create-egregore 0.19.5 → 0.19.7

package/runtime/pi/bin/lib/metrics.sh

@@ -0,0 +1,374 @@
+# shellcheck shell=bash
+# metrics.sh — Momentum metrics gathering and rendering for startup greetings.
+#
+# Function-only library. Safe to source from bash or zsh.
+
+_metrics_zero_json() {
+  printf '%s\n' '{"source":"local","sessions":{"buckets":[0,0,0,0,0],"week":0,"prev":0,"all":0},"commits":{"buckets":[0,0,0,0,0],"week":0,"prev":0,"authors":0,"all":0},"handoffs":{"buckets":[0,0,0,0,0],"week":0,"prev":0,"avg_resolution_days":null,"all":0},"knowledge":{"buckets":[0,0,0,0,0],"week":0,"prev":0,"all":0},"members":{"active":0,"total":0}}'
+}
+
+_num() {
+  awk '{n=$1+0; if (n < 0) n=0; printf "%d\n", n}' 2>/dev/null <<EOF
+$1
+EOF
+}
+
+_num_float() {
+  awk '{n=$1+0; if (n < 0) n=0; printf "%.1f\n", n}' 2>/dev/null <<EOF
+$1
+EOF
+}
+
+_normalize_buckets() {
+  set -- $(printf '%s' "$1")
+  printf '%d %d %d %d %d\n' "$(_num "${1:-0}")" "$(_num "${2:-0}")" "$(_num "${3:-0}")" "$(_num "${4:-0}")" "$(_num "${5:-0}")"
+}
+
+_buckets_json() {
+  set -- $(printf '%s' "$(_normalize_buckets "$1")")
+  jq -n --argjson a "$(_num "${1:-0}")" --argjson b "$(_num "${2:-0}")" \
+    --argjson c "$(_num "${3:-0}")" --argjson d "$(_num "${4:-0}")" \
+    --argjson e "$(_num "${5:-0}")" '[$a,$b,$c,$d,$e]' 2>/dev/null || echo '[0,0,0,0,0]'
+}
+
+_bucket_week() {
+  set -- $(printf '%s' "$(_normalize_buckets "$1")")
+  _num "${5:-0}"
+}
+
+_bucket_prev() {
+  set -- $(printf '%s' "$(_normalize_buckets "$1")")
+  _num "${4:-0}"
+}
+
+_spark() {
+  local values max out v idx glyph
+  values="${1:-0 0 0 0 0}"
+  max=0
+  set -- $(printf '%s' "$values")
+  [ "$#" -eq 0 ] && set -- 0 0 0 0 0
+  for v in "$@"; do
+    v=$(_num "$v")
+    [ "$v" -gt "$max" ] 2>/dev/null && max="$v"
+  done
+  out=""
+  for v in "$@"; do
+    v=$(_num "$v")
+    if [ "$max" -le 0 ] 2>/dev/null; then
+      idx=0
+    else
+      idx=$(( (v * 7) / max ))
+    fi
+    # Select glyphs explicitly: substring slicing can split UTF-8 characters
+    # under Bash 3.2 or a C locale.
