create-egregore 0.21.0-runtime-mvp.13 → 0.21.0-runtime-mvp.14

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.13
+// egregore-launcher-version: 0.21.0-runtime-mvp.14
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.13";
+const VERSION = "0.21.0-runtime-mvp.14";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2673,7 +2673,11 @@ function formatUpgradeLines(inst, st, { candidate = "", retrieval = null } = {})
     + (d.candidate_version ? ` → candidate ${d.candidate_version}` : candidate ? ` → candidate ${candidate} available` : ""));
   lines.push(`Status: ${UPGRADE_STATUS_LABEL[d.status] || d.status}`);
   if (d.candidate_digest) lines.push(`Package digest: sha256 ${String(d.candidate_digest).slice(0, 16)}…`);
-  if (d.failure && d.failure.message) lines.push(`Attention: ${d.failure.message}`);
+  // A recorded failure only needs attention while the transaction is stuck
+  // on it; once a later prepare succeeds the line would contradict "ready".
+  if (d.failure && d.failure.message && (d.status === "failed" || d.status === "interrupted")) {
+    lines.push(`Attention: ${d.failure.message}`);
+  }
   if (d.rollback_version && d.status !== "none") lines.push(`Rollback target: ${d.rollback_version}`);
   const ts = d.team_sync;
   if (ts && ts.label) lines.push(`Team memory: ${ts.label}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.13",
+  "version": "0.21.0-runtime-mvp.14",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/lib/greeting.sh

@@ -95,19 +95,15 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
-# --- Unshared org-settings drift (launcher writes not yet shared) ---
-if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
-  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
-fi
+# --- Org-settings sync receipts. A settings.json heal is logged to
+# .egregore/settings-drift.log, never announced; local settings changes reach
+# the control plane through bin/settings.sh, so there is nothing to ask. ---
 if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
   echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
 fi
 if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
   echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
 fi
-if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
-  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
-fi
 
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"

package/runtime/claude/bin/lib/settings-drift.sh

@@ -61,7 +61,11 @@ settings_drift_heal() {
 
   if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
     if _settings_is_reduced_adapter; then
-      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+      if git checkout -- .claude/settings.json 2>/dev/null; then
+        SETTINGS_ADAPTER_RESTORED="true"
+        mkdir -p .egregore 2>/dev/null && printf '%s restored .claude/settings.json: a generated adapter had replaced the org file\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> .egregore/settings-drift.log 2>/dev/null || true
+      fi
     fi
   fi
 

package/runtime/claude/egregore_runtime/upgrade.py

@@ -53,6 +53,40 @@ BUNDLE_TREES = ("claude", "codex", "pi", "prime")
 # wins and duplicates are skipped.
 APPLY_TREES = ("claude", "codex", "pi", "prime")
 APPLY_TREE = APPLY_TREES[0]
+# Bundle metadata at the root of each adapter tree; never instance content.
+BUNDLE_MANIFEST = "manifest.json"
+# The harness settings adapter the bundle generates; an instance's richer
+# committed copy is preserved on activation.
+SETTINGS_ADAPTER = ".claude/settings.json"
+
+
+def _settings_carries_more(existing: Path, candidate: Path) -> bool:
+    """True when the instance's settings file has hook events or permission
+    allows the candidate's generated adapter lacks. An unreadable candidate
+    keeps the existing file; an unreadable or missing existing file does not."""
+    if not existing.is_file():
+        return False
+    try:
+        current = json.loads(existing.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    try:
+        incoming = json.loads(candidate.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return True
+    if not isinstance(current, dict) or not isinstance(incoming, dict):
+        return False
+
+    def hooks(doc: dict) -> set[str]:
+        value = doc.get("hooks")
+        return set(value.keys()) if isinstance(value, dict) else set()
+
+    def allows(doc: dict) -> set[str]:
+        perms = doc.get("permissions")
+        value = perms.get("allow") if isinstance(perms, dict) else None
+        return {str(v) for v in value} if isinstance(value, list) else set()
+
+    return bool(hooks(current) - hooks(incoming)) or bool(allows(current) - allows(incoming))
 
