create-egregore 0.19.8 → 0.19.11

package/runtime/pi/bin/person.sh

@@ -0,0 +1,448 @@
+#!/bin/bash
+set -euo pipefail
+
+# One identity spine for .egregore-state.json, memory/people, Supabase, and
+# Neo4j. GitHub's numeric id is the durable key when available.
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SCRIPT_DIR="$ROOT"
+CONFIG="$ROOT/egregore.json"
+STATE="$ROOT/.egregore-state.json"
+PERSON_PY="$ROOT/bin/person.py"
+
+# shellcheck source=bin/lib/config.sh
+source "$ROOT/bin/lib/config.sh"
+
+usage() {
+  echo 'usage: bash bin/person.sh {sync|onboard|set-name NAME|set-email EMAIL|show|backfill [--dry-run|--apply] [--include-removed]}' >&2
+  exit 2
+}
+
+remote_config() {
+  api_url="${EGREGORE_API_URL:-$(_config_val api_url)}"
+  api_key="${EGREGORE_API_KEY:-$(_load_env_var EGREGORE_API_KEY)}"
+}
+
+sync_remote_identity() {
+  identity="$1"
+  remote_config
+
+  api_status="not-configured"
+  platform_user_id=""
+  if [ -n "$api_url" ] && [ -n "$api_key" ]; then
+    api_payload="$(printf '%s' "$identity" | jq '{
+      github_username,
+      github_id,
+      github_name,
+      github_aliases,
+      display_name,
+      email,
+      emails
+    }')"
+    api_result="$(curl -sf "${api_url}/api/user/ensure" \
+      -H "Authorization: Bearer ${api_key}" \
+      -H "Content-Type: application/json" \
+      -d "$api_payload" \
+      --max-time 10 2>/dev/null || true)"
+    api_status="$(printf '%s' "$api_result" | jq -r '.status // "failed"' 2>/dev/null || echo failed)"
+    platform_user_id="$(printf '%s' "$api_result" | jq -r '.user_id // empty' 2>/dev/null || true)"
+  fi
+
+  # A removed membership is terminal until an admin explicitly re-invites
+  # the person. Never let startup recreate their graph membership.
+  if [ "$api_status" = "removed" ]; then
+    printf '%s' "$identity" | jq \
+      --arg platform_user_id "$platform_user_id" \
+      '. + {
+        status:"removed",
+        supabase:"removed",
+        graph:"skipped-removed",
+        platform_user_id:$platform_user_id,
+        merged_duplicates:0
+      }'
+    return 0
+  fi
+
+  params="$(printf '%s' "$identity" | jq --arg platformUserId "$platform_user_id" '{
+    personId:.person_id,
+    github:.github_username,
+    githubId:(if .github_id == null then "" else (.github_id|tostring) end),
+    fullName:.github_name,
+    displayName:.display_name,
+    primaryEmail:(.email // ""),
+    emails,
+    githubAliases:.github_aliases,
+    previousNames:.previous_names,
+    profilePath:.profile_path,
+    allowNameMatch:(
+      (.allow_name_match // false)
+      or (.source_profile // "") != ""
+      or ((.aliases_reconciled // []) | length) > 0
+    ),
+    platformUserId:$platformUserId
+  }')"
+
+  graph_status="failed"
+  if graph_result="$(bash "$ROOT/bin/graph.sh" query "
+    OPTIONAL MATCH (legacy:Person)
+    WHERE NOT coalesce(legacy.kind, '') IN ['external', 'identity_alias']
+      AND coalesce(legacy.status, 'active') = 'active'
+      AND legacy.ingestRef IS NULL
+      AND (
+        legacy.personId = \$personId
+        OR (\$githubId <> '' AND coalesce(toString(legacy.githubId), '') = \$githubId)
+        OR toLower(coalesce(legacy.github, '')) = toLower(\$github)
+        OR toLower(coalesce(legacy.github, '')) IN
+          [alias IN \$githubAliases | toLower(alias)]
+        OR (
+          \$allowNameMatch
+          AND legacy.personId IS NULL
+          AND legacy.githubId IS NULL
+          AND (legacy.github IS NULL OR legacy.github = '')
+          AND toLower(coalesce(legacy.name, '')) = toLower(\$displayName)