+    case "$idx" in
+      0) glyph="▁" ;;
+      1) glyph="▂" ;;
+      2) glyph="▃" ;;
+      3) glyph="▄" ;;
+      4) glyph="▅" ;;
+      5) glyph="▆" ;;
+      6) glyph="▇" ;;
+      *) glyph="█" ;;
+    esac
+    out="${out}${glyph}"
+  done
+  printf '%s\n' "$out"
+}
+
+_pct_delta() {
+  local cur prev pct
+  cur=$(_num "${1:-0}")
+  prev=$(_num "${2:-0}")
+  [ "$prev" -le 0 ] 2>/dev/null && return 0
+  pct=$(( ((cur - prev) * 100) / prev ))
+  if [ "$pct" -gt 0 ] 2>/dev/null; then
+    printf '↑ %d%%\n' "$pct"
+  elif [ "$pct" -lt 0 ] 2>/dev/null; then
+    printf '↓ %d%%\n' "$(( -pct ))"
+  else
+    printf '→ 0%%\n'
+  fi
+}
+
+_commafy() {
+  awk '
+    function comma(s, out, sign) {
+      s = int(s + 0)
+      if (s < 0) { sign = "-"; s = -s } else { sign = "" }
+      s = sprintf("%d", s)
+      out = ""
+      while (length(s) > 3) {
+        out = "," substr(s, length(s) - 2, 3) out
+        s = substr(s, 1, length(s) - 3)
+      }
+      return sign s out
+    }
+    { print comma($1) }
+  ' 2>/dev/null <<EOF
+${1:-0}
+EOF
+}
+
+_git_added_buckets() {
+  local repo now paths
+  repo="$1"
+  shift
+  now=$(date +%s)
+  if [ -d "$repo" ] || [ -f "$repo" ]; then
+    git -C "$repo" log --diff-filter=A --since="35 days ago" --format='%ct' -- "$@" 2>/dev/null | \
+      awk -v now="$now" '
+        BEGIN { for (i=0;i<5;i++) b[i]=0 }
+        /^[0-9]+$/ {
+          days = int((now - $1) / 86400)
+          idx = 4 - int(days / 7)
+          if (idx >= 0 && idx < 5) b[idx]++
+        }
+        END { printf "%d %d %d %d %d\n", b[0], b[1], b[2], b[3], b[4] }
+      ' 2>/dev/null || echo "0 0 0 0 0"
+  else
+    echo "0 0 0 0 0"
+  fi
+}
+
+_find_count_md() {
+  find -L "$@" -name '*.md' ! -name 'index*' 2>/dev/null | wc -l | awk '{print $1+0}' 2>/dev/null || echo 0
+}
+
+_metrics_gather() {
+  local _root _mem _scratch _API_URL _API_KEY _connected
+  _root="${SCRIPT_DIR:-$PWD}"
+  _mem="$_root/memory"
+  _scratch=$(mktemp -d 2>/dev/null || mktemp -d -t egregore-metrics)
+  _API_URL=$(jq -r '.api_url // empty' "$_root/egregore.json" 2>/dev/null || echo "")
+  _API_KEY=$(grep '^EGREGORE_API_KEY=' "${ENV_FILE:-$_root/.env}" 2>/dev/null | cut -d'=' -f2- || true)
+  _connected=false
+  [ -n "$_API_URL" ] && [ -n "$_API_KEY" ] && _connected=true
+
+  (
+    if [ "$_connected" = true ]; then
+      raw=$(bash "$_root/bin/graph.sh" query "MATCH (s:Session) WHERE date(s.date) >= date() - duration('P35D')
+OPTIONAL MATCH (s)-[:BY]->(p:Person)
+WITH duration.inDays(date(s.date), date()).days / 7 AS weeksAgo,
+     count(s) AS sessions, count(DISTINCT p) AS people
+RETURN weeksAgo, sessions, people ORDER BY weeksAgo" 2>/dev/null || echo "")
+      printf '%s' "$raw" | jq -r '
+        (.values // []) as $v
+        | if ($v|length) == 0 then empty else
+          reduce $v[] as $r ({b:[0,0,0,0,0], a:0, ok:0};
+            ($r[0] // 99 | tonumber? // 99) as $w
+            | if $w >= 0 and $w <= 4 then
+                .b[4 - $w] = (($r[1] // 0 | tonumber? // 0) | floor)
+                | .ok = 1
+                | if $w == 0 then .a = (($r[2] // 0 | tonumber? // 0) | floor) else . end
+              else . end)
+          | "\(.b|join(" "))|\(.a)|\(.ok)"
+          end
+      ' 2>/dev/null || echo "0 0 0 0 0|0|0"
+    else
