create-egregore 0.19.8 → 0.19.11

package/runtime/codex/bin/session-log.sh

@@ -0,0 +1,199 @@
+#!/bin/bash
+# Graceful session-end adapter: write a structured session log to memory/sessions/.
+# Receives runtime-neutral JSON on stdin from Claude Code or Pi.
+# Runs BEFORE transcript-archive.sh (needs obs buffer + worktree intact).
+# Makes sessions visible in local-mode without requiring /handoff or /wrap.
+set -euo pipefail
+
+# Suppress all output — hook scripts must not leak to terminal
+exec >/dev/null 2>&1
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." 2>/dev/null && pwd)" || SCRIPT_DIR=""
+if [ -z "$SCRIPT_DIR" ] || [ ! -d "$SCRIPT_DIR" ]; then
+  SCRIPT_DIR="${CLAUDE_PROJECT_DIR:-}"
+fi
+if [ -z "$SCRIPT_DIR" ] || [ ! -d "$SCRIPT_DIR" ]; then
+  exit 0
+fi
+
+# --- Read hook input from stdin ---
+INPUT=$(cat /dev/stdin 2>/dev/null || echo "{}")
+SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null || true)
+TRANSCRIPT_PATH=$(echo "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null || true)
+
+if [ -z "$SESSION_ID" ]; then
+  exit 0
+fi
+
+# Sanitize SESSION_ID
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ] || [ ${#SESSION_ID} -gt 128 ]; then
+  exit 0
+fi
+
+# --- Gate: memory must exist ---
+if [ ! -L "$SCRIPT_DIR/memory" ] && [ ! -d "$SCRIPT_DIR/memory" ]; then
+  exit 0
+fi
+
+# --- Read identity ---
+STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+AUTHOR=""
+DISPLAY_NAME=""
+if [ -f "$STATE_FILE" ]; then
+  AUTHOR=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null || true)
+  DISPLAY_NAME=$(jq -r '.display_name // empty' "$STATE_FILE" 2>/dev/null || true)
+fi
+AUTHOR=$(echo "$AUTHOR" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$AUTHOR" ]; then
+  exit 0
+fi
+
+# --- Git metadata ---
+BRANCH=$(git -C "$SCRIPT_DIR" branch --show-current 2>/dev/null || echo "")
+
+# --- Derive topic from branch name ---
+TOPIC=""
+if [ -n "$BRANCH" ] && [ "$BRANCH" != "develop" ] && [ "$BRANCH" != "main" ]; then
+  TOPIC=$(echo "$BRANCH" | sed 's|^dev/[^/]*/||; s|^feature/||; s|^bugfix/||' | tr '-' ' ')
+fi
+[ -z "$TOPIC" ] && TOPIC="session"
+
+# --- Read baseline (written by session-start.sh) ---
+BASELINE_FILE="/tmp/egregore-baseline-${SESSION_ID}.json"
+BASELINE_COMMIT=""
+BASELINE_STARTED=""
+if [ -f "$BASELINE_FILE" ]; then
+  BASELINE_COMMIT=$(jq -r '.commit // empty' "$BASELINE_FILE" 2>/dev/null || true)
+  BASELINE_STARTED=$(jq -r '.started_at // empty' "$BASELINE_FILE" 2>/dev/null || true)
+fi
+
+# --- Extract timestamps from transcript ---
+STARTED_AT=""
+ENDED_AT=""
+if [ -n "$TRANSCRIPT_PATH" ]; then
+  TRANSCRIPT_PATH="${TRANSCRIPT_PATH/#\~/$HOME}"
+  TRANSCRIPT_PATH=$(realpath "$TRANSCRIPT_PATH" 2>/dev/null || echo "")
+  if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ]; then
+    STARTED_AT=$(head -1 "$TRANSCRIPT_PATH" 2>/dev/null | jq -r '.timestamp // empty' 2>/dev/null || echo "")
+    ENDED_AT=$(tail -1 "$TRANSCRIPT_PATH" 2>/dev/null | jq -r '.timestamp // empty' 2>/dev/null || echo "")
+  fi
+fi
+
+# Use baseline start time if transcript didn't provide one
+[ -z "$STARTED_AT" ] && STARTED_AT="$BASELINE_STARTED"
+# Fallback to now
+[ -z "$ENDED_AT" ] && ENDED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+[ -z "$STARTED_AT" ] && STARTED_AT="$ENDED_AT"
+
+# --- Compute duration ---
+DURATION=""
+DURATION_MIN=0
+if [ -n "$STARTED_AT" ] && [ -n "$ENDED_AT" ]; then
+  S_EPOCH=$(python3 -c "from datetime import datetime; print(int(datetime.fromisoformat('$STARTED_AT'.replace('Z','+00:00')).timestamp()))" 2>/dev/null || echo "0")
+  E_EPOCH=$(python3 -c "from datetime import datetime; print(int(datetime.fromisoformat('$ENDED_AT'.replace('Z','+00:00')).timestamp()))" 2>/dev/null || echo "0")
