create-egregore 0.19.33 → 0.20.0

package/runtime/pi/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-pi-meta-harness",
   "policy": "Pi-native lifecycle layer over the available OSS Codex skill corpus",
-  "skillCount": 43,
+  "skillCount": 46,
   "skills": [
     "activity",
     "announce",
@@ -19,12 +19,14 @@
     "handoff",
     "harvest",
     "ingest",
+    "ingest-notion",
     "ingest-user-interview",
     "invite",
     "issue",
     "me",
     "meeting",
     "note",
+    "notion-connect",
     "onboarding",
     "pr",
     "pull",
@@ -36,6 +38,7 @@
     "slack-connect",
     "summon",
     "sync-repos",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -70,6 +73,7 @@
     ".codex/skills/handoff/SKILL.md",
     ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
+    ".codex/skills/ingest-notion/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
     ".codex/skills/ingest/SKILL.md",
     ".codex/skills/invite/SKILL.md",
@@ -77,6 +81,7 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/note/SKILL.md",
+    ".codex/skills/notion-connect/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
     ".codex/skills/pull/SKILL.md",
@@ -88,6 +93,7 @@
     ".codex/skills/slack-connect/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",

package/runtime/prime/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/prime/.codex/config.toml

@@ -0,0 +1,17 @@
+[features]
+hooks = true
+
+[tui]
+# Codex currently accepts built-in footer item IDs only. Egregore's dynamic
+# ◆ CONNECTED / ◇ LOCAL identity is rendered by bin/codex-session-start.sh.
+status_line = [
+  "model-with-reasoning",
+  "git-branch",
+  "current-dir",
+  "context-remaining",
+  "five-hour-limit",
+  "weekly-limit",
+  "permissions",
+  "approval-mode",
+]
+status_line_use_colors = true

package/runtime/prime/.codex/hooks/branch-guard.js

@@ -0,0 +1,461 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+function readStdin() {
+  try {
+    return fs.readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw || "{}");
+  } catch {
+    return {};
+  }
+}
+
+function run(cmd, args, cwd) {
+  const result = spawnSync(cmd, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  if (result.status !== 0) return "";
+  return String(result.stdout || "").trim();
+}
+
+function realish(filePath) {
+  const absolute = path.resolve(filePath);
+  let cursor = absolute;
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) return absolute;
+    cursor = parent;
+  }
+  try {
+    const resolved = fs.realpathSync(cursor);
+    return path.join(resolved, path.relative(cursor, absolute));
+  } catch {
+    return absolute;
+  }
+}
+
+function inside(child, parent) {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!!rel && !rel.startsWith("..") && !path.isAbsolute(rel));
+}
+
+function nearestExistingDirectory(candidate) {
+  let cursor = path.resolve(candidate);
+  try {
+    if (fs.existsSync(cursor) && !fs.statSync(cursor).isDirectory()) cursor = path.dirname(cursor);
+  } catch {}
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return cursor;
+}
+
+function gitContext(candidate) {
+  if (!candidate) return null;
+  const probe = nearestExistingDirectory(candidate);
+  const top = run("git", ["-C", probe, "rev-parse", "--show-toplevel"], probe);
+  if (!top) return null;
+  const commonRaw = run("git", ["-C", top, "rev-parse", "--git-common-dir"], top);
+  const common = commonRaw
+    ? realish(path.isAbsolute(commonRaw) ? commonRaw : path.join(top, commonRaw))
+    : realish(path.join(top, ".git"));
+  return { top: realish(top), common };
+}
+
+function shellRetarget(command) {
+  // Only retarget a single operation. Mixed command chains are evaluated from
+  // the hub context so one external `git -C` cannot mask a later project write.
+  if (shellSegments(command).length !== 1) return "";
+  const gitC = String(command || "").match(/(?:^|[;&|]\s*)git\s+-C\s+("[^"]*"|'[^']*'|[^\s;&|]+)/);
+  const cdAnd = String(command || "").match(/^\s*cd\s+("[^"]*"|'[^']*'|[^\s;&|]+)\s*&&/);
+  const raw = (gitC && gitC[1]) || (cdAnd && cdAnd[1]) || "";
+  const target = raw.replace(/^['"]|['"]$/g, "");
+  return /[$`*?]/.test(target) ? "" : target;
+}
+
+function operationCandidate(input, baseDir) {
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const explicitWorkdir = toolInput.workdir || toolInput.cwd || "";
+  let candidate = explicitWorkdir
+    ? (path.isAbsolute(explicitWorkdir) ? explicitWorkdir : path.join(baseDir, explicitWorkdir))
+    : baseDir;
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  } else if (toolName === "Bash") {
+    const target = shellRetarget(toolInput.command || "");
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  }
+
+  return candidate;
+}
+
+function findProjectContext(input) {
+  // The launcher keeps EGREGORE_CODEX_PROJECT_DIR on the hub checkout while
+  // individual tool calls can target a task worktree, memory, or a managed
+  // repo. Compare Git common dirs: a task worktree shares the hub common dir
+  // and must use its own branch; memory/managed repos are separate and exempt.