+      echo "0 0 0 0 0|0|0"
+    fi
+  ) > "$_scratch/graph_sessions" 2>/dev/null &
+
+  (
+    if [ "$_connected" = true ]; then
+      raw=$(bash "$_root/bin/graph.sh" query "MATCH (s:Session) WITH count(s) AS totalSessions MATCH (p:Person)-[:MEMBER_OF]->(:Org) RETURN totalSessions, count(DISTINCT p) AS members" 2>/dev/null || echo "")
+      total=$(printf '%s' "$raw" | jq -r '.values[0][0] // 0' 2>/dev/null || echo 0)
+      members=$(printf '%s' "$raw" | jq -r '.values[0][1] // 0' 2>/dev/null || echo 0)
+      if [ "$(_num "$members")" -eq 0 ] 2>/dev/null; then
+        raw2=$(bash "$_root/bin/graph.sh" query "MATCH (p:Person) RETURN count(p)" 2>/dev/null || echo "")
+        members=$(printf '%s' "$raw2" | jq -r '.values[0][0] // 0' 2>/dev/null || echo 0)
+      fi
+      printf '%s|%s\n' "$(_num "$total")" "$(_num "$members")"
+    else
+      echo "0|0"
+    fi
+  ) > "$_scratch/graph_totals" 2>/dev/null &
+
+  (
+    if [ "$_connected" = true ]; then
+      raw=$(bash "$_root/bin/graph.sh" query "MATCH (s:Session)-[:HANDED_TO]->(:Person)
+WHERE s.handoffStatus = 'done' AND date(s.date) >= date() - duration('P30D')
+  AND s.handoffReadDate IS NOT NULL
+WITH duration.inDays(date(s.date), date(s.handoffReadDate)).days AS d
+RETURN avg(d) AS avgDays, count(*) AS n" 2>/dev/null || echo "")
+      avg=$(printf '%s' "$raw" | jq -r '.values[0][0] // empty' 2>/dev/null || echo "")
+      n=$(printf '%s' "$raw" | jq -r '.values[0][1] // 0' 2>/dev/null || echo 0)
+      if [ "$(_num "$n")" -gt 0 ] 2>/dev/null && [ -n "$avg" ]; then _num_float "$avg"; else echo ""; fi
+    else
+      echo ""
+    fi
+  ) > "$_scratch/handoff_resolution" 2>/dev/null &
+
+  (
+    buckets=$(_git_added_buckets "$_mem" sessions wraps)
+    all=$(_find_count_md "$_root/memory/sessions" "$_root/memory/wraps")
+    printf '%s|%s\n' "$buckets" "$all"
+  ) > "$_scratch/local_sessions" 2>/dev/null &
+
+  (
+    now=$(date +%s)
+    if [ -d "$_mem" ] || [ -f "$_mem" ]; then
+      git -C "$_mem" log --since="35 days ago" --format='%ct|%ae' 2>/dev/null | \
+        awk -F'|' -v now="$now" '
+          BEGIN { for (i=0;i<5;i++) b[i]=0 }
+          {
+            days = int((now - $1) / 86400)
+            idx = 4 - int(days / 7)
+            if (idx >= 0 && idx < 5) {
+              b[idx]++
+              if (idx == 4 && $2 != "") a[$2]=1
+            }
+          }
+          END {
+            n=0; for (k in a) n++
+            printf "%d %d %d %d %d|%d\n", b[0], b[1], b[2], b[3], b[4], n
+          }
+        ' 2>/dev/null || echo "0 0 0 0 0|0"
+    else
+      echo "0 0 0 0 0|0"
+    fi
+  ) > "$_scratch/commits" 2>/dev/null &
+
+  (
+    if [ -d "$_mem" ] || [ -f "$_mem" ]; then git -C "$_mem" rev-list --count HEAD 2>/dev/null || echo 0; else echo 0; fi
+  ) > "$_scratch/commits_all" 2>/dev/null &
+
+  (
+    buckets=$(_git_added_buckets "$_mem" handoffs)
+    all=$(_find_count_md "$_root/memory/handoffs")
+    printf '%s|%s\n' "$buckets" "$all"
+  ) > "$_scratch/handoffs" 2>/dev/null &
+
+  (
+    buckets=$(_git_added_buckets "$_mem" knowledge/decisions knowledge/findings knowledge/patterns)
+    all=$(_find_count_md "$_root/memory/knowledge/decisions" "$_root/memory/knowledge/findings" "$_root/memory/knowledge/patterns")
+    printf '%s|%s\n' "$buckets" "$all"
