create-egregore 0.21.0-runtime-mvp.27 → 0.21.0-runtime-mvp.28

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.27
+// egregore-launcher-version: 0.21.0-runtime-mvp.28
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.27";
+const VERSION = "0.21.0-runtime-mvp.28";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -753,72 +753,120 @@ async function renderCodexStartupCard(egregoreDir) {
   return false;
 }
 
-function codexSupportMessage(egregoreDir) {
-  return [
-    "Codex harness support is missing from this Egregore checkout.",
-    `  path: ${egregoreDir}`,
-    "",
-    "This checkout needs a newer Egregore core with:",
-    "  bin/codex-session-start.sh",
-    "  bin/codex-install-skills.sh",
-    "  .codex/config.toml",
-    "  .codex/skills/",
-    "  .codex/hooks.json",
-    "  .codex/hooks/",
-    "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
-    "A global CLI refresh does not repair instance files.",
-    "Egregore workflows appear as slash commands. In Codex, invoke them with the matching $skill token or ask in natural language.",
-  ].join("\n");
+const CORE_SUPPORT_PATHS = {
+  codex: [
+    "bin/codex-session-start.sh",
+    "bin/codex-install-skills.sh",
+    ".codex/config.toml",
+    ".codex/skills",
+    ".codex/hooks.json",
+    ".codex/hooks",
+  ],
+  pi: [
+    "bin/pi-session-start.sh",
+    ".pi/APPEND_SYSTEM.md",
+    ".pi/settings.json",
+    ".pi/extensions/egregore.ts",
+    ".codex/skills",
+  ],
+  prime: [
+    "bin/prime-session-start.sh",
+    ".prime/agent/APPEND_SYSTEM.md",
+    ".prime/agent/settings.json",
+    ".prime/agent/extensions/egregore.ts",
+    ".codex/skills",
+  ],
+};
+
+function missingCorePaths(runtime, egregoreDir) {
+  return (CORE_SUPPORT_PATHS[runtime] || []).filter(
+    (rel) => !fs.existsSync(path.join(egregoreDir, ...rel.split("/"))),
+  );
 }
 
 function hasCodexCoreSupport(egregoreDir) {
-  return (
-    fs.existsSync(path.join(egregoreDir, "bin", "codex-session-start.sh")) &&
-    fs.existsSync(path.join(egregoreDir, "bin", "codex-install-skills.sh")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "config.toml")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "skills")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "hooks.json")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "hooks"))
-  );
+  return missingCorePaths("codex", egregoreDir).length === 0;
 }
 
 function hasPiCoreSupport(egregoreDir) {
-  return (
-    fs.existsSync(path.join(egregoreDir, "bin", "pi-session-start.sh")) &&
-    fs.existsSync(path.join(egregoreDir, ".pi", "APPEND_SYSTEM.md")) &&
-    fs.existsSync(path.join(egregoreDir, ".pi", "settings.json")) &&
-    fs.existsSync(path.join(egregoreDir, ".pi", "extensions", "egregore.ts")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "skills"))
-  );
+  return missingCorePaths("pi", egregoreDir).length === 0;
 }
 
-function piSupportMessage(egregoreDir) {
-  return [
-    "Pi meta-harness support is missing from this Egregore checkout.",
+function hasPrimeCoreSupport(egregoreDir) {
+  return missingCorePaths("prime", egregoreDir).length === 0;
+}
+
+// The repair command is pinned to this launcher's own release. `@latest`
+// once pulled another release channel's files into an instance; the
+// launcher and the files it installs must always be the same version.
+function harnessAddCommand(runtime) {
+  return `npx -y ${PUBLIC_NPX_PACKAGE}@${VERSION} --add-harness ${runtimeShort(runtime)}`;
+}
+
+function harnessSupportMessage(runtime, egregoreDir) {
+  const label = runtimeLabel(runtime);
+  const missing = missingCorePaths(runtime, egregoreDir);
+  const lines = [
+    `${label} support is missing from this Egregore checkout.`,
     `  path: ${egregoreDir}`,
+  ];
+  if (missing.length > 0) {
+    lines.push("", "Missing:");
+    for (const rel of missing) lines.push(`  ${rel}`);
+  }
+  lines.push(
     "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
-  ].join("\n");
+    `Add ${label} support to this instance (missing files only, nothing overwritten):`,
+    `  cd ${egregoreDir}`,
+    `  ${harnessAddCommand(runtime)}`,
+    "Then rerun egregore.",
+  );
+  if (runtime === "codex") {
+    lines.push("Egregore workflows appear as slash commands. In Codex, invoke them with the matching $skill token or ask in natural language.");
+  }
+  return lines.join("\n");
 }
 