 STATUS_PENDING = "pending"
 STATUS_PREPARING = "preparing"
@@ -744,6 +778,22 @@ class UpgradeEngine:
                     continue
                 relative = str(source_file.relative_to(tree))
                 selected.setdefault(relative, source_file)
+        # The bundle's own manifest describes the package, not the instance;
+        # nothing in an instance reads it and it only shows up as an untracked
+        # file in the instance's repository.
+        selected.pop(BUNDLE_MANIFEST, None)
+        # The instance's own settings adapter may carry hook events or
+        # permission allows the generated public-safe adapter lacks (an org's
+        # committed .claude/settings.json). Activation never reduces it — the
+        # same rule the installer applies. A stale generated adapter (equal or
+        # a subset) still upgrades.
+        preserved: list[str] = []
+        candidate_settings = selected.get(SETTINGS_ADAPTER)
+        if candidate_settings is not None and _settings_carries_more(
+            instance / SETTINGS_ADAPTER, candidate_settings
+        ):
+            selected.pop(SETTINGS_ADAPTER, None)
+            preserved.append(SETTINGS_ADAPTER)
         # Journal opens the transaction BEFORE the first byte moves. From here
         # until the caller clears it, a crash is recoverable from the backup.
         self.store.write_apply_journal({
@@ -794,7 +844,12 @@ class UpgradeEngine:
             (self.store.root / "rollback-files.tar.gz").unlink(missing_ok=True)
             (self.store.root / "rollback-manifest.json").unlink(missing_ok=True)
             raise
-        return {"applied_files": len(selected), "replaced": len(replaced), "added": len(added)}
+        return {
+            "applied_files": len(selected),
+            "replaced": len(replaced),
+            "added": len(added),
+            "preserved": preserved,
+        }
 
     def activate(self) -> dict[str, Any]:
         self._acquire_apply_lock()
@@ -886,7 +941,14 @@ class UpgradeEngine:
         self.store.request_cancel()
         worker = state.get("worker") or {}
         pid = worker.get("pid")
-        if state.get("status") == STATUS_PREPARING and not (pid and _pid_alive(pid)):
+        status = state.get("status")
+        if status in (STATUS_PENDING, STATUS_READY, STATUS_FAILED):
+            # Nothing is running: release the staged candidate outright so a
+            # newer one can be staged. A ready or failed candidate used to be
+            # unreleasable — cancel ignored it and init refused "already staged".
+            state["status"] = STATUS_CANCELLED
+            self.store.write(state)
+        elif status == STATUS_PREPARING and not (pid and _pid_alive(pid)):
             # No live worker will observe the flag — record the cancel now.
             state["status"] = STATUS_CANCELLED
             self.store.write(state)

package/runtime/codex/bin/lib/greeting.sh

@@ -95,19 +95,15 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
-# --- Unshared org-settings drift (launcher writes not yet shared) ---
-if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
-  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
-fi
+# --- Org-settings sync receipts. A settings.json heal is logged to
+# .egregore/settings-drift.log, never announced; local settings changes reach
+# the control plane through bin/settings.sh, so there is nothing to ask. ---
 if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
   echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
 fi
 if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
   echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
 fi
-if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
-  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
-fi
 
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"

package/runtime/codex/bin/lib/settings-drift.sh

@@ -61,7 +61,11 @@ settings_drift_heal() {
 
   if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
     if _settings_is_reduced_adapter; then
-      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+      if git checkout -- .claude/settings.json 2>/dev/null; then
+        SETTINGS_ADAPTER_RESTORED="true"
+        mkdir -p .egregore 2>/dev/null && printf '%s restored .claude/settings.json: a generated adapter had replaced the org file\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> .egregore/settings-drift.log 2>/dev/null || true
+      fi
     fi
   fi
 

package/runtime/codex/egregore_runtime/upgrade.py

@@ -53,6 +53,40 @@ BUNDLE_TREES = ("claude", "codex", "pi", "prime")
 # wins and duplicates are skipped.
 APPLY_TREES = ("claude", "codex", "pi", "prime")
 APPLY_TREE = APPLY_TREES[0]
+# Bundle metadata at the root of each adapter tree; never instance content.
+BUNDLE_MANIFEST = "manifest.json"
+# The harness settings adapter the bundle generates; an instance's richer
+# committed copy is preserved on activation.
+SETTINGS_ADAPTER = ".claude/settings.json"
+
+
+def _settings_carries_more(existing: Path, candidate: Path) -> bool:
+    """True when the instance's settings file has hook events or permission
+    allows the candidate's generated adapter lacks. An unreadable candidate
+    keeps the existing file; an unreadable or missing existing file does not."""
+    if not existing.is_file():
+        return False
+    try:
+        current = json.loads(existing.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    try:
+        incoming = json.loads(candidate.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return True
+    if not isinstance(current, dict) or not isinstance(incoming, dict):
+        return False
+
+    def hooks(doc: dict) -> set[str]:
+        value = doc.get("hooks")
+        return set(value.keys()) if isinstance(value, dict) else set()
+
+    def allows(doc: dict) -> set[str]:
+        perms = doc.get("permissions")
+        value = perms.get("allow") if isinstance(perms, dict) else None
+        return {str(v) for v in value} if isinstance(value, list) else set()
+
+    return bool(hooks(current) - hooks(incoming)) or bool(allows(current) - allows(incoming))
 