+  ) > "$_scratch/knowledge" 2>/dev/null &
+
+  (
+    _find_count_md "$_root/memory/people"
+  ) > "$_scratch/members_total_local" 2>/dev/null &
+
+  wait
+
+  gs=$(cat "$_scratch/graph_sessions" 2>/dev/null || echo "0 0 0 0 0|0|0")
+  gt=$(cat "$_scratch/graph_totals" 2>/dev/null || echo "0|0")
+  lsess=$(cat "$_scratch/local_sessions" 2>/dev/null || echo "0 0 0 0 0|0")
+  commits=$(cat "$_scratch/commits" 2>/dev/null || echo "0 0 0 0 0|0")
+  handoffs=$(cat "$_scratch/handoffs" 2>/dev/null || echo "0 0 0 0 0|0")
+  knowledge=$(cat "$_scratch/knowledge" 2>/dev/null || echo "0 0 0 0 0|0")
+
+  graph_valid=$(_num "$(printf '%s' "$gs" | awk -F'|' '{print $3}')")
+  if [ "$graph_valid" -gt 0 ] 2>/dev/null; then
+    source_name="graph"
+    session_buckets=$(_normalize_buckets "$(printf '%s' "$gs" | awk -F'|' '{print $1}')")
+    session_all=$(_num "$(printf '%s' "$gt" | awk -F'|' '{print $1}')")
+    members_active=$(_num "$(printf '%s' "$gs" | awk -F'|' '{print $2}')")
+    members_total=$(_num "$(printf '%s' "$gt" | awk -F'|' '{print $2}')")
+    if [ "$session_all" -le 0 ] 2>/dev/null; then
+      session_all=$(_num "$(printf '%s' "$lsess" | awk -F'|' '{print $2}')")
+    fi
+    if [ "$members_total" -le 0 ] 2>/dev/null; then
+      members_total=$(_num "$(cat "$_scratch/members_total_local" 2>/dev/null || echo 0)")
+    fi
+  else
+    source_name="local"
+    session_buckets=$(_normalize_buckets "$(printf '%s' "$lsess" | awk -F'|' '{print $1}')")
+    session_all=$(_num "$(printf '%s' "$lsess" | awk -F'|' '{print $2}')")
+    members_active=$(_num "$(printf '%s' "$commits" | awk -F'|' '{print $2}')")
+    members_total=$(_num "$(cat "$_scratch/members_total_local" 2>/dev/null || echo 0)")
+  fi
+
+  commit_buckets=$(_normalize_buckets "$(printf '%s' "$commits" | awk -F'|' '{print $1}')")
+  handoff_buckets=$(_normalize_buckets "$(printf '%s' "$handoffs" | awk -F'|' '{print $1}')")
+  knowledge_buckets=$(_normalize_buckets "$(printf '%s' "$knowledge" | awk -F'|' '{print $1}')")
+  avg_res=$(cat "$_scratch/handoff_resolution" 2>/dev/null || echo "")
+
+  session_buckets_json=$(_buckets_json "$session_buckets")
+  commit_buckets_json=$(_buckets_json "$commit_buckets")
+  handoff_buckets_json=$(_buckets_json "$handoff_buckets")
+  knowledge_buckets_json=$(_buckets_json "$knowledge_buckets")
+
+  if [ -n "$avg_res" ]; then
+    jq -n --arg source "$source_name" \
+      --argjson sb "$session_buckets_json" --argjson sw "$(_bucket_week "$session_buckets")" --argjson sp "$(_bucket_prev "$session_buckets")" --argjson sall "$session_all" \
+      --argjson cb "$commit_buckets_json" --argjson cw "$(_bucket_week "$commit_buckets")" --argjson cp "$(_bucket_prev "$commit_buckets")" --argjson ca "$(_num "$(printf '%s' "$commits" | awk -F'|' '{print $2}')")" --argjson call "$(_num "$(cat "$_scratch/commits_all" 2>/dev/null || echo 0)")" \
+      --argjson hb "$handoff_buckets_json" --argjson hw "$(_bucket_week "$handoff_buckets")" --argjson hp "$(_bucket_prev "$handoff_buckets")" --argjson havg "$avg_res" --argjson hall "$(_num "$(printf '%s' "$handoffs" | awk -F'|' '{print $2}')")" \
+      --argjson kb "$knowledge_buckets_json" --argjson kw "$(_bucket_week "$knowledge_buckets")" --argjson kp "$(_bucket_prev "$knowledge_buckets")" --argjson kall "$(_num "$(printf '%s' "$knowledge" | awk -F'|' '{print $2}')")" \