+        )
+      )
+    WITH legacy
+    ORDER BY CASE
+      WHEN legacy.personId = \$personId THEN 0
+      WHEN \$githubId <> '' AND coalesce(toString(legacy.githubId), '') = \$githubId THEN 1
+      WHEN toLower(coalesce(legacy.github, '')) = toLower(\$github) THEN 2
+      ELSE 3
+    END
+    WITH head(collect(legacy)) AS legacy
+    FOREACH (_ IN CASE WHEN legacy IS NULL THEN [] ELSE [1] END |
+      SET legacy.personId = \$personId
+    )
+    MERGE (p:Person {personId: \$personId})
+    ON CREATE SET p.joined = date()
+    SET p.github = \$github,
+        p.githubId = CASE WHEN \$githubId = '' THEN p.githubId ELSE \$githubId END,
+        p.kind = 'member',
+        p.org = \$_org,
+        p.status = 'active',
+        p.removedAt = null,
+        p.identityStatus = CASE WHEN \$githubId = '' THEN 'provisional' ELSE 'verified' END,
+        p.platformUserId = CASE WHEN \$platformUserId = '' THEN p.platformUserId ELSE \$platformUserId END,
+        p.name = \$displayName,
+        p.displayName = \$displayName,
+        p.fullName = \$fullName,
+        p.email = CASE WHEN \$primaryEmail = '' THEN p.email ELSE \$primaryEmail END,
+        p.emails = reduce(acc = coalesce(p.emails, []), value IN \$emails |
+          CASE WHEN value IN acc THEN acc ELSE acc + value END),
+        p.githubAliases = reduce(acc = coalesce(p.githubAliases, []), value IN \$githubAliases |
+          CASE WHEN value IN acc THEN acc ELSE acc + value END),
+        p.previousNames = reduce(acc = coalesce(p.previousNames, []), value IN \$previousNames |
+          CASE WHEN value IN acc THEN acc ELSE acc + value END),
+        p.profilePath = \$profilePath,
+        p.identityVersion = 1,
+        p.identityUpdatedAt = datetime()
+    WITH p
+    MATCH (o:Org {id: \$_org})
+    MERGE (p)-[:MEMBER_OF]->(o)
+    RETURN p.personId AS personId
+  " "$params" 2>/dev/null)"; then
+    if printf '%s' "$graph_result" | jq -e \
+      --arg personId "$(printf '%s' "$identity" | jq -r .person_id)" \
+      '.values[0][0] == $personId' >/dev/null 2>&1; then
+      graph_status="synced"
+    fi
+  fi
+
+  merged_duplicates=0
+  if [ "$graph_status" = "synced" ]; then
+    duplicates="$(bash "$ROOT/bin/graph.sh" query "
+      MATCH (real:Person {personId: \$personId})
+      MATCH (duplicate:Person)
+      WHERE duplicate <> real AND (
+        duplicate.personId = \$personId
+        OR (\$githubId <> '' AND coalesce(toString(duplicate.githubId), '') = \$githubId)
+        OR toLower(coalesce(duplicate.github, '')) = toLower(\$github)
+        OR toLower(coalesce(duplicate.github, '')) IN \$githubAliases
+        OR (
+          duplicate.githubId IS NULL
+          AND duplicate.personId IS NULL
+          AND (duplicate.github IS NULL OR duplicate.github = '')
+          AND any(email IN coalesce(duplicate.emails, []) WHERE email IN \$emails)
+        )
+        OR (
+          \$allowNameMatch
+          AND
+          (duplicate.github IS NULL OR duplicate.github = '')
+          AND duplicate.personId IS NULL
+          AND toLower(coalesce(duplicate.name, '')) = toLower(\$displayName)
+        )
+      )
+      AND NOT coalesce(duplicate.kind, '') IN ['external', 'identity_alias']
+      AND coalesce(duplicate.status, 'active') = 'active'
+      AND duplicate.ingestRef IS NULL
+      RETURN DISTINCT coalesce(duplicate.github, duplicate.name) AS ref
+    " "$params" 2>/dev/null || echo '{"values":[]}')"
+    while IFS= read -r duplicate; do
+      [ -n "$duplicate" ] || continue
