create-egregore 0.19.5 → 0.19.7

package/runtime/pi/bin/lib/greeting.sh

@@ -0,0 +1,340 @@
+# shellcheck shell=bash
+# greeting.sh — Greeting output renderer for session-start.sh
+#
+# Renders the full session greeting:
+#   - ASCII art banner
+#   - Identity line (org/repo + user + branch)
+#   - Momentum board (sessions, commits, handoffs, knowledge)
+#   - Pending questions signal
+#   - Health footer
+#   - Alias migration
+#   - Session context JSON (hidden, for Claude)
+#   - Soul file inclusion
+#   - Telemetry emit
+#   - First session welcome
+#
+# Inputs:  SCRIPT_DIR, STATE_FILE, CONFIG, CTX_DIR, BRANCH, COMMITS_AHEAD,
+#          AUTHOR, LOCAL_MODE, MEMORY_SYNCED, REPOS_STATUS, SAVED_BRANCH,
+#          HEALTH_*, FRAMEWORK_VERSION, TIME_OF_DAY, EGREGORE_SESSION_ID,
+#          FIRST_SESSION, DISPLAY_NAME_STATE, DASHBOARD_URL
+
+# --- Output greeting for Claude to display ---
+cat << 'GREETING'
+
+  ███████╗ ██████╗ ██████╗ ███████╗ ██████╗  ██████╗ ██████╗ ███████╗
+  ██╔════╝██╔════╝ ██╔══██╗██╔════╝██╔════╝ ██╔═══██╗██╔══██╗██╔════╝
+  █████╗  ██║  ███╗██████╔╝█████╗  ██║  ███╗██║   ██║██████╔╝█████╗
+  ██╔══╝  ██║   ██║██╔══██╗██╔══╝  ██║   ██║██║   ██║██╔══██╗██╔══╝
+  ███████╗╚██████╔╝██║  ██║███████╗╚██████╔╝╚██████╔╝██║  ██║███████╗
+  ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚══════╝
+
+GREETING
+
+# --- Ornamented status ---
+REPO_NAME=$(jq -r '.repo_name // "egregore"' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+GITHUB_ORG_DISPLAY=$(jq -r '.github_org // ""' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+ORG_NAME=$(jq -r '.org_name // ""' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+
+DISPLAY_NAME=""
+if [ -f "$STATE_FILE" ]; then
+  DISPLAY_NAME=$(jq -r '.display_name // .name // empty' "$STATE_FILE" 2>/dev/null)
+fi
+GREETING_NAME="${DISPLAY_NAME:-$AUTHOR}"
+
+# --- Line 1: Org/Repo + User + Branch (primary info) ---
+SEPARATOR="  ┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄"
+
+# Build identity line: Org/repo on left, user + branch on right
+if [ "$LOCAL_MODE" = "true" ]; then
+  IDENTITY_LEFT="  Egregore"
+else
+  IDENTITY_LEFT="  ${GITHUB_ORG_DISPLAY}/${REPO_NAME}"
+fi
+BRANCH_COMPACT="$BRANCH"
+if [ "$COMMITS_AHEAD" -gt 0 ] 2>/dev/null; then
+  BRANCH_COMPACT="${BRANCH} · ${COMMITS_AHEAD}↑"
+fi
+IDENTITY_RIGHT="${GREETING_NAME} · ${BRANCH_COMPACT}"
+LINE_WIDTH=67
+ID_LEFT_LEN=${#IDENTITY_LEFT}
+ID_RIGHT_LEN=${#IDENTITY_RIGHT}
+ID_PADDING=$((LINE_WIDTH - ID_LEFT_LEN - ID_RIGHT_LEN))
+if [ "$ID_PADDING" -lt 1 ]; then ID_PADDING=1; fi
+printf "\n%s%*s%s\n" "$IDENTITY_LEFT" "$ID_PADDING" "" "$IDENTITY_RIGHT"
+echo "$SEPARATOR"
+
+# --- Momentum board ---
+source "$SCRIPT_DIR/bin/lib/metrics.sh"
+_render_momentum_board
+
+# Pending questions addressed to you (one summary line — /answer to engage)
+PENDING_Q=$(cat "$CTX_DIR/pending_questions" 2>/dev/null || echo "[]")
+PENDING_Q_COUNT=$(echo "$PENDING_Q" | jq 'length' 2>/dev/null || echo "0")
+if [ "$PENDING_Q_COUNT" -gt 0 ] 2>/dev/null && [ "$PENDING_Q_COUNT" != "0" ]; then
+  PQ_SENDERS=$(echo "$PENDING_Q" | jq -r '[.[].from] | unique | join(", ")' 2>/dev/null)
+  if [ "$PENDING_Q_COUNT" = "1" ]; then
+    PQ_NOUN="question"