 STATUS_PENDING = "pending"
 STATUS_PREPARING = "preparing"
@@ -744,6 +778,22 @@ class UpgradeEngine:
                     continue
                 relative = str(source_file.relative_to(tree))
                 selected.setdefault(relative, source_file)
+        # The bundle's own manifest describes the package, not the instance;
+        # nothing in an instance reads it and it only shows up as an untracked
+        # file in the instance's repository.
+        selected.pop(BUNDLE_MANIFEST, None)
+        # The instance's own settings adapter may carry hook events or
+        # permission allows the generated public-safe adapter lacks (an org's
+        # committed .claude/settings.json). Activation never reduces it — the
+        # same rule the installer applies. A stale generated adapter (equal or
+        # a subset) still upgrades.
+        preserved: list[str] = []
+        candidate_settings = selected.get(SETTINGS_ADAPTER)
+        if candidate_settings is not None and _settings_carries_more(
+            instance / SETTINGS_ADAPTER, candidate_settings
+        ):
+            selected.pop(SETTINGS_ADAPTER, None)
+            preserved.append(SETTINGS_ADAPTER)
         # Journal opens the transaction BEFORE the first byte moves. From here
         # until the caller clears it, a crash is recoverable from the backup.
         self.store.write_apply_journal({
@@ -794,7 +844,12 @@ class UpgradeEngine:
             (self.store.root / "rollback-files.tar.gz").unlink(missing_ok=True)
             (self.store.root / "rollback-manifest.json").unlink(missing_ok=True)
             raise
-        return {"applied_files": len(selected), "replaced": len(replaced), "added": len(added)}
+        return {
+            "applied_files": len(selected),
+            "replaced": len(replaced),
+            "added": len(added),
+            "preserved": preserved,
+        }
 
     def activate(self) -> dict[str, Any]:
         self._acquire_apply_lock()
@@ -886,7 +941,14 @@ class UpgradeEngine:
         self.store.request_cancel()
         worker = state.get("worker") or {}
         pid = worker.get("pid")
-        if state.get("status") == STATUS_PREPARING and not (pid and _pid_alive(pid)):
+        status = state.get("status")
+        if status in (STATUS_PENDING, STATUS_READY, STATUS_FAILED):
+            # Nothing is running: release the staged candidate outright so a
+            # newer one can be staged. A ready or failed candidate used to be
+            # unreleasable — cancel ignored it and init refused "already staged".
+            state["status"] = STATUS_CANCELLED
+            self.store.write(state)
+        elif status == STATUS_PREPARING and not (pid and _pid_alive(pid)):
             # No live worker will observe the flag — record the cancel now.
             state["status"] = STATUS_CANCELLED
             self.store.write(state)

package/runtime/pi/bin/lib/greeting.sh

@@ -95,19 +95,15 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
-# --- Unshared org-settings drift (launcher writes not yet shared) ---
-if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
-  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
-fi
+# --- Org-settings sync receipts. A settings.json heal is logged to
+# .egregore/settings-drift.log, never announced; local settings changes reach
+# the control plane through bin/settings.sh, so there is nothing to ask. ---
 if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
   echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
 fi
 if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
   echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
 fi
-if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
-  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
-fi
 
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"

package/runtime/pi/bin/lib/settings-drift.sh

@@ -61,7 +61,11 @@ settings_drift_heal() {
 
   if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
     if _settings_is_reduced_adapter; then
-      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+      if git checkout -- .claude/settings.json 2>/dev/null; then
+        SETTINGS_ADAPTER_RESTORED="true"
+        mkdir -p .egregore 2>/dev/null && printf '%s restored .claude/settings.json: a generated adapter had replaced the org file\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> .egregore/settings-drift.log 2>/dev/null || true
+      fi
     fi
   fi
 