+      if bash "$ROOT/bin/graph-op.sh" merge-person "$(printf '%s' "$identity" | jq -r .person_id)" \
+        "$duplicate" >/dev/null 2>&1; then
+        merged_duplicates=$((merged_duplicates + 1))
+      fi
+    done < <(printf '%s' "$duplicates" | jq -r '.values[]?[0] // empty')
+  fi
+
+  status="synced"
+  [ "$api_status" = "ok" ] || status="partial"
+  [ "$graph_status" = "synced" ] || status="partial"
+  printf '%s' "$identity" | jq \
+    --arg status "$status" \
+    --arg supabase "$api_status" \
+    --arg graph "$graph_status" \
+    --arg platform_user_id "$platform_user_id" \
+    --argjson merged_duplicates "$merged_duplicates" \
+    '. + {
+      status:$status,
+      supabase:$supabase,
+      graph:$graph,
+      platform_user_id:$platform_user_id,
+      merged_duplicates:$merged_duplicates
+    }'
+}
+
+backfill_people() {
+  mode="dry-run"
+  include_removed="false"
+  shift
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --dry-run) mode="dry-run" ;;
+      --apply) mode="apply" ;;
+      --include-removed) include_removed="true" ;;
+      *) usage ;;
+    esac
+    shift
+  done
+
+  if [ "$(_detect_mode)" = "local" ]; then
+    jq -n '{status:"unavailable",reason:"person backfill requires the hosted member roster in this configuration"}'
+    return 1
+  fi
+  command -v gh >/dev/null 2>&1 || {
+    jq -n '{status:"error",error:"GitHub CLI is required to resolve stable user ids"}'
+    return 1
+  }
+
+  remote_config
+  if [ -z "$api_url" ] || [ -z "$api_key" ]; then
+    jq -n '{status:"error",error:"connected API configuration is incomplete"}'
+    return 1
+  fi
+  org_slug="$(_config_val slug)"
+  members_result="$(curl -sf "${api_url}/api/org/${org_slug}/members?include_removed=true" \
+    -H "Authorization: Bearer ${api_key}" \
+    --max-time 20 2>/dev/null || true)"
+  if ! printf '%s' "$members_result" | jq -e '.members | type == "array"' >/dev/null 2>&1; then
+    jq -n '{status:"error",error:"could not load the hosted member roster"}'
+    return 1
+  fi
+  if ! printf '%s' "$members_result" | jq -e \
+    '.members | length == 0 or all(has("github_id") and has("github_aliases"))' \
+    >/dev/null 2>&1; then
+    jq -n '{status:"blocked",error:"the hosted API is still using the pre-identity member contract; deploy it before backfilling"}'
+    return 1
+  fi
+
+  results='[]'
+  excluded_removed=0
+  while IFS= read -r member; do
+    [ -n "$member" ] || continue
+    member_status="$(printf '%s' "$member" | jq -r '.status // "active"')"
+    if [ "$member_status" != "active" ] && [ "$include_removed" != "true" ]; then
+      excluded_removed=$((excluded_removed + 1))
+      continue
+    fi
+
+    previous_github="$(printf '%s' "$member" | jq -r '.github_username // empty')"
+    if ! printf '%s' "$previous_github" | grep -Eq '^[A-Za-z0-9-]{1,39}$'; then
+      item="$(jq -n --arg github "$previous_github" '{
+        github_username:$github,status:"skipped",reason:"invalid GitHub login"
+      }')"
+      results="$(printf '%s' "$results" | jq --argjson item "$item" '. + [$item]')"
+      continue
+    fi
+
+    github_result="$(gh api "users/${previous_github}" \
+      --jq '{login,id,name,email}' 2>/dev/null || true)"
+    if ! printf '%s' "$github_result" | jq -e \
+      '.login and (.id | type == "number")' >/dev/null 2>&1; then
+      item="$(jq -n --arg github "$previous_github" '{
+        github_username:$github,status:"unresolved",reason:"GitHub identity could not be resolved"
+      }')"
+      results="$(printf '%s' "$results" | jq --argjson item "$item" '. + [$item]')"
+      continue
+    fi