+  else
+    PQ_NOUN="questions"
+  fi
+  if [ -n "$PQ_SENDERS" ]; then
+    printf "  ◐ %s pending %s from %s — /answer to engage\n" "$PENDING_Q_COUNT" "$PQ_NOUN" "$PQ_SENDERS"
+  else
+    printf "  ◐ %s pending %s — /answer to engage\n" "$PENDING_Q_COUNT" "$PQ_NOUN"
+  fi
+fi
+
+# Show auto-save notice if work was committed from a previous branch
+if [ -n "$SAVED_BRANCH" ]; then
+  echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
+fi
+
+# --- Footer: health + repos + memory (tertiary) ---
+echo "$SEPARATOR"
+
+# Build compact footer line
+if [ "$LOCAL_MODE" = "true" ]; then
+  # Local mode: only check github + git, skip api-key/graph/telegram
+  HAS_FAILURE="false"
+  FAILED_SERVICES=""
+  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT"; do
+    svc="${pair%%:*}"
+    svc_status="${pair#*:}"
+    if [ "$svc_status" = "fail" ]; then
+      HAS_FAILURE="true"
+      FAILED_SERVICES="${FAILED_SERVICES} ${svc} ✗"
+    fi
+  done
+
+  if [ "$HAS_FAILURE" = "true" ]; then
+    echo "  ⚠${FAILED_SERVICES} — run /checkup"
+  else
+    if [ "${FRAMEWORK_UPDATED:-false}" = "true" ]; then
+      printf "  ◆ updated\n"
+    else
+      printf "  ✓ ready\n"
+    fi
+
+    # Managed repos on separate line
+    if [ -n "$REPOS_STATUS" ]; then
+      REPOS_COMPACT=$(printf '%s' "$REPOS_STATUS" | sed 's/^  ◇ //;s/^[[:space:]]*//' | paste -sd'  ' - | sed 's/[[:space:]]*$//')
+      if [ -n "$REPOS_COMPACT" ]; then
+        printf "  %s\n" "$REPOS_COMPACT"
+      fi
+    fi
+  fi
+else
+  # Connected mode: check all services
+  HAS_FAILURE="false"
+  FAILED_SERVICES=""
+  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT" "api-key:$HEALTH_APIKEY" "graph:$HEALTH_GRAPH" "telegram:$HEALTH_TELEGRAM"; do
+    svc="${pair%%:*}"
+    svc_status="${pair#*:}"
+    if [ "$svc_status" = "fail" ]; then
+      HAS_FAILURE="true"
+      FAILED_SERVICES="${FAILED_SERVICES} ${svc} ✗"
+    fi
+  done
+
+  if [ "$HAS_FAILURE" = "true" ]; then
+    echo "  ⚠${FAILED_SERVICES} — run /checkup"
+  else
+    # Compact footer: ready + memory on one line, repos on next if present
+    FOOTER_LEFT="  ✓ ready"
+    FOOTER_RIGHT=""
+    if [ "$MEMORY_SYNCED" = "true" ]; then
+      FOOTER_RIGHT="◆ memory synced"
+    fi
+
+    FL_LEN=${#FOOTER_LEFT}
+    FR_LEN=${#FOOTER_RIGHT}
+    F_PAD=$((LINE_WIDTH - FL_LEN - FR_LEN))
+    if [ "$F_PAD" -lt 1 ]; then F_PAD=1; fi
+    printf "%s%*s%s\n" "$FOOTER_LEFT" "$F_PAD" "" "$FOOTER_RIGHT"
+
+    # Managed repos on separate line (avoids line overflow)
+    if [ -n "$REPOS_STATUS" ]; then
+      REPOS_COMPACT=$(printf '%s' "$REPOS_STATUS" | sed 's/^  ◇ //;s/^[[:space:]]*//' | paste -sd'  ' - | sed 's/[[:space:]]*$//')
+      if [ -n "$REPOS_COMPACT" ]; then
+        printf "  %s\n" "$REPOS_COMPACT"
+      fi
+    fi
+  fi
+fi
+
+# Dashboard link (OSC 8 hyperlink — clickable text in supported terminals)
+if [ -n "${DASHBOARD_URL:-}" ]; then
+  printf "  ◆ %s\n" "$DASHBOARD_URL"
+fi
+
+if [ -n "${BOARD_URL:-}" ]; then
+  printf "  ◆ %s (board)\n" "$BOARD_URL"
+fi
+
+if [ -n "${LOOM_DOCTOR_BRIEF:-}" ]; then
+  printf "  %s\n" "$LOOM_DOCTOR_BRIEF"
+fi
+
+# Framework updates come through PRs to develop — no separate auto-update channel.