+  if [ "$S_EPOCH" -gt 0 ] 2>/dev/null && [ "$E_EPOCH" -gt 0 ] 2>/dev/null; then
+    DURATION_MIN=$(( (E_EPOCH - S_EPOCH) / 60 ))
+    if [ "$DURATION_MIN" -lt 1 ] 2>/dev/null; then
+      DURATION="<1min"
+    elif [ "$DURATION_MIN" -lt 60 ] 2>/dev/null; then
+      DURATION="${DURATION_MIN}min"
+    else
+      HOURS=$(( DURATION_MIN / 60 ))
+      MINS=$(( DURATION_MIN % 60 ))
+      if [ "$MINS" -gt 0 ] 2>/dev/null; then
+        DURATION="${HOURS}h ${MINS}min"
+      else
+        DURATION="${HOURS}h"
+      fi
+    fi
+  fi
+fi
+[ -z "$DURATION" ] && DURATION="unknown"
+
+# --- Read obs buffer for files touched ---
+OBS_BUFFER="/tmp/egregore-obs-${SESSION_ID}.jsonl"
+OBS_FILES=""
+OBS_COUNT=0
+if [ -f "$OBS_BUFFER" ] && [ -s "$OBS_BUFFER" ]; then
+  OBS_COUNT=$(wc -l < "$OBS_BUFFER" 2>/dev/null | tr -d ' ')
+  OBS_FILES=$(jq -r '.path // empty' "$OBS_BUFFER" 2>/dev/null | grep -v '^$' | grep -v '^unknown$' | sort -u | head -10 || true)
+fi
+
+# --- Count commits since baseline ---
+COMMIT_COUNT=0
+if [ -n "$BASELINE_COMMIT" ] && git -C "$SCRIPT_DIR" rev-parse "$BASELINE_COMMIT" >/dev/null 2>&1; then
+  COMMIT_COUNT=$(git -C "$SCRIPT_DIR" rev-list "${BASELINE_COMMIT}..HEAD" --count 2>/dev/null || echo "0")
+fi
+
+# --- Empty session guard ---
+# Skip if: duration < 2 min AND no commits AND no obs buffer activity
+if [ "$DURATION_MIN" -lt 2 ] 2>/dev/null && [ "$COMMIT_COUNT" -eq 0 ] 2>/dev/null && [ "$OBS_COUNT" -eq 0 ] 2>/dev/null; then
+  rm -f "$BASELINE_FILE" 2>/dev/null
+  exit 0
+fi
+
+# --- Deduplication: explicit /handoff or /wrap wins over baseline capture ---
+TODAY=$(date +%d)
+MONTH=$(date +%Y-%m)
+if [ -n "$STARTED_AT" ]; then
+  MONTH=$(echo "$STARTED_AT" | grep -oE '^[0-9]{4}-[0-9]{2}' || date +%Y-%m)
+  TODAY=$(echo "$STARTED_AT" | grep -oE '^[0-9]{4}-[0-9]{2}-([0-9]{2})' | tail -c3 | sed 's/^-//' || date +%d)
+fi
+
+AUTHOR_LC=$(echo "$AUTHOR" | tr '[:upper:]' '[:lower:]')
+DISPLAY_LC=$(echo "$DISPLAY_NAME" | tr '[:upper:]' '[:lower:]')
+AUTHOR_PATTERN="-${AUTHOR_LC}-"
+[ -n "$DISPLAY_LC" ] && AUTHOR_PATTERN="${AUTHOR_PATTERN}|-${DISPLAY_LC}-"
+for CAPTURE_DIR in \
+  "$SCRIPT_DIR/memory/handoffs/$MONTH" \
+  "$SCRIPT_DIR/memory/wraps/$MONTH"; do
+  [ -d "$CAPTURE_DIR" ] || continue
+  # Match the canonical handle or display name in today's filename.
+  EXISTING=""
+  for CANDIDATE in "$CAPTURE_DIR/${TODAY}-"*.md; do
+    [ -e "$CANDIDATE" ] || continue
+    CANDIDATE_NAME="$(basename "$CANDIDATE" | tr '[:upper:]' '[:lower:]')"
+    if printf '%s\n' "$CANDIDATE_NAME" | grep -Eq -- "$AUTHOR_PATTERN"; then
+      EXISTING="$CANDIDATE_NAME"
+      break
+    fi
+  done
+  if [ -n "$EXISTING" ]; then
+    rm -f "$BASELINE_FILE" 2>/dev/null
+    exit 0
+  fi
+done
+
+# --- Write through the shared capture engine -----------------------------
+SUMMARY="${DURATION} session on ${TOPIC}; ${COMMIT_COUNT} commit(s), ${OBS_COUNT} observed action(s)."
+{
+  if [ -n "$OBS_FILES" ]; then
+    echo "## Files"
+    echo "$OBS_FILES" | while read -r F; do
+      [ -n "$F" ] && echo "- $F"
+    done
+    echo ""
+  fi
+
+  if [ "$COMMIT_COUNT" -gt 0 ] 2>/dev/null; then
+    echo "## Commits"
+    echo "$COMMIT_COUNT commits on ${BRANCH:-develop}"
+    echo ""
+  fi
+} | bash "$SCRIPT_DIR/bin/capture-run.sh" \
+      --mode baseline \
+      --author "$AUTHOR" \
+      --display-name "$DISPLAY_NAME" \
+      --topic "$TOPIC" \
+      --summary "$SUMMARY" \
+      --session-id "$SESSION_ID" \
+      --branch "${BRANCH:-develop}" \
+      --date "$STARTED_AT" \
+      --duration "$DURATION" \
+      --async-push >/dev/null 2>&1 || true
+
+# --- Clean up baseline ---
+rm -f "$BASELINE_FILE" 2>/dev/null
+
+exit 0