-function hasPrimeCoreSupport(egregoreDir) {
-  return (
-    fs.existsSync(path.join(egregoreDir, "bin", "prime-session-start.sh")) &&
-    fs.existsSync(path.join(egregoreDir, ".prime", "agent", "APPEND_SYSTEM.md")) &&
-    fs.existsSync(path.join(egregoreDir, ".prime", "agent", "settings.json")) &&
-    fs.existsSync(path.join(egregoreDir, ".prime", "agent", "extensions", "egregore.ts")) &&
-    fs.existsSync(path.join(egregoreDir, ".codex", "skills"))
-  );
+function codexSupportMessage(egregoreDir) {
+  return harnessSupportMessage("codex", egregoreDir);
+}
+
+function piSupportMessage(egregoreDir) {
+  return harnessSupportMessage("pi", egregoreDir);
 }
 
 function primeSupportMessage(egregoreDir) {
-  return [
-    "Prime Agent runtime support is missing from this Egregore checkout.",
-    `  path: ${egregoreDir}`,
+  return harnessSupportMessage("prime", egregoreDir);
+}
+
+// A launch that fails the support check offers to add exactly that harness
+// to exactly this instance, using this launcher's own release. Without a
+// terminal to ask, print the command and stop; never install unattended.
+async function ensureHarnessSupport(inst, runtime) {
+  if (missingCorePaths(runtime, inst.path).length === 0) return;
+  const message = harnessSupportMessage(runtime, inst.path);
+  if (!canPrompt()) die(message);
+  const label = runtimeLabel(runtime);
+  const name = inst.name || inst.slug || path.basename(inst.path);
+  process.stdout.write([
     "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
-  ].join("\n");
+    `  ${BOLD}${label} support is missing from ${name}.${RESET}`,
+    `  ${DIM}Missing: ${missingCorePaths(runtime, inst.path).join(", ")}${RESET}`,
+    `  ${DIM}Egregore can add it now. Only missing files are written; nothing is overwritten:${RESET}`,
+    `    ${harnessAddCommand(runtime)}`,
+    "",
+  ].join("\n"));
+  const yes = await confirmLine(`Add ${label} support to ${name} now?`);
+  if (!yes) die(message);
+  const result = spawnSync(
+    "npx",
+    ["-y", `${PUBLIC_NPX_PACKAGE}@${VERSION}`, "--add-harness", runtimeShort(runtime)],
+    { cwd: inst.path, stdio: "inherit", env: process.env, timeout: 3 * 60 * 1000 },
+  );
+  if (result.error || result.status !== 0 || missingCorePaths(runtime, inst.path).length > 0) {
+    die(`${label} support could not be added automatically.\n\n${harnessSupportMessage(runtime, inst.path)}`);
+  }
+  process.stdout.write(`  ${GREEN}✓${RESET} ${label} support added to ${name}\n\n`);
 }
 