+# The develop sync above already keeps framework files current.
+# Use /update for manual upstream pulls when needed.
+
+# --- One-time migration: fix aliases to use 'claude "start"' ---
+# v1: 'claude start' → 'claude' (cross-instance bug)
+# v2: 'claude' → 'claude "start"' (blank prompt — auto-sends first message)
+ALIAS_VERSION=$(jq -r '.alias_version // 0' "$STATE_FILE" 2>/dev/null || echo "0")
+if [ "$ALIAS_VERSION" -lt 2 ] 2>/dev/null; then
+  for profile in "$HOME/.zshrc" "$HOME/.bashrc" "$HOME/.bash_profile"; do
+    if [ -f "$profile" ] && grep -q "$SCRIPT_DIR" "$profile" 2>/dev/null; then
+      # Replace any egregore alias pointing to this directory with the correct command
+      # Handles: && claude start, && claude, && claude "start" (idempotent)
+      sed -i.bak "s|&& claude start|\\&\\& claude \"start\"|g; s|&& claude'|\\&\\& claude \"start\"'|g" "$profile" 2>/dev/null && rm -f "${profile}.bak" || true
+    fi
+  done
+  if [ -f "$STATE_FILE" ] && jq . "$STATE_FILE" >/dev/null 2>&1; then
+    jq '. + {"alias_fixed": true, "alias_version": 2}' "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+  fi
+fi
+
+echo ""
+
+# --- Session context (hidden, for Claude) ---
+CONTEXT_HANDOFFS=$(cat "$CTX_DIR/handoffs" 2>/dev/null || echo "[]")
+CONTEXT_ADDRESSED=$(cat "$CTX_DIR/addressed" 2>/dev/null || echo "[]")
+CONTEXT_QUESTS=$(cat "$CTX_DIR/quests" 2>/dev/null || echo "[]")
+CONTEXT_ACTIVITY=$(cat "$CTX_DIR/activity" 2>/dev/null || echo "")
+CONTEXT_TEAM=$(cat "$CTX_DIR/team" 2>/dev/null || echo "[]")
+CONTEXT_SOUL=$(cat "$CTX_DIR/soul_summary" 2>/dev/null || echo "")
+CONTEXT_LIFECYCLE=$(cat "$CTX_DIR/lifecycle" 2>/dev/null || echo '{"merged_prs":[],"implemented_handoffs":[]}')
+CONTEXT_PULSE=$(cat "$CTX_DIR/pulse_brief" 2>/dev/null || echo '{}')
+if [ -f "$CTX_DIR/metrics" ]; then
+  CONTEXT_METRICS=$(jq -c . "$CTX_DIR/metrics" 2>/dev/null || echo "{}")
+  [ -n "$CONTEXT_METRICS" ] || CONTEXT_METRICS="{}"
+else
+  CONTEXT_METRICS="{}"
+fi
+
+# --- Write compact subagent context cache (reuses already-gathered data) ---
+SUBAGENT_CTX="/tmp/egregore-subagent-ctx-${EGREGORE_SESSION_ID}.txt"
+(
+  SA_ORG_NAME=$(jq -r '.org_name // "Unknown"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo "Unknown")
+  SA_GITHUB_ORG=$(jq -r '.github_org // "unknown"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo "unknown")
+
+  # Format quests list
+  SA_QUESTS="none"
+  if [ "$CONTEXT_QUESTS" != "[]" ]; then
+    SA_QUESTS=$(echo "$CONTEXT_QUESTS" | jq -r '.[]' 2>/dev/null | paste -sd', ' - 2>/dev/null || echo "none")
+  fi
+
+  # Format recent handoffs
+  SA_HANDOFFS="none"
+  if [ "$CONTEXT_HANDOFFS" != "[]" ]; then
+    SA_HANDOFFS=$(echo "$CONTEXT_HANDOFFS" | jq -r '.[] | .name' 2>/dev/null | head -5 | paste -sd', ' - 2>/dev/null || echo "none")
+  fi
+
+  cat > "$SUBAGENT_CTX" << SAEOF
+<!-- egregore-context
+Organization: $SA_ORG_NAME (github: $SA_GITHUB_ORG)
+Session: $BRANCH — ${EGREGORE_SESSION_ID}
+Active quests: $SA_QUESTS
+Recent handoffs: $SA_HANDOFFS
+Memory: memory/ is a symlink to shared knowledge base. Use bin/graph.sh for Neo4j queries.
