregore-branch-consent", ".env"]) {
+    if (resolved === realish(path.join(projectDir, file))) return true;
+  }
+
+  if (memoryDir && inside(resolved, memoryDir)) return true;
+
+  return !inside(resolved, projectDir);
+}
+
+function extractApplyPatchPaths(command) {
+  const paths = [];
+  for (const line of String(command || "").split(/\r?\n/)) {
+    const match = line.match(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/) || line.match(/^\*\*\* Move to: (.+)$/);
+    if (match && match[1]) paths.push(match[1].trim());
+  }
+  return paths;
+}
+
+function commandTargetsOtherRepo(command, projectDir, memoryDir) {
+  const paths = [];
+  const patterns = [
+    /\bcd\s+["']?([^"';&|]+)["']?/g,
+    /\bgit\s+-C\s+["']?([^"';&|]+)["']?/g,
+  ];
+  for (const pattern of patterns) {
+    let match;
+    while ((match = pattern.exec(command))) paths.push(match[1]);
+  }
+
+  for (const raw of paths) {
+    const resolved = realish(path.isAbsolute(raw) ? raw : path.join(projectDir, raw));
+    if (memoryDir && inside(resolved, memoryDir)) return true;
+    if (!inside(resolved, projectDir)) return true;
+  }
+  return false;
+}
+
+function isBranchSetupCommand(command) {
+  if (shellSegments(command).length !== 1) return false;
+  return (
+    /^\s*bin\/agent\.sh\s+branch\b/.test(command) ||
+    /^\s*git\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
+    /^\s*git\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
+    /^\s*git\s+worktree\s+add\b/.test(command) ||
+    /^\s*bin\/worktree\.sh\s+setup\b/.test(command)
+  );
+}
+
+function stagedOnlyFrameworkPaths(projectDir) {
+  const files = run("git", ["-C", projectDir, "diff", "--cached", "--name-only"], projectDir)
+    .split(/\r?\n/)
+    .filter(Boolean);
+  return files.length > 0 && files.every((file) => /^(bin\/|\.claude\/|\.codex\/|CLAUDE\.md$|AGENTS\.md$|skills\/)/.test(file));
+}
+
+function stripQuotedSegments(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") i++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += "x";
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+function maskQuotedOperators(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") {
+        out += ch;
+        if (i + 1 < command.length) out += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      out += /[><|;&]/.test(ch) ? " " : ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') quote = ch;
+    out += ch;
+  }
+  return out;
+}
+
+function shellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      current += ch;
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) current += command[++i];
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+function shellWords(segment) {
+  const words = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(segment || "").length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < segment.length) current += segment[++i];
+      else if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) words.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === "\\") {
+      if (i + 1 < segment.length) current += segment[++i];
+      continue;
+    }
+    current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+function filesystemMutationStatus(command, projectDir, memoryDir) {
+  const commands = new Set(["rm", "mv", "cp", "mkdir", "rmdir", "touch", "chmod", "chown", "ln", "tee"]);
+  let unsafe = false;
+
+  for (const segment of shellSegments(command)) {
+    const words = shellWords(segment);
+    while (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) words.shift();
+    while (words[0] === "sudo" || words[0] === "command" || words[0] === "env") words.shift();
+    if (!words.length) continue;
+
+    const name = path.basename(words.shift());
+    if (!commands.has(name)) continue;
+
+    const args = words.filter((word) => !word.startsWith("-"));
+    let targets = args;
+    if (name === "cp" || name === "ln") targets = args.length ? [args[args.length - 1]] : [];
+    if (name === "chmod" || name === "chown") targets = args.slice(1);
+
+    if (!targets.length || targets.some((target) =>
+      /[$`*?{}]/.test(target) || !isExemptPath(target, projectDir, memoryDir)
+    )) unsafe = true;
+  }
+
+  return { unsafe };
+}
+
+function redirectLooksMutating(command, projectDir, memoryDir) {
+  const visible = maskQuotedOperators(command);
+  const redirectPatterns = [
+    /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g,
+    /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g,
+  ];
+
+  for (const pattern of redirectPatterns) {
+    let match;
+    while ((match = pattern.exec(visible))) {
+      const target = String(match[1] || "").replace(/^["']|["']$/g, "");
+      if (!target || target === "/dev/null" || target.startsWith("$")) continue;
+      if (!isExemptPath(target, projectDir, memoryDir)) return true;
+    }
+  }
+  return false;
+}
+
+function shellLooksMutating(command, projectDir, memoryDir) {
+  if (!command.trim()) return false;
+  const visible = stripQuotedSegments(command);
+  if (isBranchSetupCommand(visible)) return false;
+
+  const mutatingPatterns = [
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?apply_patch\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(sed|perl)\b[^;&|]*\s-i(\s|$)/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
+  ];
+
+  const gitCommit = /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+commit\b/.test(visible);
+  if (gitCommit && stagedOnlyFrameworkPaths(projectDir)) return false;
+
+  const filesystem = filesystemMutationStatus(command, projectDir, memoryDir);
+  return mutatingPatterns.some((pattern) => pattern.test(visible)) ||
+    filesystem.unsafe ||
+    redirectLooksMutating(command, projectDir, memoryDir);
+}
+
+function isConsentCommand(command, branch) {
+  const escaped = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
+}
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
+function main() {
+  const input = parseJson(readStdin());
+  const context = findProjectContext(input);
+  if (context.external) return;
+  const projectDir = context.projectDir;
+  const branch = currentBranch(projectDir);
+  if (!isProtectedBranch(branch, projectDir)) return;
+
+  // Consent bypass: the user explicitly chose to work on this protected branch.
+  // Written only after they pick "Proceed on <branch>"; cleared on session start,
+  // so consent is asked once per session, not per write.
+  try {
+    const consent = fs.readFileSync(path.join(projectDir, ".egregore-branch-consent"), "utf-8").trim();
+    if (consent === branch) return;
+  } catch {}
+
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const memoryDir = realish(path.join(projectDir, "memory"));
+  const author = currentAuthor(projectDir);
+  const reason = [
+    `Protected branch (${branch}). Move project work to a task branch before writing.`,
+    `If the work topic is clear, run bin/agent.sh branch --topic "<work topic>" automatically (prefix dev/${author}/...), continue in the printed worktree, and briefly tell the user.`,
+    "Ask only when the work topic is genuinely ambiguous; ask for the topic, not for routine Git permission.",
+    `Only when the user explicitly requested writing on ${branch}, record consent with: echo '${branch}' > .egregore-branch-consent`,
+    "Memory, framework-runtime, and managed-repo writes are exempt and should not trigger this guard.",
+  ].join("\n");
+
+  if (toolName === "apply_patch") {
+    const changedPaths = extractApplyPatchPaths(toolInput.command || "");
+    if (changedPaths.length === 0 || changedPaths.some((p) => !isExemptPath(p, projectDir, memoryDir))) {
+      deny(reason);
+    }
+    return;
+  }
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (!target || !isExemptPath(target, projectDir, memoryDir)) deny(reason);
+    return;
+  }
+
+  if (toolName === "Bash") {
+    const command = String(toolInput.command || "");
+    if (isConsentCommand(command, branch)) return;
+    if (commandTargetsOtherRepo(command, projectDir, memoryDir)) return;
+    if (shellLooksMutating(command, projectDir, memoryDir)) deny(reason);
+  }
+}
+
+main();