 // Minimal y/N line prompt for pre-launch decisions (the TUI select machinery
@@ -873,7 +921,7 @@ function primeAuthHint() {
 
 function installCodexSkills(egregoreDir) {
   const script = path.join(egregoreDir, "bin", "codex-install-skills.sh");
-  if (!fs.existsSync(script)) return false;
+  if (!fs.existsSync(script)) return { ok: false, stderr: `missing ${script}` };
   try {
     const result = spawnSync("bash", [script], {
       cwd: egregoreDir,
@@ -881,9 +929,9 @@ function installCodexSkills(egregoreDir) {
       encoding: "utf-8",
       maxBuffer: 1024 * 1024,
     });
-    return result.status === 0;
-  } catch {
-    return false;
+    return { ok: result.status === 0, stderr: (result.stderr || "").trim() };
+  } catch (err) {
+    return { ok: false, stderr: String(err && err.message ? err.message : err) };
   }
 }
 
@@ -966,29 +1014,31 @@ async function launch(inst, runtimeOverride) {
     }
   }
   if (runtime === "codex") {
-    // Launching never changes an instance's runtime or release channel.
-    if (!hasCodexCoreSupport(inst.path)) die(codexSupportMessage(inst.path));
-    const skillsInstalled = installCodexSkills(inst.path);
+    // Launching never changes an instance's runtime or release channel. A
+    // missing harness is added only with the user's consent, one harness
+    // into this one instance, at this launcher's own version.
+    await ensureHarnessSupport(inst, runtime);
+    const skills = installCodexSkills(inst.path);
+    if (!skills.ok) {
+      die(`Codex skill setup failed in ${inst.path} (bin/codex-install-skills.sh):\n${skills.stderr || "  (no error output)"}`);
+    }
     const cardRendered = await renderCodexStartupCard(inst.path);
-    if (!skillsInstalled || !cardRendered) {
-      die(codexSupportMessage(inst.path));
+    if (!cardRendered) {
+      die(`Codex startup card failed in ${inst.path} (bin/codex-session-start.sh exited non-zero; its output is above).`);
     }
   } else if (runtime === "pi") {
-    if (!hasPiCoreSupport(inst.path)) {
-      die(piSupportMessage(inst.path));
-    }
+    await ensureHarnessSupport(inst, runtime);
   }
   let launchArgs = null;
   if (runtime === "prime") {
+    await ensureHarnessSupport(inst, runtime);
     // Cover the gap between choosing the harness and Prime's first paint:
-    // the loader runs through the launcher-side pre-flight (core-support
-    // check + the trust-flag probe, which shells out to the binary), then a
-    // single handoff line explains the remaining in-harness startup.
+    // the loader runs through the launcher-side pre-flight (the trust-flag
+    // probe, which shells out to the binary), then a single handoff line
+    // explains the remaining in-harness startup.
     const stopLoader = startSpinner("Starting Prime Agent");
-    const coreOk = hasPrimeCoreSupport(inst.path);
-    launchArgs = coreOk ? runtimeLaunchArgs(runtime, inst.path) : null;
+    launchArgs = runtimeLaunchArgs(runtime, inst.path);
     stopLoader();
-    if (!coreOk) die(primeSupportMessage(inst.path));
     primeAuthHint();
     process.stdout.write(`  ${CYAN}◆${RESET} ${BOLD}Prime Agent starting${RESET}${DIM} — the Egregore greeting loads inside in a few seconds${RESET}\n`);
   }