package/runtime/pi/egregore_runtime/upgrade.py

@@ -53,6 +53,40 @@ BUNDLE_TREES = ("claude", "codex", "pi", "prime")
 # wins and duplicates are skipped.
 APPLY_TREES = ("claude", "codex", "pi", "prime")
 APPLY_TREE = APPLY_TREES[0]
+# Bundle metadata at the root of each adapter tree; never instance content.
+BUNDLE_MANIFEST = "manifest.json"
+# The harness settings adapter the bundle generates; an instance's richer
+# committed copy is preserved on activation.
+SETTINGS_ADAPTER = ".claude/settings.json"
+
+
+def _settings_carries_more(existing: Path, candidate: Path) -> bool:
+    """True when the instance's settings file has hook events or permission
+    allows the candidate's generated adapter lacks. An unreadable candidate
+    keeps the existing file; an unreadable or missing existing file does not."""
+    if not existing.is_file():
+        return False
+    try:
+        current = json.loads(existing.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    try:
+        incoming = json.loads(candidate.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return True
+    if not isinstance(current, dict) or not isinstance(incoming, dict):
+        return False
+
+    def hooks(doc: dict) -> set[str]:
+        value = doc.get("hooks")
+        return set(value.keys()) if isinstance(value, dict) else set()
+
+    def allows(doc: dict) -> set[str]:
+        perms = doc.get("permissions")
+        value = perms.get("allow") if isinstance(perms, dict) else None
+        return {str(v) for v in value} if isinstance(value, list) else set()
+
+    return bool(hooks(current) - hooks(incoming)) or bool(allows(current) - allows(incoming))
 
 STATUS_PENDING = "pending"
 STATUS_PREPARING = "preparing"
@@ -744,6 +778,22 @@ class UpgradeEngine:
                     continue
                 relative = str(source_file.relative_to(tree))
                 selected.setdefault(relative, source_file)
+        # The bundle's own manifest describes the package, not the instance;
+        # nothing in an instance reads it and it only shows up as an untracked
+        # file in the instance's repository.
+        selected.pop(BUNDLE_MANIFEST, None)
+        # The instance's own settings adapter may carry hook events or
+        # permission allows the generated public-safe adapter lacks (an org's
+        # committed .claude/settings.json). Activation never reduces it — the
+        # same rule the installer applies. A stale generated adapter (equal or
+        # a subset) still upgrades.
+        preserved: list[str] = []
+        candidate_settings = selected.get(SETTINGS_ADAPTER)
+        if candidate_settings is not None and _settings_carries_more(
+            instance / SETTINGS_ADAPTER, candidate_settings
+        ):
+            selected.pop(SETTINGS_ADAPTER, None)
+            preserved.append(SETTINGS_ADAPTER)
         # Journal opens the transaction BEFORE the first byte moves. From here
         # until the caller clears it, a crash is recoverable from the backup.
         self.store.write_apply_journal({
@@ -794,7 +844,12 @@ class UpgradeEngine:
             (self.store.root / "rollback-files.tar.gz").unlink(missing_ok=True)
             (self.store.root / "rollback-manifest.json").unlink(missing_ok=True)
             raise
-        return {"applied_files": len(selected), "replaced": len(replaced), "added": len(added)}
+        return {
+            "applied_files": len(selected),
+            "replaced": len(replaced),
+            "added": len(added),
+            "preserved": preserved,
+        }
 
     def activate(self) -> dict[str, Any]:
         self._acquire_apply_lock()
@@ -886,7 +941,14 @@ class UpgradeEngine:
         self.store.request_cancel()
         worker = state.get("worker") or {}
         pid = worker.get("pid")
-        if state.get("status") == STATUS_PREPARING and not (pid and _pid_alive(pid)):
+        status = state.get("status")
+        if status in (STATUS_PENDING, STATUS_READY, STATUS_FAILED):
+            # Nothing is running: release the staged candidate outright so a
+            # newer one can be staged. A ready or failed candidate used to be
+            # unreleasable — cancel ignored it and init refused "already staged".
+            state["status"] = STATUS_CANCELLED
+            self.store.write(state)
+        elif status == STATUS_PREPARING and not (pid and _pid_alive(pid)):
             # No live worker will observe the flag — record the cancel now.
             state["status"] = STATUS_CANCELLED
             self.store.write(state)

package/runtime/prime/bin/lib/greeting.sh

@@ -95,19 +95,15 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
-# --- Unshared org-settings drift (launcher writes not yet shared) ---
-if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
-  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
-fi
+# --- Org-settings sync receipts. A settings.json heal is logged to
+# .egregore/settings-drift.log, never announced; local settings changes reach
+# the control plane through bin/settings.sh, so there is nothing to ask. ---
 if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
   echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
 fi
 if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
   echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
 fi
-if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
-  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
-fi
 