+
+    github="$(printf '%s' "$github_result" | jq -r .login)"
+    github_id="$(printf '%s' "$github_result" | jq -r .id)"
+    github_name="$(printf '%s' "$github_result" | jq -r '.name // empty')"
+    public_email="$(printf '%s' "$github_result" | jq -r '.email // empty')"
+    display_name="$(printf '%s' "$member" | jq -r \
+      --arg githubName "$github_name" --arg github "$github" \
+      '.display_name // (if $githubName != "" then $githubName else $github end)')"
+    role="$(printf '%s' "$member" | jq -r '.member_role // .role // "Member"')"
+    joined="$(printf '%s' "$member" | jq -r '.joined_at // empty' | cut -c1-10)"
+    aliases="$(printf '%s' "$member" | jq -r \
+      --arg old "$previous_github" --arg current "$github" '
+      ((.github_aliases // []) + (if ($old|ascii_downcase) != ($current|ascii_downcase) then [$old] else [] end))
+      | map(select(type == "string" and length > 0)) | unique | join(",")
+    ')"
+    emails="$(printf '%s' "$member" | jq -r \
+      --arg public "$public_email" '
+      ((.emails // []) + [(.primary_email // ""), $public])
+      | map(select(type == "string" and length > 0)) | unique | join(",")
+    ')"
+
+    profile_args=(
+      sync-profile
+      --github "$github"
+      --github-id "$github_id"
+      --github-name "$github_name"
+      --display-name "$display_name"
+      --previous-github "$previous_github"
+      --github-aliases "$aliases"
+      --emails "$emails"
+      --role "$role"
+      --joined "$joined"
+    )
+    [ "$mode" = "apply" ] || profile_args+=(--dry-run)
+    if ! identity="$(python3 "$PERSON_PY" "${profile_args[@]}")"; then
+      item="$(jq -n --arg github "$github" '{
+        github_username:$github,status:"skipped",reason:"profile reconciliation failed"
+      }')"
+      results="$(printf '%s' "$results" | jq --argjson item "$item" '. + [$item]')"
+      continue
+    fi
+    roster_name_matches="$(printf '%s' "$members_result" | jq \
+      --arg displayName "$display_name" '
+      [.members[]
+        | (.display_name // "")
+        | select(length > 0)
+        | ascii_downcase
+        | select(. == ($displayName | ascii_downcase))]
+      | length
+    ')"
+    allow_name_match="false"
+    [ "$roster_name_matches" -eq 1 ] && allow_name_match="true"
+    identity="$(printf '%s' "$identity" | jq \
+      --argjson allowNameMatch "$allow_name_match" \
+      '.allow_name_match = $allowNameMatch')"
+
+    if [ "$mode" = "apply" ]; then
+      synced="$(sync_remote_identity "$identity")"
+      report="$(printf '%s' "$synced" | jq 'del(.email,.emails,.allow_name_match)')"
+    else
+      report="$(printf '%s' "$identity" | jq \
+        '. + {status:"planned"} | del(.email,.emails,.allow_name_match)')"
+    fi
+    results="$(printf '%s' "$results" | jq --argjson item "$report" '. + [$item]')"
+  done < <(printf '%s' "$members_result" | jq -c '.members[]')
+
+  printf '%s' "$results" | jq \
+    --arg mode "$mode" \
+    --arg org "$org_slug" \
+    --argjson excluded_removed "$excluded_removed" '
+    {
+      status:(if any(.[]; .status == "partial") then "partial" else "ok" end),
+      mode:$mode,
+      org:$org,
+      summary:{
+        considered:length,
+        planned_or_synced:[.[] | select(.status == "planned" or .status == "synced")]|length,
+        partial:[.[] | select(.status == "partial")]|length,
+        unresolved:[.[] | select(.status == "unresolved")]|length,
+        skipped:[.[] | select(.status == "skipped")]|length,
+        excluded_removed:$excluded_removed
+      },
+      people:.