package/bin/cli.js

@@ -91,6 +91,32 @@ function detectCwdEgregore(cwd) {
   }
 }
 
+// Resolve which instance `--add-harness` writes into. Explicit `--instance`
+// wins; otherwise the current directory when it is an instance; otherwise the
+// only registered instance. Several registered instances and no explicit
+// choice is an error — this command must never fan out.
+function resolveAddHarnessTarget(explicitPath) {
+  const isInstance = (dir) => dir && fs.existsSync(path.join(dir, "egregore.json"));
+  if (explicitPath) {
+    const dir = path.resolve(explicitPath);
+    if (isInstance(dir)) return dir;
+    ui.error(`Not an Egregore instance: ${dir} (no egregore.json).`);
+    return null;
+  }
+  let cwd = null;
+  try { cwd = process.cwd(); } catch {}
+  if (isInstance(cwd)) return cwd;
+  const registered = readLocalInstances().filter((inst) => isInstance(inst.path));
+  if (registered.length === 1) return path.resolve(registered[0].path);
+  if (registered.length === 0) {
+    ui.error("No Egregore instance found. Run this inside the instance directory, or pass --instance <path>.");
+    return null;
+  }
+  ui.error("Several Egregore instances are registered. Pass --instance <path> to choose one:");
+  for (const inst of registered) ui.info(`  ${inst.path}`);
+  return null;
+}
+
 function binaryOnPath(bin) {
   return commandExists(bin);
 }
@@ -211,6 +237,14 @@ function parseArgs(argv) {
       args.refreshLauncher = true;
     } else if (argv[i] === "--refresh-connect") {
       args.refreshConnect = true;
+    } else if (argv[i] === "--add-harness" && argv[i + 1]) {
+      args.addHarness = argv[++i];
+    } else if (argv[i].startsWith("--add-harness=")) {
+      args.addHarness = argv[i].split("=")[1];
+    } else if (argv[i] === "--instance" && argv[i + 1]) {
+      args.instance = argv[++i];
+    } else if (argv[i].startsWith("--instance=")) {
+      args.instance = argv[i].split("=")[1];
     } else if (argv[i] === "--codex") {
       args.runtime = "codex";
     } else if (argv[i] === "--pi") {
@@ -386,7 +420,9 @@ function showHelp() {
   ui.info("  --force           Skip the in-repo detection check");
   ui.info("  --no-autolaunch   Don't launch the harness at the end (for CI)");
   ui.info("  --no-screens      Skip the full-screen welcome/ready bookends");
-  ui.info("  --refresh-launcher Refresh the Egregore CLI and runtime packs, then exit");
+  ui.info("  --refresh-launcher Refresh only the global Egregore CLI, then exit");
+  ui.info("  --add-harness <h> Add codex, pi, or prime support to one existing instance (missing files only)");
+  ui.info("  --instance <path> Instance for --add-harness (default: cwd, or the only registered instance)");
   ui.info("  -h, --help        Show this help");
   ui.info("");
 }
@@ -433,6 +469,39 @@ async function main() {
     }
   }
 
+  if (args.addHarness) {
+    // Explicit, instance-scoped harness addition. This is the only path that
+    // writes harness files into an existing instance from the global CLI: one
+    // harness, one instance, missing files only. The launcher invokes it with
+    // its own pinned version when a launch fails the support check.
+    const { addHarnessRuntime, harnessLabel, normalizeHarness } = require("../lib/harness-add");
+    const harness = normalizeHarness(args.addHarness);
+    if (!harness) {
+      ui.error(`Unknown harness "${args.addHarness}". Use --add-harness codex, pi, or prime.`);
+      process.exit(1);
+    }
+    const targetDir = resolveAddHarnessTarget(args.instance);
+    if (!targetDir) process.exit(1);
+    try {
+      const summary = addHarnessRuntime(targetDir, harness);
+      const label = harnessLabel(harness);
+      if (summary.installed.length === 0) {
+        ui.success(`${label} support already present in ${targetDir}`);
+      } else {
+        ui.success(`Added ${label} support to ${targetDir} ${ui.dim(`(${summary.installed.length} files, ${summary.present} kept)`)}`);
+      }
+      if (!summary.ready) {
+        ui.warn(`${label} support is still incomplete in ${targetDir}; an existing file may be a directory or symlink where a file is expected.`);
+        process.exit(1);
+      }
+      ui.info(`Run: egregore --runtime ${harness}`);
+      return;
+    } catch (err) {
+      ui.error(String(err.message || err));
+      process.exit(1);
+    }
+  }
+
   if (args.refreshConnect) {
     // Session-start maintenance mode: refresh the Connect overlay for an
     // existing instance. Local instances no-op instantly; network failure is