+  const fallback = input.cwd || process.cwd();
+  const hubSeed = process.env.EGREGORE_CODEX_PROJECT_DIR || fallback;
+  const hub = gitContext(hubSeed);
+  const baseDir = input.cwd || hub?.top || fallback;
+  const candidate = operationCandidate(input, baseDir);
+  const operation = gitContext(candidate);
+
+  if (!hub) return { projectDir: operation?.top || realish(baseDir), external: false };
+  if (operation && operation.common === hub.common) {
+    return { projectDir: operation.top, external: false };
+  }
+  if (operation && operation.common !== hub.common) {
+    return { projectDir: hub.top, external: true };
+  }
+
+  const resolvedCandidate = realish(candidate);
+  if (!inside(resolvedCandidate, hub.top)) {
+    return { projectDir: hub.top, external: true };
+  }
+  return { projectDir: hub.top, external: false };
+}
+
+function currentBranch(projectDir) {
+  return run("git", ["-C", projectDir, "rev-parse", "--abbrev-ref", "HEAD"], projectDir);
+}
+
+function currentAuthor(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, ".egregore-state.json"), "utf-8");
+    const state = JSON.parse(raw);
+    const value = state.handle || state.display_name || state.name || "dev";
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "dev";
+  } catch {
+    return "dev";
+  }
+}
+
+function configuredBaseBranch(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, "egregore.json"), "utf-8");
+    const value = JSON.parse(raw).base_branch;
+    return typeof value === "string" && value.trim() ? value.trim() : "develop";
+  } catch {
+    return "develop";
+  }
+}
+
+function isProtectedBranch(branch, projectDir) {
+  return branch === configuredBaseBranch(projectDir) ||
+    branch === "develop" || branch === "main" || branch === "master";
+}
+
+function isExemptPath(rawPath, projectDir, memoryDir) {
+  if (!rawPath) return false;
+  const absolute = path.isAbsolute(rawPath) ? rawPath : path.join(projectDir, rawPath);
+  const resolved = realish(absolute);
+
+  for (const dir of [".claude", ".codex", "memory"]) {
+    const target = realish(path.join(projectDir, dir));
+    if (inside(resolved, target)) return true;
+  }
+
+  for (const file of [".egregore-state.json", ".egregore-branch-consent", ".env"]) {
+    if (resolved === realish(path.join(projectDir, file))) return true;
+  }
+
+  if (memoryDir && inside(resolved, memoryDir)) return true;
+
+  return !inside(resolved, projectDir);
+}
+
+function extractApplyPatchPaths(command) {
+  const paths = [];
+  for (const line of String(command || "").split(/\r?\n/)) {
+    const match = line.match(/^\*\*\* (?:Add|Update|Delete) File: (.+)$/) || line.match(/^\*\*\* Move to: (.+)$/);
+    if (match && match[1]) paths.push(match[1].trim());
+  }
+  return paths;
+}
+
+function commandTargetsOtherRepo(command, projectDir, memoryDir) {
+  const paths = [];
+  const patterns = [
+    /\bcd\s+["']?([^"';&|]+)["']?/g,
+    /\bgit\s+-C\s+["']?([^"';&|]+)["']?/g,
+  ];
+  for (const pattern of patterns) {
+    let match;
+    while ((match = pattern.exec(command))) paths.push(match[1]);
+  }
+
+  for (const raw of paths) {
+    const resolved = realish(path.isAbsolute(raw) ? raw : path.join(projectDir, raw));
+    if (memoryDir && inside(resolved, memoryDir)) return true;
+    if (!inside(resolved, projectDir)) return true;
+  }
+  return false;
+}
+
+function isBranchSetupCommand(command) {
+  if (shellSegments(command).length !== 1) return false;
+  return (
+    /^\s*bin\/agent\.sh\s+branch\b/.test(command) ||
+    /^\s*git\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
+    /^\s*git\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
+    /^\s*git\s+worktree\s+add\b/.test(command) ||
+    /^\s*bin\/worktree\.sh\s+setup\b/.test(command)
+  );
+}
+
+function stagedOnlyFrameworkPaths(projectDir) {
+  const files = run("git", ["-C", projectDir, "diff", "--cached", "--name-only"], projectDir)
+    .split(/\r?\n/)
+    .filter(Boolean);
+  return files.length > 0 && files.every((file) => /^(bin\/|\.claude\/|\.codex\/|CLAUDE\.md$|AGENTS\.md$|skills\/)/.test(file));
+}
+
+function stripQuotedSegments(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") i++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += "x";