+    }'
+}
+
+command="${1:-}"
+[ -n "$command" ] || usage
+
+if [ "$command" = "show" ]; then
+  jq '{
+    person_id,
+    display_name,
+    github_username,
+    github_id,
+    github_name,
+    email,
+    emails,
+    github_aliases,
+    previous_names,
+    identity_version
+  }' "$STATE"
+  exit 0
+fi
+
+if [ "$command" = "backfill" ]; then
+  backfill_people "$@"
+  exit $?
+fi
+
+display_args=()
+email_args=()
+onboard_args=()
+case "$command" in
+  sync) ;;
+  onboard) onboard_args=(--onboarded) ;;
+  set-name)
+    name="${2:-}"
+    [ -n "$name" ] || usage
+    if [ "${#name}" -gt 60 ] || ! printf '%s' "$name" | grep -Eq "^[[:alnum:]À-ž .'-]+$"; then
+      echo '{"status":"error","error":"display name must be 1-60 name characters"}'
+      exit 2
+    fi
+    display_args=(--display-name "$name")
+    ;;
+  set-email)
+    email="${2:-}"
+    [ -n "$email" ] || usage
+    if [ "${#email}" -gt 254 ] || ! printf '%s' "$email" | grep -Eq '^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$'; then
+      echo '{"status":"error","error":"email must be a valid address"}'
+      exit 2
+    fi
+    email_args=(--email "$email")
+    ;;
+  *) usage ;;
+esac
+
+github_args=()
+state_github="$(jq -r '.github_username // empty' "$STATE" 2>/dev/null)"
+if command -v gh >/dev/null 2>&1; then
+  gh_identity="$(gh api user --jq '{login,id,name,email}' 2>/dev/null || true)"
+  gh_login="$(printf '%s' "$gh_identity" | jq -r '.login // empty' 2>/dev/null)"
+  gh_id="$(printf '%s' "$gh_identity" | jq -r '.id // empty' 2>/dev/null)"
+  state_github_id="$(jq -r '.github_id // empty' "$STATE" 2>/dev/null)"
+  gh_login_lc="$(printf '%s' "$gh_login" | tr '[:upper:]' '[:lower:]')"
+  state_github_lc="$(printf '%s' "$state_github" | tr '[:upper:]' '[:lower:]')"
+  if [ -n "$gh_login" ] && {
+    [ -z "$state_github" ] ||
+    [ "$gh_login_lc" = "$state_github_lc" ] ||
+    { [ -n "$gh_id" ] && [ -n "$state_github_id" ] && [ "$gh_id" = "$state_github_id" ]; }
+  }; then
+    github_args=(--github "$gh_login")
+    gh_email="$(printf '%s' "$gh_identity" | jq -r '.email // empty')"
+    [ -z "$gh_id" ] || github_args+=(--github-id "$gh_id")
+    [ -z "$gh_email" ] || github_args+=(--email "$gh_email")
+  fi
+fi
+
+if [ "$(jq -r '.onboarding_complete // false' "$STATE" 2>/dev/null)" = "true" ]; then
+  onboard_args=(--onboarded)
+fi
+identity="$(python3 "$PERSON_PY" sync-local \
+  "${display_args[@]}" "${github_args[@]}" "${email_args[@]}" "${onboard_args[@]}")"
+
+if [ "$(_detect_mode)" = "local" ]; then
+  printf '%s' "$identity" | jq '. + {status:"synced-local",supabase:"unavailable",graph:"unavailable"}'
+  exit 0
+fi
+
+sync_remote_identity "$identity"

package/runtime/pi/bin/pi-branch-policy.mjs

@@ -1,10 +1,170 @@
-const MUTATING_COMMANDS = /(^|[;&|]\s*)(rm|mv|cp|mkdir|rmdir|touch|chmod|chown|install)\b/;
-const MUTATING_GIT = /(^|[;&|]\s*)git\s+(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv)\b/;
-const MUTATING_PACKAGES = /(^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(install|add|remove|uninstall|update)\b/;
+import { isAbsolute, relative, resolve } from "node:path";
+
+const MUTATING_COMMANDS = /(^|[;&|]\s*)(?:sudo\s+)?(rm|mv|cp|mkdir|rmdir|touch|chmod|chown|install|tee)\b/;
+const MUTATING_GIT = /(^|[;&|]\s*)(?:sudo\s+)?git\s+(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv)\b/;