package/lib/harness-add.js

@@ -0,0 +1,159 @@
+"use strict";
+
+// Add one harness (Codex, Pi, Prime Agent) to an existing instance.
+//
+// Setup overlays only the harness chosen at install time, so a Claude-only
+// instance has no Codex files. The September 2026 launcher auto-repair fixed
+// that by running the *latest* installer against *every* registered instance,
+// which overwrote and deleted files in instances on another release channel.
+// This module is the scoped replacement:
+//
+//   - one harness, one instance, chosen explicitly;
+//   - copies only files that are missing from that harness's packaged bundle;
+//   - never overwrites, never deletes, never touches another harness;
+//   - records what it wrote in its own manifest so nothing else claims
+//     ownership of pre-existing files.
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const PACKAGE = require("../package.json");
+
+const HARNESSES = {
+  codex: { label: "Codex", module: "./codex-runtime", bundle: "codex" },
+  pi: { label: "Pi", module: "./pi-runtime", bundle: "pi" },
+  prime: { label: "Prime Agent", module: "./prime-runtime", bundle: "prime" },
+};
+
+function normalizeHarness(name) {
+  const value = String(name || "").trim().toLowerCase();
+  if (value === "codex") return "codex";
+  if (value === "pi") return "pi";
+  if (value === "prime" || value === "prime-agent") return "prime";
+  return null;
+}
+
+function harnessLabel(harness) {
+  return (HARNESSES[harness] && HARNESSES[harness].label) || harness;
+}
+
+function bundleDirFor(harness) {
+  return path.join(__dirname, "..", "runtime", HARNESSES[harness].bundle);
+}
+
+function listFiles(dir, prefix = "") {
+  if (!fs.existsSync(dir)) return [];
+  const result = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? path.join(prefix, entry.name) : entry.name;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      result.push(...listFiles(full, rel));
+    } else if (entry.isFile()) {
+      result.push(rel);
+    }
+  }
+  return result.sort();
+}
+
+function pathExistsOrSymlink(file) {
+  try {
+    fs.lstatSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function copyMissingFile(src, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+  try {
+    const mode = fs.statSync(src).mode & 0o777;
+    fs.chmodSync(dest, mode);
+  } catch {}
+}
+
+// Required paths come from the harness module so the CLI and the launcher's
+// pre-launch check agree on what "support present" means.
+function requiredPathsFor(harness) {
+  const mod = require(HARNESSES[harness].module);
+  const checker = mod.hasCodexRuntimeSupport || mod.hasPiRuntimeSupport || mod.hasPrimeRuntimeSupport;
+  return { hasSupport: (dir) => Boolean(checker && checker(dir)) };
+}
+
+function manifestPath(egregoreDir, harness) {
+  return path.join(egregoreDir, ".egregore", `${harness}-harness-add.json`);
+}
+
+// Current Codex discovers project skills via .agents/skills -> ../.codex/skills.
+// Create the link only when nothing is there; never replace a real directory.
+function ensureAgentsSkillsLink(egregoreDir, summary) {
+  const agentsDir = path.join(egregoreDir, ".agents");
+  const link = path.join(agentsDir, "skills");
+  if (pathExistsOrSymlink(link)) return;
+  try {
+    fs.mkdirSync(agentsDir, { recursive: true });
+    fs.symlinkSync(path.join("..", ".codex", "skills"), link);
+    summary.installed.push(".agents/skills");
+  } catch {}
+}
+
+/**
+ * Copy every file of `harness`'s packaged bundle that is missing from
+ * `egregoreDir`. Existing files are left untouched regardless of content.
+ *
+ * Returns { harness, installed: [rel...], present: n, ready: bool }.
+ */
+function addHarnessRuntime(egregoreDir, harnessName) {
+  const harness = normalizeHarness(harnessName);
+  if (!harness) {
+    throw new Error(`Unknown harness "${harnessName}". Expected codex, pi, or prime.`);
+  }
+  const bundleDir = bundleDirFor(harness);
+  if (!fs.existsSync(bundleDir)) {
+    throw new Error(`This create-egregore release ships no ${harnessLabel(harness)} bundle (${bundleDir}).`);
+  }
+  if (!fs.existsSync(path.join(egregoreDir, "egregore.json"))) {
+    throw new Error(`Not an Egregore instance: ${egregoreDir} (no egregore.json).`);
+  }
+
+  const summary = { harness, installed: [], present: 0, ready: false };
+  for (const rel of listFiles(bundleDir)) {
+    if (rel === "manifest.json") continue;
+    const dest = path.join(egregoreDir, rel);
+    if (pathExistsOrSymlink(dest)) {
+      summary.present += 1;
+      continue;
+    }
+    copyMissingFile(path.join(bundleDir, rel), dest);
+    summary.installed.push(rel);
+  }
+  if (harness === "codex") ensureAgentsSkillsLink(egregoreDir, summary);
+
+  summary.ready = requiredPathsFor(harness).hasSupport(egregoreDir);
+
+  if (summary.installed.length > 0) {
+    const file = manifestPath(egregoreDir, harness);
+    const previous = (() => {
+      try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return { files: [] }; }
+    })();
+    const files = Array.from(new Set([...(previous.files || []), ...summary.installed])).sort();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({
+      package: PACKAGE.name,
+      version: PACKAGE.version,
+      harness,
+      addedAt: new Date().toISOString(),
+      files,
+    }, null, 2) + "\n");
+  }
+  return summary;
+}
+
+module.exports = {
+  HARNESSES,
+  addHarnessRuntime,
+  harnessLabel,
+  normalizeHarness,
+};