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"

package/runtime/prime/bin/lib/settings-drift.sh

@@ -61,7 +61,11 @@ settings_drift_heal() {
 
   if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
     if _settings_is_reduced_adapter; then
-      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+      if git checkout -- .claude/settings.json 2>/dev/null; then
+        SETTINGS_ADAPTER_RESTORED="true"
+        mkdir -p .egregore 2>/dev/null && printf '%s restored .claude/settings.json: a generated adapter had replaced the org file\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> .egregore/settings-drift.log 2>/dev/null || true
+      fi
     fi
   fi
 

package/runtime/prime/egregore_runtime/upgrade.py

@@ -53,6 +53,40 @@ BUNDLE_TREES = ("claude", "codex", "pi", "prime")
 # wins and duplicates are skipped.
 APPLY_TREES = ("claude", "codex", "pi", "prime")
 APPLY_TREE = APPLY_TREES[0]
+# Bundle metadata at the root of each adapter tree; never instance content.
+BUNDLE_MANIFEST = "manifest.json"
+# The harness settings adapter the bundle generates; an instance's richer
+# committed copy is preserved on activation.
+SETTINGS_ADAPTER = ".claude/settings.json"
+
+
+def _settings_carries_more(existing: Path, candidate: Path) -> bool:
+    """True when the instance's settings file has hook events or permission
+    allows the candidate's generated adapter lacks. An unreadable candidate
+    keeps the existing file; an unreadable or missing existing file does not."""
+    if not existing.is_file():
+        return False
+    try:
+        current = json.loads(existing.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    try:
+        incoming = json.loads(candidate.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return True
+    if not isinstance(current, dict) or not isinstance(incoming, dict):
+        return False
+
+    def hooks(doc: dict) -> set[str]:
+        value = doc.get("hooks")
+        return set(value.keys()) if isinstance(value, dict) else set()
+
+    def allows(doc: dict) -> set[str]:
+        perms = doc.get("permissions")
+        value = perms.get("allow") if isinstance(perms, dict) else None
+        return {str(v) for v in value} if isinstance(value, list) else set()
+
+    return bool(hooks(current) - hooks(incoming)) or bool(allows(current) - allows(incoming))
 
 STATUS_PENDING = "pending"
 STATUS_PREPARING = "preparing"
@@ -744,6 +778,22 @@ class UpgradeEngine:
                     continue
                 relative = str(source_file.relative_to(tree))
                 selected.setdefault(relative, source_file)
+        # The bundle's own manifest describes the package, not the instance;
+        # nothing in an instance reads it and it only shows up as an untracked
+        # file in the instance's repository.
+        selected.pop(BUNDLE_MANIFEST, None)
+        # The instance's own settings adapter may carry hook events or
+        # permission allows the generated public-safe adapter lacks (an org's
+        # committed .claude/settings.json). Activation never reduces it — the
+        # same rule the installer applies. A stale generated adapter (equal or
+        # a subset) still upgrades.
+        preserved: list[str] = []
+        candidate_settings = selected.get(SETTINGS_ADAPTER)
+        if candidate_settings is not None and _settings_carries_more(
+            instance / SETTINGS_ADAPTER, candidate_settings
+        ):
+            selected.pop(SETTINGS_ADAPTER, None)
+            preserved.append(SETTINGS_ADAPTER)
         # Journal opens the transaction BEFORE the first byte moves. From here
         # until the caller clears it, a crash is recoverable from the backup.
         self.store.write_apply_journal({
@@ -794,7 +844,12 @@ class UpgradeEngine:
             (self.store.root / "rollback-files.tar.gz").unlink(missing_ok=True)
             (self.store.root / "rollback-manifest.json").unlink(missing_ok=True)
             raise
-        return {"applied_files": len(selected), "replaced": len(replaced), "added": len(added)}
+        return {
+            "applied_files": len(selected),
+            "replaced": len(replaced),
+            "added": len(added),
+            "preserved": preserved,
+        }
 
     def activate(self) -> dict[str, Any]:
         self._acquire_apply_lock()
@@ -886,7 +941,14 @@ class UpgradeEngine:
         self.store.request_cancel()
         worker = state.get("worker") or {}
         pid = worker.get("pid")
-        if state.get("status") == STATUS_PREPARING and not (pid and _pid_alive(pid)):
+        status = state.get("status")
+        if status in (STATUS_PENDING, STATUS_READY, STATUS_FAILED):
+            # Nothing is running: release the staged candidate outright so a
+            # newer one can be staged. A ready or failed candidate used to be
+            # unreleasable — cancel ignored it and init refused "already staged".
+            state["status"] = STATUS_CANCELLED
+            self.store.write(state)
+        elif status == STATUS_PREPARING and not (pid and _pid_alive(pid)):
             # No live worker will observe the flag — record the cancel now.
             state["status"] = STATUS_CANCELLED
             self.store.write(state)