+const MUTATING_PACKAGES = /(^|[;&|]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|uninstall|update)\b/;
+
+// A `>` only acts as a shell redirect when it sits OUTSIDE quotes. Quoted
+// `>` shows up constantly in read-only commands — Cypher comparisons
+// (`WHERE x >= y`), JS/Python formatters (`f"{a} -> {b}"`), jq filters —
+// so the redirect test runs on a quote-stripped copy of the command.
+// Quoted segments collapse to a placeholder char so a redirect with a
+// quoted TARGET (`echo hi > "/tmp/x"`) is still detected.
+function stripQuotedSegments(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") i++; // skip escaped char inside double quotes
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; out += "x"; continue; }
+    out += ch;
+  }
+  return out;
+}
+
+function maskQuotedOperators(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) {
+        out += ch + command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      out += /[><|;&]/.test(ch) ? " " : ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') quote = ch;
+    out += ch;
+  }
+  return out;
+}
+
+function shellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      current += ch;
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) current += command[++i];
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+function shellWords(segment) {
+  const words = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < segment.length) current += segment[++i];
+      else if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) words.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === "\\" && i + 1 < segment.length) current += segment[++i];
+    else current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+export function isRuntimeStatePath(target, projectDir) {
+  if (!target || /[$`*?{}]/.test(target)) return false;
+  const absolute = isAbsolute(target) ? resolve(target) : resolve(projectDir, target);
+  const rel = relative(resolve(projectDir), absolute);
+  if (rel.startsWith("..") || isAbsolute(rel)) return true;
+  if (rel === ".claude/worktrees" || rel.startsWith(".claude/worktrees/")) return false;
+  return rel === "memory" || rel.startsWith("memory/") ||
+    rel === ".claude" || rel.startsWith(".claude/") ||
+    rel === ".codex" || rel.startsWith(".codex/") ||
+    rel === ".pi" || rel.startsWith(".pi/") ||
+    rel === ".egregore-state.json" ||
+    rel === ".egregore-branch-consent" ||
+    rel === ".env";
+}
+
+export function mutatesOnlyRuntimeState(command, projectDir) {
+  if (!isMutatingBash(command)) return false;
+  const visible = stripQuotedSegments(String(command));
+  if (MUTATING_GIT.test(visible) || MUTATING_PACKAGES.test(visible) ||
+      /\bsed\s+[^\n]*\s-i(?:\s|$)/.test(visible)) return false;
+
+  let foundTarget = false;
+  const pathCommands = new Set(["rm", "mv", "cp", "mkdir", "rmdir", "touch", "chmod", "chown", "install", "tee"]);
+  for (const segment of shellSegments(String(command))) {
+    const words = shellWords(segment);
+    while (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) words.shift();
+    while (words[0] === "sudo" || words[0] === "command" || words[0] === "env") words.shift();
+    if (!words.length) continue;
+    const name = words.shift().split("/").pop();
+    if (!pathCommands.has(name)) continue;
+
+    const args = words.filter((word) => !word.startsWith("-"));