+-->
+SAEOF
+) 2>/dev/null || true
+
+cat << CTXEOF
+
+<!-- session-context
+{
+  "framework_version": "$FRAMEWORK_VERSION",
+  "time_of_day": "$TIME_OF_DAY",
+  "dashboard_url": "${DASHBOARD_URL:-}",
+  "recent_handoffs": $CONTEXT_HANDOFFS,
+  "addressed_to_user": $CONTEXT_ADDRESSED,
+  "quests": $CONTEXT_QUESTS,
+  "last_user_activity": "$CONTEXT_ACTIVITY",
+  "team_recent_memory": $CONTEXT_TEAM,
+  "soul_self_summary": "$CONTEXT_SOUL",
+  "lifecycle": $CONTEXT_LIFECYCLE,
+  "momentum": $CONTEXT_METRICS,
+  "pulse": $CONTEXT_PULSE
+}
+-->
+CTXEOF
+
+# Include soul file if present
+if [ -f "$SCRIPT_DIR/egregore.md" ]; then
+  echo ""
+  echo "<!-- egregore-soul"
+  cat "$SCRIPT_DIR/egregore.md"
+  echo "-->"
+fi
+
+# Include latest soul reflection if present
+if [ -d "$SCRIPT_DIR/memory/soul" ]; then
+  LATEST_REFLECTION=$(ls -t "$SCRIPT_DIR/memory/soul/"*.md 2>/dev/null | head -1 || true)
+  if [ -n "$LATEST_REFLECTION" ]; then
+    echo "<!-- latest-reflection"
+    cat "$LATEST_REFLECTION"
+    echo "-->"
+  fi
+fi
+
+# --- Flush leftover telemetry from previous session (background) ---
+# If the previous session exited without a clean flush (terminal closed,
+# crash, kill -9), events are still in the local buffer. Drain them now.
+bash "$SCRIPT_DIR/bin/telemetry.sh" flush 2>/dev/null &
+
+# --- Emit session_start telemetry (background, non-blocking) ---
+bash "$SCRIPT_DIR/bin/telemetry.sh" emit "session_start" \
+  "$(jq -n --arg branch "$BRANCH" '{branch: $branch}')" 2>/dev/null &
+
+# --- Health check-in (background, non-blocking) ---
+bash "$SCRIPT_DIR/bin/startup-check.sh" >/dev/null 2>&1 &
+
+# --- Warm npx cache for egregore-artifacts (background, throttled) ---
+# publish-artifact.sh spawns `npx egregore-artifacts` — first run in a
+# fresh npx cache pays a 5-10s npm download. Warmup is throttled to
+# once per hour via a marker file so we don't storm npm when a user
+# opens many tabs, and don't start runaway retry loops when offline.
+_WARM_TS_FILE="$HOME/.cache/egregore/npx-warm-ts"
+mkdir -p "$(dirname "$_WARM_TS_FILE")" 2>/dev/null
+_WARM_LAST=$(cat "$_WARM_TS_FILE" 2>/dev/null || echo 0)
+_WARM_NOW=$(date +%s)
+if [ $(( _WARM_NOW - _WARM_LAST )) -gt 3600 ]; then
+  (npx -y egregore-artifacts@latest --help >/dev/null 2>&1 \
+    && echo "$_WARM_NOW" > "$_WARM_TS_FILE" &) >/dev/null 2>&1
+fi
+
+# Clean up temp files
+rm -rf "$CTX_DIR"
+
+# --- First session welcome ---
+if [ -z "$FIRST_SESSION" ] && [ -f "$STATE_FILE" ]; then
+  FIRST_SESSION=$(jq -r '.first_session // false' "$STATE_FILE" 2>/dev/null)
+fi
+
+if [ "$FIRST_SESSION" = "true" ]; then
+  echo ""
+  echo "  Welcome! This is your first session."