package/runtime/codex/bin/settings.sh

@@ -198,7 +198,7 @@ _people_file() {
     if [ ! -f "$f" ]; then
       inviter="$(jq -r '.display_name // .github_username // "admin"' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null || echo admin)"
       today="$(date -u +%Y-%m-%d)"
-      printf -- '---\nname: %s\ngithub: %s\ninvited_by: %s\njoined: %s\n---\n' "$user" "$user" "$inviter" "$today" > "$f"
+      printf -- '---\nname: %s\nperson_id: github-login:%s\ngithub: %s\ninvited_by: %s\njoined: %s\n---\n' "$user" "$(printf '%s' "$user" | tr '[:upper:]' '[:lower:]')" "$user" "$inviter" "$today" > "$f"
     fi
   else
     rm -f "$f"

package/runtime/codex/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-runtime",
   "policy": "public-safe subset derived from .syncignore; built by scripts/build-runtime-bundle.mjs",
-  "skillCount": 56,
+  "skillCount": 58,
   "skills": [
     "activity",
     "add",
@@ -17,6 +17,7 @@
     "dashboard",
     "deep-reflect",
     "delete-user",
+    "deploy-bridge",
     "egregore-voice",
     "emissary",
     "env",
@@ -47,6 +48,7 @@
     "setup",
     "summon",
     "sync-repos",
+    "task",
     "telegram-connect",
     "telemetry",
     "test",
@@ -80,6 +82,7 @@
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",
     ".codex/skills/delete-user/SKILL.md",
+    ".codex/skills/deploy-bridge/SKILL.md",
     ".codex/skills/egregore-voice/SKILL.md",
     ".codex/skills/emissary/SKILL.md",
     ".codex/skills/env/SKILL.md",
@@ -112,6 +115,7 @@
     ".codex/skills/setup/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
+    ".codex/skills/task/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -130,6 +134,9 @@
     "AGENTS.md",
     "bin/activity-data.sh",
     "bin/agent.sh",
+    "bin/attendant.sh",
+    "bin/capture-reconcile.sh",
+    "bin/capture-run.sh",
     "bin/codex-install-skills.sh",
     "bin/codex-render-spec.mjs",
     "bin/codex-session-start.sh",
@@ -144,6 +151,12 @@
     "bin/handoff-run.sh",
     "bin/handoff-save-egregore.sh",
     "bin/index-handoff.sh",
+    "bin/ingest-graph.sh",
+    "bin/ingest-surface.html",
+    "bin/ingest.py",
+    "bin/ingest.sh",
+    "bin/ingest_graph.py",
+    "bin/ingest_surface.py",
     "bin/lib/artifact-id.sh",
     "bin/lib/config.sh",
     "bin/lib/context.sh",
@@ -154,13 +167,18 @@
     "bin/lib/hash.sh",
     "bin/lib/identity.sh",
     "bin/lib/metrics.sh",
+    "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/notify.sh",
+    "bin/person.py",
+    "bin/person.sh",
     "bin/publish-artifact.sh",
     "bin/publish-references.sh",
     "bin/repo-state.sh",
+    "bin/session-autosave.sh",
+    "bin/session-log.sh",
     "bin/settings.sh",
     "bin/telemetry.sh",
     "bin/worktree-create.sh",