+    let targets = args;
+    if (name === "cp" || name === "install") targets = args.length ? [args[args.length - 1]] : [];
+    if (name === "chmod" || name === "chown") targets = args.slice(1);
+    if (!targets.length || targets.some((target) => !isRuntimeStatePath(target, projectDir))) return false;
+    foundTarget = true;
+  }
+
+  const redirectSource = maskQuotedOperators(String(command));
+  const redirects = /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g;
+  let redirect;
+  while ((redirect = redirects.exec(redirectSource))) {
+    const target = String(redirect[1] || "").replace(/^["']|["']$/g, "");
+    if (!target || target === "/dev/null") continue;
+    if (!isRuntimeStatePath(target, projectDir)) return false;
+    foundTarget = true;
+  }
+
+  const tees = /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g;
+  let tee;
+  while ((tee = tees.exec(redirectSource))) {
+    const target = String(tee[1] || "").replace(/^["']|["']$/g, "");
+    if (!isRuntimeStatePath(target, projectDir)) return false;
+    foundTarget = true;
+  }
+
+  return foundTarget;
+}
 
 export function isMutatingBash(command) {
   if (!command) return false;
-  const meaningfulRedirects = String(command)
+  const meaningfulRedirects = stripQuotedSegments(String(command))
     .replace(/(?:^|\s)\d*>>?\s*\/dev\/null\b/g, " ")
     .replace(/(?:^|\s)\d*>\s*&\d+\b/g, " ");
   return MUTATING_COMMANDS.test(command) ||

package/runtime/pi/bin/pi-product-workflows.mjs

@@ -235,11 +235,11 @@ export async function createHandoff(pi, root, params, signal) {
   writeFileSync(body, buildHandoffDocument(params, author));
 
   try {
-    const shell = 'tmp="$1"; body="$2"; shift 2; TMPDIR="$tmp" bash bin/handoff-run.sh "$@" < "$body"';
+    const shell = 'tmp="$1"; body="$2"; runner="$3"; shift 3; TMPDIR="$tmp" bash "$runner" --mode addressed "$@" < "$body"';
     await checkedExec(
       pi,
       "bash",
-      ["-c", shell, "egregore-pi-handoff", temp, body, ...runnerArgs],
+      ["-c", shell, "egregore-pi-handoff", temp, body, join(root, "bin", "capture-run.sh"), ...runnerArgs],
       { signal, timeout: 180000 },
       "Handoff",
     );
@@ -263,6 +263,35 @@ export async function createHandoff(pi, root, params, signal) {
   }
 }
 
+export async function captureSessionEnd(pi, root, sessionFile, signal) {
+  const sessionIdFile = join(root, ".egregore-session-id");
+  if (!existsSync(sessionIdFile)) return false;
+  const sessionId = cleanArgs(readFileSync(sessionIdFile, "utf8"));
+  if (!sessionId) return false;
+
+  const temp = mkdtempSync(join(tmpdir(), "egregore-pi-session-end-"));
+  const input = join(temp, "session-end.json");
+  writeFileSync(input, JSON.stringify({
+    session_id: sessionId,
+    transcript_path: cleanArgs(sessionFile),
+    runtime: "pi",
+  }));
+
+  try {
+    const shell = 'bash "$1" < "$2"';
+    await checkedExec(
+      pi,
+      "bash",
+      ["-c", shell, "egregore-pi-session-end", join(root, "bin", "session-log.sh"), input],
+      { signal, timeout: 10000 },
+      "Session capture",
+    );
+    return true;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 export async function publishScroll(pi, root, params, signal) {
   const source = resolve(root, String(params.source || "").replace(/^@/, ""));
   if (!existsSync(source)) throw new Error(`Scroll source not found: ${relative(root, source)}`);