+      --argjson ma "$members_active" --argjson mt "$members_total" \
+      '{source:$source,sessions:{buckets:$sb,week:$sw,prev:$sp,all:$sall},commits:{buckets:$cb,week:$cw,prev:$cp,authors:$ca,all:$call},handoffs:{buckets:$hb,week:$hw,prev:$hp,avg_resolution_days:$havg,all:$hall},knowledge:{buckets:$kb,week:$kw,prev:$kp,all:$kall},members:{active:$ma,total:$mt}}' 2>/dev/null || _metrics_zero_json
+  else
+    jq -n --arg source "$source_name" \
+      --argjson sb "$session_buckets_json" --argjson sw "$(_bucket_week "$session_buckets")" --argjson sp "$(_bucket_prev "$session_buckets")" --argjson sall "$session_all" \
+      --argjson cb "$commit_buckets_json" --argjson cw "$(_bucket_week "$commit_buckets")" --argjson cp "$(_bucket_prev "$commit_buckets")" --argjson ca "$(_num "$(printf '%s' "$commits" | awk -F'|' '{print $2}')")" --argjson call "$(_num "$(cat "$_scratch/commits_all" 2>/dev/null || echo 0)")" \
+      --argjson hb "$handoff_buckets_json" --argjson hw "$(_bucket_week "$handoff_buckets")" --argjson hp "$(_bucket_prev "$handoff_buckets")" --argjson hall "$(_num "$(printf '%s' "$handoffs" | awk -F'|' '{print $2}')")" \
+      --argjson kb "$knowledge_buckets_json" --argjson kw "$(_bucket_week "$knowledge_buckets")" --argjson kp "$(_bucket_prev "$knowledge_buckets")" --argjson kall "$(_num "$(printf '%s' "$knowledge" | awk -F'|' '{print $2}')")" \
+      --argjson ma "$members_active" --argjson mt "$members_total" \
+      '{source:$source,sessions:{buckets:$sb,week:$sw,prev:$sp,all:$sall},commits:{buckets:$cb,week:$cw,prev:$cp,authors:$ca,all:$call},handoffs:{buckets:$hb,week:$hw,prev:$hp,avg_resolution_days:null,all:$hall},knowledge:{buckets:$kb,week:$kw,prev:$kp,all:$kall},members:{active:$ma,total:$mt}}' 2>/dev/null || _metrics_zero_json
+  fi
+  rm -rf "$_scratch" 2>/dev/null || true
+}
+
+_metrics_read() {
+  local file filter fallback
+  file="${CTX_DIR:-}/metrics"
+  filter="$1"
+  fallback="$2"
+  if [ -f "$file" ]; then
+    jq -r "$filter" "$file" 2>/dev/null || echo "$fallback"
+  else
+    echo "$fallback"
+  fi
+}
+
+_render_momentum_board() {
+  local separator line_width header_left header_right pad
+  local sb sw sp sall cb cw ca call hb hw havg hall kb kw kall active total
+  local sdelta sann cann hann kann know_week
+  separator="${SEPARATOR:-  ┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄}"
+  line_width="${LINE_WIDTH:-67}"
+
+  sb=$(_metrics_read '(.sessions.buckets // [0,0,0,0,0]) | .[0:5] | map(. // 0) | join(" ")' "0 0 0 0 0")
+  sw=$(_num "$(_metrics_read '.sessions.week // 0' "0")")
+  sp=$(_num "$(_metrics_read '.sessions.prev // 0' "0")")
+  sall=$(_num "$(_metrics_read '.sessions.all // 0' "0")")
+  cb=$(_metrics_read '(.commits.buckets // [0,0,0,0,0]) | .[0:5] | map(. // 0) | join(" ")' "0 0 0 0 0")
+  cw=$(_num "$(_metrics_read '.commits.week // 0' "0")")
+  ca=$(_num "$(_metrics_read '.commits.authors // 0' "0")")
+  call=$(_num "$(_metrics_read '.commits.all // 0' "0")")
+  hb=$(_metrics_read '(.handoffs.buckets // [0,0,0,0,0]) | .[0:5] | map(. // 0) | join(" ")' "0 0 0 0 0")
+  hw=$(_num "$(_metrics_read '.handoffs.week // 0' "0")")
+  havg=$(_metrics_read '.handoffs.avg_resolution_days // empty' "")