package/runtime/pi/.codex/hooks/branch-guard.js

@@ -48,22 +48,86 @@ function inside(child, parent) {
   return rel === "" || (!!rel && !rel.startsWith("..") && !path.isAbsolute(rel));
 }
 
-function findProjectDir(input) {
-  // Tool payload cwd is the operation location. Codex launchers may keep
-  // EGREGORE_CODEX_PROJECT_DIR pointed at the main checkout even after the
-  // model continues in a task worktree, so using the env var first can make
-  // legitimate worktree writes look like writes on protected develop.
-  const cwd = input.cwd || process.cwd() || process.env.EGREGORE_CODEX_PROJECT_DIR;
-  const top = run("git", ["-C", cwd, "rev-parse", "--show-toplevel"], cwd);
-  if (top) return realish(top);
+function nearestExistingDirectory(candidate) {
+  let cursor = path.resolve(candidate);
+  try {
+    if (fs.existsSync(cursor) && !fs.statSync(cursor).isDirectory()) cursor = path.dirname(cursor);
+  } catch {}
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return cursor;
+}
+
+function gitContext(candidate) {
+  if (!candidate) return null;
+  const probe = nearestExistingDirectory(candidate);
+  const top = run("git", ["-C", probe, "rev-parse", "--show-toplevel"], probe);
+  if (!top) return null;
+  const commonRaw = run("git", ["-C", top, "rev-parse", "--git-common-dir"], top);
+  const common = commonRaw
+    ? realish(path.isAbsolute(commonRaw) ? commonRaw : path.join(top, commonRaw))
+    : realish(path.join(top, ".git"));
+  return { top: realish(top), common };
+}
+
+function shellRetarget(command) {
+  // Only retarget a single operation. Mixed command chains are evaluated from
+  // the hub context so one external `git -C` cannot mask a later project write.
+  if (shellSegments(command).length !== 1) return "";
+  const gitC = String(command || "").match(/(?:^|[;&|]\s*)git\s+-C\s+("[^"]*"|'[^']*'|[^\s;&|]+)/);
+  const cdAnd = String(command || "").match(/^\s*cd\s+("[^"]*"|'[^']*'|[^\s;&|]+)\s*&&/);
+  const raw = (gitC && gitC[1]) || (cdAnd && cdAnd[1]) || "";
+  const target = raw.replace(/^['"]|['"]$/g, "");
+  return /[$`*?]/.test(target) ? "" : target;
+}
+
+function operationCandidate(input, baseDir) {
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const explicitWorkdir = toolInput.workdir || toolInput.cwd || "";
+  let candidate = explicitWorkdir
+    ? (path.isAbsolute(explicitWorkdir) ? explicitWorkdir : path.join(baseDir, explicitWorkdir))
+    : baseDir;
 