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+function maskQuotedOperators(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") {
+        out += ch;
+        if (i + 1 < command.length) out += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      out += /[><|;&]/.test(ch) ? " " : ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') quote = ch;
+    out += ch;
+  }
+  return out;
+}
+
+function shellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      current += ch;
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) current += command[++i];
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+function shellWords(segment) {
+  const words = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(segment || "").length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < segment.length) current += segment[++i];
+      else if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) words.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === "\\") {
+      if (i + 1 < segment.length) current += segment[++i];
+      continue;
+    }
+    current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+function filesystemMutationStatus(command, projectDir, memoryDir) {
+  const commands = new Set(["rm", "mv", "cp", "mkdir", "rmdir", "touch", "chmod", "chown", "ln", "tee"]);
+  let unsafe = false;
+
+  for (const segment of shellSegments(command)) {
+    const words = shellWords(segment);
+    while (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) words.shift();
+    while (words[0] === "sudo" || words[0] === "command" || words[0] === "env") words.shift();
+    if (!words.length) continue;
+
+    const name = path.basename(words.shift());
+    if (!commands.has(name)) continue;
+
+    const args = words.filter((word) => !word.startsWith("-"));
+    let targets = args;
+    if (name === "cp" || name === "ln") targets = args.length ? [args[args.length - 1]] : [];
+    if (name === "chmod" || name === "chown") targets = args.slice(1);
+
+    if (!targets.length || targets.some((target) =>
+      /[$`*?{}]/.test(target) || !isExemptPath(target, projectDir, memoryDir)
+    )) unsafe = true;
+  }
+
+  return { unsafe };
+}
+
+function redirectLooksMutating(command, projectDir, memoryDir) {
+  const visible = maskQuotedOperators(command);
+  const redirectPatterns = [
+    /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g,
+    /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g,
+  ];
+
+  for (const pattern of redirectPatterns) {
+    let match;
+    while ((match = pattern.exec(visible))) {
+      const target = String(match[1] || "").replace(/^["']|["']$/g, "");
+      if (!target || target === "/dev/null" || target.startsWith("$")) continue;
+      if (!isExemptPath(target, projectDir, memoryDir)) return true;
+    }
+  }
+  return false;
+}
+
+function shellLooksMutating(command, projectDir, memoryDir) {
+  if (!command.trim()) return false;
+  const visible = stripQuotedSegments(command);
+  if (isBranchSetupCommand(visible)) return false;
+
+  const mutatingPatterns = [
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?apply_patch\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(sed|perl)\b[^;&|]*\s-i(\s|$)/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
+  ];
+
+  const gitCommit = /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+commit\b/.test(visible);
+  if (gitCommit && stagedOnlyFrameworkPaths(projectDir)) return false;
+
+  const filesystem = filesystemMutationStatus(command, projectDir, memoryDir);
+  return mutatingPatterns.some((pattern) => pattern.test(visible)) ||
+    filesystem.unsafe ||
+    redirectLooksMutating(command, projectDir, memoryDir);
+}
+
+function isConsentCommand(command, branch) {
+  const escaped = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
+}
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  }));
+}
+
+function main() {
+  const input = parseJson(readStdin());
+  const context = findProjectContext(input);
+  if (context.external) return;
+  const projectDir = context.projectDir;
+  const branch = currentBranch(projectDir);
+  if (!isProtectedBranch(branch, projectDir)) return;
+
+  // Consent bypass: the user explicitly chose to work on this protected branch.
+  // Written only after they pick "Proceed on <branch>"; cleared on session start,
+  // so consent is asked once per session, not per write.
