create-egregore 0.21.0-runtime-mvp.21 → 0.21.0-runtime-mvp.22

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.21
+// egregore-launcher-version: 0.21.0-runtime-mvp.22
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.21";
+const VERSION = "0.21.0-runtime-mvp.22";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2499,20 +2499,33 @@ function formatTelemetryLines(status) {
 function upgradeStatus(inst, { fetch = false } = {}) {
   const args = ["status"]; if (fetch) args.push("--fetch");
   const r = runUpgrade(inst, args);
-  if (!r || r.status !== 0 || !r.stdout) return null;
-  try { return JSON.parse(r.stdout); } catch { return null; }
+  if (!r || r.status !== 0 || !r.stdout) {
+    const detail = String((r && (r.stderr || r.stdout)) || "Runtime status probe failed")
+      .trim().split("\n")[0];
+    return { status: "unavailable", failure: { message: detail } };
+  }
+  try { return JSON.parse(r.stdout); } catch {
+    return { status: "unavailable", failure: { message: "Runtime status returned an unreadable response" } };
+  }
 }
 
 function upgradeStatusAsync(inst, cb) {
   const bridge = resolveUpgradeBridge(inst);
-  if (!bridge) return cb(null);
-  let buf = "";
+  if (!bridge) return cb({ status: "unavailable", failure: { message: "No Runtime update engine is installed" } });
+  let buf = ""; let err = "";
   try {
-    const child = spawn("bash", [bridge.script, "status"], { cwd: inst.path, stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, ...bridge.env } });
+    const child = spawn("bash", [bridge.script, "status"], { cwd: inst.path, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...bridge.env } });
     child.stdout.on("data", (d) => { buf += d; });
-    child.on("close", () => { try { cb(JSON.parse(buf)); } catch { cb(null); } });
-    child.on("error", () => cb(null));
-  } catch { cb(null); }
+    child.stderr.on("data", (d) => { err += d; });
+    child.on("close", (code) => {
+      if (code === 0) {
+        try { cb(JSON.parse(buf)); return; } catch {}
+      }
+      const detail = String(err || buf || "Runtime status probe failed").trim().split("\n")[0];
+      cb({ status: "unavailable", failure: { message: detail } });
+    });
+    child.on("error", (error) => cb({ status: "unavailable", failure: { message: error.message } }));
+  } catch (error) { cb({ status: "unavailable", failure: { message: error.message } }); }
 }
 
 // Local retrieval health for the settings surface. Package-update state,
@@ -2632,6 +2645,7 @@ const UPGRADE_STATUS_LABEL = {
   active: "active",
   cancelled: "cancelled",
   "rolled-back": "rolled back",
+  unavailable: "unavailable",
 };
 
 // Settings-row truth for the Runtime update line. The row must say outright
@@ -2645,6 +2659,7 @@ function runtimeUpdateRowValue(st, candidate) {
     if (candidate && candidate !== v) return `${v} active ${YELLOW}· update available ${candidate}${RESET}`;
     return `${GREEN}${v} active${RESET}${candidate ? `${DIM} · up to date${RESET}` : ""}`;
   }
+  if (st.status === "unavailable") return `${YELLOW}update unavailable${RESET}`;
   if (st.status === "ready-to-activate") return `${GREEN}${upgradeSummary(st)}${RESET}`;
   if (st.status === "failed" || st.status === "interrupted") return `${YELLOW}${upgradeSummary(st)}${RESET}`;
   if (st.status === "preparing" || st.status === "pending") return `${DIM}${upgradeSummary(st)}${RESET}`;
@@ -2685,7 +2700,7 @@ function formatUpgradeLines(inst, st, { candidate = "", retrieval = null } = {})
   if (d.candidate_digest) lines.push(`Package digest: sha256 ${String(d.candidate_digest).slice(0, 16)}…`);
   // A recorded failure only needs attention while the transaction is stuck
   // on it; once a later prepare succeeds the line would contradict "ready".
-  if (d.failure && d.failure.message && (d.status === "failed" || d.status === "interrupted")) {
+  if (d.failure && d.failure.message && (["failed", "interrupted", "unavailable"].includes(d.status))) {
     lines.push(`Attention: ${d.failure.message}`);
   }
   if (d.rollback_version && d.status !== "none") lines.push(`Rollback target: ${d.rollback_version}`);
@@ -2760,6 +2775,7 @@ async function cmdSettingsRuntime(inst, args) {
     const st = upgradeStatus(inst, { fetch: fetchFlag });
     if (st === null) { process.stderr.write("Runtime update state is unavailable for this egregore.\n"); process.exitCode = 1; return; }
     emit(st);
+    if (st.status === "unavailable") process.exitCode = 1;
     if (action === "review" || (st.status !== "active" && st.status !== "none")) {
       process.stdout.write("\nWhat stays:\n");
       for (const s of UPGRADE_STAYS) process.stdout.write(`  · ${s}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.21",
+  "version": "0.21.0-runtime-mvp.22",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/claude/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/codex/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/codex/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/pi/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/pi/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/prime/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/prime/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2