+  hall=$(_num "$(_metrics_read '.handoffs.all // 0' "0")")
+  kb=$(_metrics_read '(.knowledge.buckets // [0,0,0,0,0]) | .[0:5] | map(. // 0) | join(" ")' "0 0 0 0 0")
+  kw=$(_num "$(_metrics_read '.knowledge.week // 0' "0")")
+  kall=$(_num "$(_metrics_read '.knowledge.all // 0' "0")")
+  active=$(_num "$(_metrics_read '.members.active // 0' "0")")
+  total=$(_num "$(_metrics_read '.members.total // 0' "0")")
+
+  header_left="  ◦ momentum · this week"
+  header_right="${active} of ${total} active"
+  pad=$((line_width - ${#header_left} - ${#header_right}))
+  [ "$pad" -lt 1 ] && pad=1
+  printf "%s%*s%s\n" "$header_left" "$pad" "" "$header_right"
+
+  sdelta=$(_pct_delta "$sw" "$sp")
+  sann=""
+  [ -n "$sdelta" ] && sann="${sdelta} vs last week"
+  cann=""
+  if [ "$ca" -gt 0 ] 2>/dev/null; then
+    if [ "$ca" -eq 1 ] 2>/dev/null; then cann="1 author"; else cann="${ca} authors"; fi
+  fi
+  hann=""
+  if [ -n "$havg" ]; then hann="$(_num_float "$havg")d avg resolution"; fi
+  kann="$(_commafy "$kall") artifacts total"
+  know_week="+${kw}"
+
+  printf "  %-11s%5s   5-week %s   %s\n\n" "sessions" "$sw" "$(_spark "$sb")" "$sann"
+  printf "  %-11s%5s   5-week %s   %s\n\n" "commits" "$cw" "$(_spark "$cb")" "$cann"
+  printf "  %-11s%5s   5-week %s   %s\n\n" "handoffs" "$hw" "$(_spark "$hb")" "$hann"
+  printf "  %-11s%5s   5-week %s   %s\n" "knowledge" "$know_week" "$(_spark "$kb")" "$kann"
+  echo "$separator"
+  printf "  %s sessions · %s commits · %s handoffs all-time\n" "$(_commafy "$sall")" "$(_commafy "$call")" "$(_commafy "$hall")"
+}

package/runtime/pi/bin/lib/permissions.sh

@@ -0,0 +1,106 @@
+# shellcheck shell=bash
+# permissions.sh — Soft-enforced admin-only access for Egregore content.
+#
+# Content can be marked admin-only via frontmatter:
+#
+#     ---
+#     admin: true
+#     ---
+#
+# Admins are listed in egregore.json under "admins": ["github1", "github2", ...].
+#
+# Two enforcement layers:
+#
+#  - Read-side (CLI listings, /view rendering) — soft, tag-not-hide:
+#    admin entries appear in /activity and /dashboard listings tagged so admins
+#    can identify them at a glance. For non-admins the title/topic/branch are
+#    replaced with an opaque "[admin]" placeholder — they see admin work
+#    exists but the topic doesn't leak. Anyone with git access still bypasses
+#    by `cat`-ing the file.
+#
+#  - Publish-side (egregore.xyz upload) — strict: publish-artifact.sh refuses
+#    to push admin-only files because egregore.xyz URLs are not auth-gated.
+#    Override with --allow-admin (set by /view after explicit user
+#    confirmation via AskUserQuestion).
+
+# Get list of admin GitHub usernames (newline-separated, lowercase)
+_get_admins() {
+  local config="${CONFIG:-${SCRIPT_DIR:-$(pwd)}/egregore.json}"
+  if [ -f "$config" ]; then
+    jq -r '.admins[]? // empty' "$config" 2>/dev/null | tr '[:upper:]' '[:lower:]'
+  fi
+}
+
+# Returns 0 if username is an admin, 1 otherwise. Empty username = not admin.
+_is_admin() {
+  local username="${1:-}"
+  [ -z "$username" ] && return 1
+  local lc
+  lc=$(printf '%s' "$username" | tr '[:upper:]' '[:lower:]')
+  _get_admins | grep -qx "$lc"
+}
+
+# Returns 0 if the file's frontmatter contains `admin: true`, 1 otherwise.