+  echo ""
+  echo "IMPORTANT: Display the above greeting exactly as-is (ASCII art + ornamented status). Then ask the user if they'd like a quick onboarding tour (run /onboarding), or if they want to jump straight in."
+  # Clear the flag so it only shows once
+  jq '.first_session = false' "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
+else
+  # --- Tutorial tip (if onboarding done but tutorial not) ---
+  TUTORIAL_COMPLETE="true"
+  if [ -f "$STATE_FILE" ]; then
+    TUTORIAL_COMPLETE=$(jq -r '.tutorial_complete // false' "$STATE_FILE" 2>/dev/null || echo "true")
+  fi
+
+  if [ "$TUTORIAL_COMPLETE" != "true" ]; then
+    echo "  Tip: Run /tutorial to learn the core loop."
+  fi
+
+  echo ""
+  echo "IMPORTANT: Display the above greeting to the user exactly as-is (preserve the ASCII art formatting and ornamented status) on their first message. Then ask: What are you working on?"
+  echo ""
+  echo "BRANCH RULE: When the user responds with what they're working on, your FIRST action is to create a working branch: git fetch origin develop --quiet && git checkout -b dev/{author}/{topic-slug} origin/develop. Do this BEFORE any other work. Derive the topic slug from their description. If they ask a pure question with no work intent, skip branching."
+fi

package/runtime/pi/bin/lib/hash.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+# Cross-platform hash helpers — sourced by scripts that need hashing.
+
+# Compute MD5 hash of a string (macOS + Linux compatible)
+_md5() {
+  local input="$1"
+  echo -n "$input" | md5 2>/dev/null || echo -n "$input" | md5sum 2>/dev/null | cut -d' ' -f1
+}
+
+# Compute project hash (used for per-instance file isolation)
+_proj_hash() {
+  _md5 "${SCRIPT_DIR:-$PWD}"
+}

package/runtime/pi/bin/lib/identity.sh

@@ -0,0 +1,174 @@
+# shellcheck shell=bash
+# identity.sh — User identity resolution for session-start.sh
+#
+# Resolves the current user's identity through multiple fallback layers:
+#   1. .egregore-state.json github_username (stored during setup)
+#   2. GitHub API auto-detect via GITHUB_TOKEN
+#   3. Graph person lookup (existing team member on new machine)
+#   4. Global git config user.name (last resort)
+#
+# Inputs:  STATE_FILE, ENV_FILE, SCRIPT_DIR, HEALTH_GITHUB
+# Outputs: AUTHOR, DISPLAY_NAME_STATE, FIRST_SESSION, HEALTH_GITHUB,
+#          EGREGORE_USER, EGREGORE_ORG, EGREGORE_SESSION_ID
+#          Writes .egregore-session-id and ~/.egregore/session-*.id
+
+STORED_USERNAME=""
+FIRST_SESSION=""
+AUTHOR=""
+if [ -f "$STATE_FILE" ]; then
+  STORED_USERNAME=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+fi
+
+DISPLAY_NAME_STATE=""
+if [ -f "$STATE_FILE" ]; then
+  DISPLAY_NAME_STATE=$(jq -r '.display_name // empty' "$STATE_FILE" 2>/dev/null)
+fi
+
+if [ -n "$STORED_USERNAME" ]; then
+  # Identity stored during setup — use it and ensure repo-local git config matches
+  AUTHOR="$STORED_USERNAME"
+  HEALTH_GITHUB="ok"
+  CURRENT_LOCAL=$(git config --local user.name 2>/dev/null || echo "")
+  if [ "$CURRENT_LOCAL" != "$STORED_USERNAME" ]; then
+    STORED_NAME=$(jq -r '.github_name // empty' "$STATE_FILE" 2>/dev/null)
+    git config user.name "${STORED_NAME:-$STORED_USERNAME}" 2>/dev/null || true
+    git config user.email "${STORED_USERNAME}@users.noreply.github.com" 2>/dev/null || true
+  fi
+else
+  # No stored identity — try GitHub API to auto-detect (self-healing for pre-fix installs)
+  if [ -f "$ENV_FILE" ]; then
+    GH_TOKEN=$(grep '^GITHUB_TOKEN=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2-)
+    if [ -n "$GH_TOKEN" ]; then
+      GH_USER_JSON=$(curl -s -H "Authorization: token $GH_TOKEN" https://api.github.com/user --max-time 5 2>/dev/null || echo "")
+      GH_LOGIN=$(echo "$GH_USER_JSON" | jq -r '.login // empty' 2>/dev/null)
+      GH_NAME=$(echo "$GH_USER_JSON" | jq -r '.name // empty' 2>/dev/null)
+      if [ -n "$GH_LOGIN" ]; then