-  const envDir = process.env.EGREGORE_CODEX_PROJECT_DIR || "";
-  if (envDir) {
-    const envTop = run("git", ["-C", envDir, "rev-parse", "--show-toplevel"], envDir);
-    return realish(envTop || envDir);
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  } else if (toolName === "Bash") {
+    const target = shellRetarget(toolInput.command || "");
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  }
+
+  return candidate;
+}
+
+function findProjectContext(input) {
+  // The launcher keeps EGREGORE_CODEX_PROJECT_DIR on the hub checkout while
+  // individual tool calls can target a task worktree, memory, or a managed
+  // repo. Compare Git common dirs: a task worktree shares the hub common dir
+  // and must use its own branch; memory/managed repos are separate and exempt.
+  const fallback = input.cwd || process.cwd();
+  const hubSeed = process.env.EGREGORE_CODEX_PROJECT_DIR || fallback;
+  const hub = gitContext(hubSeed);
+  const baseDir = input.cwd || hub?.top || fallback;
+  const candidate = operationCandidate(input, baseDir);
+  const operation = gitContext(candidate);
+
+  if (!hub) return { projectDir: operation?.top || realish(baseDir), external: false };
+  if (operation && operation.common === hub.common) {
+    return { projectDir: operation.top, external: false };
+  }
+  if (operation && operation.common !== hub.common) {
+    return { projectDir: hub.top, external: true };
   }
 
-  return realish(cwd);
+  const resolvedCandidate = realish(candidate);
+  if (!inside(resolvedCandidate, hub.top)) {
+    return { projectDir: hub.top, external: true };
+  }
+  return { projectDir: hub.top, external: false };
 }
 
 function currentBranch(projectDir) {
@@ -95,7 +159,7 @@ function isExemptPath(rawPath, projectDir, memoryDir) {
     if (inside(resolved, target)) return true;
   }
 
-  for (const file of [".egregore-state.json", ".env"]) {
+  for (const file of [".egregore-state.json", ".egregore-branch-consent", ".env"]) {
     if (resolved === realish(path.join(projectDir, file))) return true;
   }
 
@@ -133,12 +197,13 @@ function commandTargetsOtherRepo(command, projectDir, memoryDir) {
 }
 
 function isBranchSetupCommand(command) {
+  if (shellSegments(command).length !== 1) return false;
   return (
-    /\bbin\/agent\.sh\s+branch\b/.test(command) ||
-    /\bgit\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
-    /\bgit\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
-    /\bgit\s+worktree\s+add\b/.test(command) ||
-    /\bbin\/worktree\.sh\s+setup\b/.test(command)
+    /^\s*bin\/agent\.sh\s+branch\b/.test(command) ||
+    /^\s*git\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
+    /^\s*git\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
+    /^\s*git\s+worktree\s+add\b/.test(command) ||
+    /^\s*bin\/worktree\.sh\s+setup\b/.test(command)
   );
 }
 
@@ -149,7 +214,134 @@ function stagedOnlyFrameworkPaths(projectDir) {
   return files.length > 0 && files.every((file) => /^(bin\/|\.claude\/|\.codex\/|CLAUDE\.md$|AGENTS\.md$|skills\/)/.test(file));
 }
 
+function stripQuotedSegments(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") i++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += "x";
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+function maskQuotedOperators(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") {
+        out += ch;
+        if (i + 1 < command.length) out += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      out += /[><|;&]/.test(ch) ? " " : ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') quote = ch;
+    out += ch;
+  }
+  return out;
+}
+
+function shellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      current += ch;
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) current += command[++i];
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+function shellWords(segment) {
+  const words = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(segment || "").length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < segment.length) current += segment[++i];
+      else if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) words.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === "\\") {
+      if (i + 1 < segment.length) current += segment[++i];
+      continue;
+    }
+    current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+function filesystemMutationStatus(command, projectDir, memoryDir) {
+  const commands = new Set(["rm", "mv", "cp", "mkdir", "rmdir", "touch", "chmod", "chown", "ln", "tee"]);
+  let unsafe = false;
+
+  for (const segment of shellSegments(command)) {
+    const words = shellWords(segment);
+    while (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) words.shift();
+    while (words[0] === "sudo" || words[0] === "command" || words[0] === "env") words.shift();
+    if (!words.length) continue;
+
+    const name = path.basename(words.shift());
+    if (!commands.has(name)) continue;
+
+    const args = words.filter((word) => !word.startsWith("-"));
+    let targets = args;
+    if (name === "cp" || name === "ln") targets = args.length ? [args[args.length - 1]] : [];
+    if (name === "chmod" || name === "chown") targets = args.slice(1);
+
+    if (!targets.length || targets.some((target) =>
+      /[$`*?{}]/.test(target) || !isExemptPath(target, projectDir, memoryDir)
+    )) unsafe = true;
+  }
+
+  return { unsafe };
+}
+
 function redirectLooksMutating(command, projectDir, memoryDir) {
+  const visible = maskQuotedOperators(command);
   const redirectPatterns = [
     /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g,
     /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g,
@@ -157,7 +349,7 @@ function redirectLooksMutating(command, projectDir, memoryDir) {
 