+  try {
+    const consent = fs.readFileSync(path.join(projectDir, ".egregore-branch-consent"), "utf-8").trim();
+    if (consent === branch) return;
+  } catch {}
+
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const memoryDir = realish(path.join(projectDir, "memory"));
+  const author = currentAuthor(projectDir);
+  const reason = [
+    `Protected branch (${branch}). Move project work to a task branch before writing.`,
+    `If the work topic is clear, run bin/agent.sh branch --topic "<work topic>" automatically (prefix dev/${author}/...), continue in the printed worktree, and briefly tell the user.`,
+    "Ask only when the work topic is genuinely ambiguous; ask for the topic, not for routine Git permission.",
+    `Only when the user explicitly requested writing on ${branch}, record consent with: echo '${branch}' > .egregore-branch-consent`,
+    "Memory, framework-runtime, and managed-repo writes are exempt and should not trigger this guard.",
+  ].join("\n");
+
+  if (toolName === "apply_patch") {
+    const changedPaths = extractApplyPatchPaths(toolInput.command || "");
+    if (changedPaths.length === 0 || changedPaths.some((p) => !isExemptPath(p, projectDir, memoryDir))) {
+      deny(reason);
+    }
+    return;
+  }
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (!target || !isExemptPath(target, projectDir, memoryDir)) deny(reason);
+    return;
+  }
+
+  if (toolName === "Bash") {
+    const command = String(toolInput.command || "");
+    if (isConsentCommand(command, branch)) return;
+    if (commandTargetsOtherRepo(command, projectDir, memoryDir)) return;
+    if (shellLooksMutating(command, projectDir, memoryDir)) deny(reason);
+  }
+}
+
+main();

package/runtime/prime/.codex/hooks/search-hint.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+"use strict";
+// search-hint.js — UserPromptSubmit hook (Codex runtime).
+//
+// Mirror of .claude/hooks/search-hint.sh: when the user's prompt is
+// recall-shaped ("find the handoff about…", "did we decide…"), inject a
+// routing hint toward `bash bin/search.sh query` — one ranked call over
+// memory/ — instead of improvised ls/grep/graph exploration.
+//
+// Advisory only, never blocks, rate-limited once per session, exits 0.
+// If the Codex runtime does not fire UserPromptSubmit, this file is inert.
+
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+
+function readStdin() {
+  try { return fs.readFileSync(0, "utf-8"); } catch { return ""; }
+}
+function parseJson(raw) {
+  try { return JSON.parse(raw || "{}"); } catch { return {}; }
+}
+
+const input = parseJson(readStdin());
+const prompt = String(input.prompt || input.user_prompt || "");
+if (!prompt) process.exit(0);
+
+const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+if (!fs.existsSync(path.join(root, "bin", "search.sh"))) process.exit(0);
+
+// Already oriented toward search.
+if (/(\/search\b|search\.sh|\bsearch (the )?memory\b)/i.test(prompt)) process.exit(0);
+
+const RECALL = new RegExp(
+  [
+    "\\b(find|locate|dig up|look up|pull up)\\b.*\\b(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\\b",
+    "\\bdid we (decide|discuss|agree|say|talk about|cover)\\b",
+    "\\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\\b",
+    "\\bwhat did we (decide|say|agree|discuss)\\b",
+    "\\bhave we (discussed|decided|covered|talked about|looked at)\\b",
+    "\\bnotes on\\b",
+    "\\bhandoff (from|about)\\b",
+    "\\bwho worked on\\b",
+    "\\bdidn.?t (someone|we) already\\b",
+    "\\bwas there (a|any) (handoff|decision|discussion|meeting)\\b",
+    "\\b(our|company|org|organization|team)\\b.*\\b(pricing|price|tiers?|plans?|paid|free|strategy|policy|positioning|ownership|decision)\\b",
+    "\\b(pricing|price|tiers?|plans?|paid|free)\\b.*\\b(our|company|org|organization|team)\\b",
+  ].join("|"),
+  "i"
+);
+if (!RECALL.test(prompt)) process.exit(0);
+
+// Rate-limit once per session.
+let sid = "default";
+try { sid = fs.readFileSync(path.join(root, ".egregore-session-id"), "utf-8").trim() || "default"; } catch {}
+const flag = path.join(os.tmpdir(), `egregore-search-hint-${sid}`);
+if (fs.existsSync(flag)) process.exit(0);
+try { fs.writeFileSync(flag, "1"); } catch {}
+
+process.stdout.write(JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: "UserPromptSubmit",
+    additionalContext:
+      "Routing hint: this prompt asks for recall from org memory. FIRST action: `bash bin/search.sh query \"<the concept, not the literal sentence>\"` — one ranked call over all of memory/ (hybrid keyword+semantic; graph-state annotations attach automatically in connected mode). Read the top hits and cite paths. Do NOT improvise ls/grep/graph exploration first — hand-written graph queries against invented labels (e.g. :Handoff — handoffs are :Session nodes) return empty. Full spec: the search skill.",
+  },
+}) + "\n");
+process.exit(0);