+# Tolerates whitespace and case in the value. Looks at the first ~60 lines
+# to keep the scan bounded.
+_is_admin_only_file() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  awk '
+    BEGIN { in_fm = 0; found = 0 }
+    NR == 1 && /^---[[:space:]]*$/ { in_fm = 1; next }
+    in_fm && /^---[[:space:]]*$/ { exit (found ? 0 : 1) }
+    in_fm && tolower($0) ~ /^admin:[[:space:]]*true[[:space:]]*$/ { found = 1 }
+    NR > 60 { exit (found ? 0 : 1) }
+    END { exit (found ? 0 : 1) }
+  ' "$path" 2>/dev/null
+}
+
+# Returns 0 if the file's frontmatter has the `admin:` key set at all (true or
+# false), 1 otherwise. Used by the admin-content-detector hook to skip files
+# whose admin status was already decided — including an explicit `admin: false`
+# meaning "reviewed, public on purpose". Without this, the hook would re-prompt
+# on every edit of a sensitive-keyword file the user has already cleared.
+_has_admin_decision() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  awk '
+    BEGIN { in_fm = 0; found = 0 }
+    NR == 1 && /^---[[:space:]]*$/ { in_fm = 1; next }
+    in_fm && /^---[[:space:]]*$/ { exit (found ? 0 : 1) }
+    in_fm && tolower($0) ~ /^admin:[[:space:]]*(true|false)[[:space:]]*$/ { found = 1 }
+    NR > 60 { exit (found ? 0 : 1) }
+    END { exit (found ? 0 : 1) }
+  ' "$path" 2>/dev/null
+}
+
+# Resolve current user's GitHub username (lowercase). Falls back through:
+#   $1 → .egregore-state.json → git user.name
+_current_user() {
+  local explicit="${1:-}"
+  if [ -n "$explicit" ]; then
+    printf '%s' "$explicit" | tr '[:upper:]' '[:lower:]'
+    return 0
+  fi
+  local state="${SCRIPT_DIR:-$(pwd)}/.egregore-state.json"
+  if [ -f "$state" ]; then
+    local u
+    u=$(jq -r '.github_username // empty' "$state" 2>/dev/null)
+    if [ -n "$u" ]; then
+      printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
+      return 0
+    fi
+  fi
+  git config user.name 2>/dev/null | tr '[:upper:]' '[:lower:]'
+}
+
+# Returns 0 if the file's body contains sensitive keywords (fundraising, legal,
+# personnel, strategic). Used by the admin-content-detector hook to flag files
+# that probably should be admin-only but aren't yet. Whole-word match on a
+# short curated list — easy to extend without retraining intuition.
+_looks_sensitive() {
+  local path="$1"
+  [ -f "$path" ] || return 1
+  # Word-boundary regex (case-insensitive). Keep this list curated, not exhaustive.
+  grep -qiE '\b(fundrais(e|ing)|term[ -]?sheet|cap[ -]?table|valuation|runway|investor|VC[s]?|raise|seed[ -]?round|series[ -][a-d]|board[ -]prep|equity[ -]grant|stock[ -]option|RSU|salary|compensation|payroll|severance|PIP|NDA|attorney|legal[ -]hold|lawsuit|acquisition|merger|due[ -]diligence)\b' "$path"
+}

package/runtime/pi/bin/lib/time.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Cross-platform time helpers — sourced by scripts that need time formatting.