   for (const pattern of redirectPatterns) {
     let match;
-    while ((match = pattern.exec(command))) {
+    while ((match = pattern.exec(visible))) {
       const target = String(match[1] || "").replace(/^["']|["']$/g, "");
       if (!target || target === "/dev/null" || target.startsWith("$")) continue;
       if (!isExemptPath(target, projectDir, memoryDir)) return true;
@@ -168,18 +360,31 @@ function redirectLooksMutating(command, projectDir, memoryDir) {
 
 function shellLooksMutating(command, projectDir, memoryDir) {
   if (!command.trim()) return false;
-  if (isBranchSetupCommand(command)) return false;
+  const visible = stripQuotedSegments(command);
+  if (isBranchSetupCommand(visible)) return false;
 
   const mutatingPatterns = [
-    /\bgit\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
-    /\b(apply_patch|touch|mkdir|rm|mv|cp|chmod|chown|ln)\b/,
-    /\b(sed|perl)\b[^;&|]*\s-i(\s|$)/,
-    /\b(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
-    /\b(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?apply_patch\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(sed|perl)\b[^;&|]*\s-i(\s|$)/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
   ];
 
-  if (/\bgit\s+commit\b/.test(command) && stagedOnlyFrameworkPaths(projectDir)) return false;
-  return mutatingPatterns.some((pattern) => pattern.test(command)) || redirectLooksMutating(command, projectDir, memoryDir);
+  const gitCommit = /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+commit\b/.test(visible);
+  if (gitCommit && stagedOnlyFrameworkPaths(projectDir)) return false;
+
+  const filesystem = filesystemMutationStatus(command, projectDir, memoryDir);
+  return mutatingPatterns.some((pattern) => pattern.test(visible)) ||
+    filesystem.unsafe ||
+    redirectLooksMutating(command, projectDir, memoryDir);
+}
+
+function isConsentCommand(command, branch) {
+  const escaped = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
 }
 
 function deny(reason) {
@@ -194,7 +399,9 @@ function deny(reason) {
 
 function main() {
   const input = parseJson(readStdin());
-  const projectDir = findProjectDir(input);
+  const context = findProjectContext(input);
+  if (context.external) return;
+  const projectDir = context.projectDir;
   const branch = currentBranch(projectDir);
   if (!isProtectedBranch(branch)) return;
 
@@ -211,11 +418,11 @@ function main() {
   const memoryDir = realish(path.join(projectDir, "memory"));
   const author = currentAuthor(projectDir);
   const reason = [
-    `Protected branch (${branch}). Ask the user how to proceed — do NOT auto-branch silently.`,
-    "Offer a choice (numbered or structured): Branch off (default) / Proceed on this branch / Cancel.",
-    `  • Branch off:        bin/agent.sh branch --topic "<work topic>"  (prefix dev/${author}/...)`,
-    `  • Proceed on ${branch}: echo '${branch}' > .egregore-branch-consent  then retry`,
-    "Proceeding records consent for this branch for the rest of the session (cleared on next session start).",
+    `Protected branch (${branch}). Move project work to a task branch before writing.`,
+    `If the work topic is clear, run bin/agent.sh branch --topic "<work topic>" automatically (prefix dev/${author}/...), continue in the printed worktree, and briefly tell the user.`,
+    "Ask only when the work topic is genuinely ambiguous; ask for the topic, not for routine Git permission.",
+    `Only when the user explicitly requested writing on ${branch}, record consent with: echo '${branch}' > .egregore-branch-consent`,
+    "Memory, framework-runtime, and managed-repo writes are exempt and should not trigger this guard.",
   ].join("\n");
 
   if (toolName === "apply_patch") {
@@ -234,6 +441,7 @@ function main() {
 
   if (toolName === "Bash") {
     const command = String(toolInput.command || "");
+    if (isConsentCommand(command, branch)) return;
     if (commandTargetsOtherRepo(command, projectDir, memoryDir)) return;
     if (shellLooksMutating(command, projectDir, memoryDir)) deny(reason);
   }