+        AUTHOR="$GH_LOGIN"
+        HEALTH_GITHUB="ok"
+        # Set repo-local config and save to state for next time
+        git config user.name "${GH_NAME:-$GH_LOGIN}" 2>/dev/null || true
+        git config user.email "${GH_LOGIN}@users.noreply.github.com" 2>/dev/null || true
+        # Save to state file so we don't need API call next time
+        # Include onboarding_complete + name so it doesn't re-trigger onboarding
+        # Determine if founder or joiner: if github_username != github_org, they're a joiner
+        GITHUB_ORG_CFG=$(jq -r '.github_org // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+        if [ -n "$GITHUB_ORG_CFG" ] && [ "$GH_LOGIN" != "$GITHUB_ORG_CFG" ]; then
+          USAGE_TYPE="joiner_group"
+        else
+          USAGE_TYPE="founder_group"
+        fi
+        if [ -f "$STATE_FILE" ]; then
+          # Existing state file — update identity but preserve onboarding status
+          HAS_ONBOARDING=$(jq -r '.onboarding_complete // "unset"' "$STATE_FILE" 2>/dev/null)
+          if [ "$HAS_ONBOARDING" = "unset" ]; then
+            # State file exists but no onboarding flag — set to false to trigger it
+            jq --arg u "$GH_LOGIN" --arg n "${GH_NAME:-$GH_LOGIN}" --arg ut "$USAGE_TYPE" \
+              '.github_username = $u | .github_name = $n | .name = $n | .onboarding_complete = false | .usage_type = $ut' "$STATE_FILE" > "$STATE_FILE.tmp" \
+              && mv "$STATE_FILE.tmp" "$STATE_FILE"
+          else
+            jq --arg u "$GH_LOGIN" --arg n "${GH_NAME:-$GH_LOGIN}" --arg ut "$USAGE_TYPE" \
+              '.github_username = $u | .github_name = $n | .name = $n | .usage_type = $ut' "$STATE_FILE" > "$STATE_FILE.tmp" \
+              && mv "$STATE_FILE.tmp" "$STATE_FILE"
+          fi
+          FIRST_SESSION="false"
+        else
+          # No state file — check graph to see if this person already exists
+          # (handles fresh clone / new machine for existing team members)
+          GRAPH_PERSON=""
+          GRAPH_DISPLAY_NAME=""
+          GRAPH_PERSON=$(bash "$SCRIPT_DIR/bin/graph.sh" query \
+            "MATCH (p:Person {github: \$github}) RETURN p.name AS name" \
+            "$(jq -n --arg github "$GH_LOGIN" '{github: $github}')" 2>/dev/null || echo "")
+          if echo "$GRAPH_PERSON" | jq -e '.values | length > 0' &>/dev/null; then
+            GRAPH_DISPLAY_NAME=$(echo "$GRAPH_PERSON" | jq -r '.values[0][0] // empty' 2>/dev/null)
+            # Existing team member — skip onboarding
+            cat > "$STATE_FILE" << STATEEOF
+{
+  "github_username": "$GH_LOGIN",
+  "github_name": "${GH_NAME:-$GH_LOGIN}",
+  "name": "${GRAPH_DISPLAY_NAME:-${GH_NAME:-$GH_LOGIN}}",
+  "display_name": "${GRAPH_DISPLAY_NAME:-}",
+  "onboarding_complete": true,
+  "usage_type": "$USAGE_TYPE",
+  "session_tracking": true,
+  "transcript_sharing": true,
+  "telemetry": true,
+  "contact_preference": "all",
+  "telemetry_noticed": true
+}
+STATEEOF
+            FIRST_SESSION="false"
+          else
+            # Genuinely new user — trigger onboarding
+            cat > "$STATE_FILE" << STATEEOF
+{
+  "github_username": "$GH_LOGIN",
+  "github_name": "${GH_NAME:-$GH_LOGIN}",
+  "name": "${GH_NAME:-$GH_LOGIN}",
+  "onboarding_complete": false,
+  "usage_type": "$USAGE_TYPE",
+  "first_session": true
+}
+STATEEOF
+            FIRST_SESSION="true"
+          fi
+        fi
+      fi
+    fi
+  fi
+
+  # Final fallback: git config user.name (global or local)
+  if [ -z "$AUTHOR" ]; then
+    FULLNAME=$(git config user.name 2>/dev/null || echo "")
+    AUTHOR=$(echo "$FULLNAME" | tr '[:upper:]' '[:lower:]' | cut -d' ' -f1)
+  fi
+fi
+
+if [ -z "$AUTHOR" ]; then
+  AUTHOR="unknown"
+  HEALTH_GITHUB="fail"
+fi
+
+# --- Validate gh CLI identity matches git identity ---
+# The gh CLI has its own auth (keyring) separate from .env GITHUB_TOKEN.