+
+# Convert ISO timestamp to epoch seconds (macOS + Linux compatible)
+# Assumes input is UTC (Z or +00:00 suffix, or bare — treated as UTC)
+_iso_to_epoch() {
+  local iso="$1"
+  local clean
+  clean=$(echo "$iso" | sed 's/Z$//; s/+00:00$//; s/\.[0-9]*//')
+  # If date-only (no T), append midnight to avoid macOS date -j filling current time
+  [[ "$clean" != *T* ]] && clean="${clean}T00:00:00"
+  # macOS → date -j, Linux → date -d
+  TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%S" "$clean" "+%s" 2>/dev/null || \
+    TZ=UTC date -d "$clean" +%s 2>/dev/null || echo "0"
+}
+
+# Convert epoch to relative time string (e.g. "3h ago", "yesterday")
+# Uses calendar-day comparison for multi-day ranges (not raw delta)
+_epoch_to_relative() {
+  local epoch="$1"
+  local now="${2:-$(date +%s)}"
+  [ "$epoch" = "0" ] && echo "--" && return
+  local delta=$(( now - epoch ))
+  if [ "$delta" -lt 60 ]; then echo "just now"
+  elif [ "$delta" -lt 3600 ]; then echo "$(( delta / 60 ))m ago"
+  elif [ "$delta" -lt 86400 ]; then echo "$(( delta / 3600 ))h ago"
+  else
+    # Calendar-day based: compare local dates for accurate "yesterday" / "Xd ago"
+    local event_date today_date
+    event_date=$(date -r "$epoch" +%Y-%m-%d 2>/dev/null || \
+                 date -d "@$epoch" +%Y-%m-%d 2>/dev/null || echo "")
+    today_date=$(date +%Y-%m-%d)
+    if [ -z "$event_date" ] || [ "$event_date" = "$today_date" ]; then echo "today"
+    else
+      local today_e event_e
+      today_e=$(date -j -f "%Y-%m-%d" "$today_date" +%s 2>/dev/null || \
+                date -d "$today_date" +%s 2>/dev/null || echo "$now")
+      event_e=$(date -j -f "%Y-%m-%d" "$event_date" +%s 2>/dev/null || \
+                date -d "$event_date" +%s 2>/dev/null || echo "$epoch")
+      local days=$(( (today_e - event_e) / 86400 ))
+      [ "$days" -lt 1 ] && days=1
+      if [ "$days" -eq 1 ]; then echo "yesterday"
+      else echo "${days}d ago"
+      fi
+    fi
+  fi
+}
+
+# Millisecond timer (for latency measurement)
+_millis() {
+  if command -v gdate &>/dev/null; then
+    gdate +%s%3N
+  else
+    python3 -c "import time; print(int(time.time() * 1000))" 2>/dev/null || echo "0"
+  fi
+}

package/runtime/pi/bin/lib/worktree-links.sh

@@ -0,0 +1,54 @@
+# shellcheck shell=bash
+# worktree-links.sh - shared-state bootstrap for git worktrees.
+#
+# Claude Code worktrees are normally created through bin/worktree-create.sh,
+# which links memory/, .env, and local state from the main checkout. Portable
+# runtimes such as Codex can land in a plain git worktree, so startup and
+# agent.sh use this helper to self-heal those links before reading context.
+
+egregore_main_project_dir() {
+  local project_dir="${1:?project dir required}"
+  if [ -f "$project_dir/.git" ]; then
+    local wt_gitdir
+    wt_gitdir=$(sed 's/^gitdir: //' "$project_dir/.git" 2>/dev/null || true)
+    if [ -n "$wt_gitdir" ]; then
+      cd "$wt_gitdir/../../.." 2>/dev/null && pwd
+      return
+    fi
+  fi
+  cd "$project_dir" 2>/dev/null && pwd
+}
+
+egregore_link_shared_state() {
+  local worktree_dir="${1:?worktree dir required}"
+  local main_dir="${2:-}"
+  local file src dst resolved
+
+  [ -f "$worktree_dir/.git" ] || return 0
+  [ -n "$main_dir" ] || main_dir="$(egregore_main_project_dir "$worktree_dir")"
+  [ -n "$main_dir" ] || return 0
+  [ "$main_dir" != "$worktree_dir" ] || return 0
+
+  for file in memory .env .egregore-state.json .egregore-session-id; do
+    src="$main_dir/$file"
+    dst="$worktree_dir/$file"
+
+    if [ "$file" = "memory" ]; then
+      if [ -L "$src" ] || [ -d "$src" ]; then
+        resolved="$(realpath "$src" 2>/dev/null || true)"
+        [ -n "$resolved" ] && [ -d "$resolved" ] || continue
+        src="$resolved"
+      else
+        continue
+      fi
+    else
+      [ -f "$src" ] || continue
+    fi
+
+    if [ -L "$dst" ]; then
+      ln -sfn "$src" "$dst" 2>/dev/null || true
+    elif [ ! -e "$dst" ]; then
+      ln -s "$src" "$dst" 2>/dev/null || true
+    fi
+  done
+}