+# If they diverge, PRs get created under the wrong account.
+if command -v gh &>/dev/null; then
+  GH_CLI_USER=$(gh api user --jq '.login' 2>/dev/null || true)
+  if [ -n "$GH_CLI_USER" ] && [ -n "$AUTHOR" ] && [ "$AUTHOR" != "unknown" ]; then
+    AUTHOR_LC=$(echo "$AUTHOR" | tr '[:upper:]' '[:lower:]')
+    GH_CLI_LC=$(echo "$GH_CLI_USER" | tr '[:upper:]' '[:lower:]')
+    if [ "$AUTHOR_LC" != "$GH_CLI_LC" ]; then
+      echo ""
+      echo "WARNING: Identity mismatch detected."
+      echo "  Git identity (.env):  $AUTHOR"
+      echo "  gh CLI (active):      $GH_CLI_USER"
+      echo "  PRs will be created as '$GH_CLI_USER', not '$AUTHOR'."
+      echo "  Fix: gh auth switch --user $AUTHOR"
+      echo ""
+    fi
+  fi
+fi
+
+# --- Export telemetry identity env vars ---
+export EGREGORE_USER="$AUTHOR"
+export EGREGORE_ORG="$(jq -r '.slug // .github_org // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null || true)"
+export EGREGORE_SESSION_ID="$(date -u +%Y%m%dT%H%M%S)-${AUTHOR}-$$"
+
+# Persist session ID to file so telemetry.sh can read it
+# (env vars from hooks don't propagate into the Claude Code agent)
+SESSION_ID_DIR="$HOME/.egregore"
+mkdir -p "$SESSION_ID_DIR"
+PROJ_HASH=$(echo -n "$SCRIPT_DIR" | md5 2>/dev/null || echo -n "$SCRIPT_DIR" | md5sum 2>/dev/null | cut -d' ' -f1)
+echo "$EGREGORE_SESSION_ID" > "$SESSION_ID_DIR/session-${PROJ_HASH}.id"
+# Also write project-local file (CLAUDE.md reads this — no glob needed)
+echo "$EGREGORE_SESSION_ID" > "$SCRIPT_DIR/.egregore-session-id"
+
+# Model stamp hashes the git common-dir root because telemetry.sh resolves it that way.
+MODEL_REPO_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --path-format=absolute --git-common-dir 2>/dev/null | sed 's|/\.git$||') || MODEL_REPO_ROOT="$SCRIPT_DIR"
+MODEL_PROJ_HASH=$(echo -n "$MODEL_REPO_ROOT" | md5 2>/dev/null || echo -n "$MODEL_REPO_ROOT" | md5sum 2>/dev/null | cut -d' ' -f1)
+MODEL_STAMP_FILE="$SESSION_ID_DIR/session-model-${MODEL_PROJ_HASH}"
+if [ -n "${CLAUDE_MODEL:-}" ]; then
+  echo "$CLAUDE_MODEL" > "$MODEL_STAMP_FILE"
+else
+  rm -f "$MODEL_STAMP_FILE"
+fi