package/lib/setup.js

@@ -1203,7 +1203,7 @@ function codexSupportMessage(egregoreDir) {
     "  .codex/hooks.json",
     "  .codex/hooks/",
     "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
+    `Add it with: npx -y create-egregore@${require("../package.json").version} --add-harness codex (run inside the instance; missing files only), then rerun egregore.`,
     "Egregore workflows appear as slash commands. In Codex, invoke them with the matching $skill token or ask in natural language.",
   ].join("\n");
 }
@@ -1217,7 +1217,7 @@ function piSupportMessage(egregoreDir) {
     "Pi meta-harness support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
+    `Add it with: npx -y create-egregore@${require("../package.json").version} --add-harness pi (run inside the instance; missing files only), then rerun egregore.`,
     "Pi loads Egregore through project-local .pi resources and the shared portable skill corpus.",
   ].join("\n");
 }
@@ -1227,7 +1227,7 @@ function primeSupportMessage(egregoreDir) {
     "Prime Agent runtime support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Restore this instance using its installed runtime version, then rerun egregore.",
+    `Add it with: npx -y create-egregore@${require("../package.json").version} --add-harness prime (run inside the instance; missing files only), then rerun egregore.`,
     "Prime Agent loads Egregore through project-local .prime/agent resources and the shared portable skill corpus.",
   ].join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.27",
+  "version": "0.21.0-runtime-mvp.28",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -14,10 +14,12 @@
     "build:claude-runtime": "node scripts/build-claude-runtime-bundle.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
     "build:prime-runtime": "node scripts/build-prime-runtime-bundle.mjs",
-    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-claude-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/invite-install.test.js test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js test/workflow-settings.test.js",
+    "test": "npm run test:runtime && npm run test:package",
     "test:packed-runtime": "node scripts/packed-runtime-canary.mjs",
     "test:e2e": "node --test test/e2e-local.test.js",
-    "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-claude-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
+    "test:all": "npm run test:runtime && node --test test/",
+    "test:runtime": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-claude-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && bash ../../bin/tests/test-codex-native-skills.sh && bash ../../bin/tests/test-codex-spec-render.sh && node ../../bin/capability-distribution.mjs skill-contract --root ../.. --strict-contract && bash ../../bin/tests/test-bundle-skill-scripts.sh && node --test test/bundle-skill-scripts.test.js",
+    "test:package": "node --test test/invite-install.test.js test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/native-command-observe.test.js test/prime-rpc-driver.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/harness-add.test.js test/connected-config.test.js test/workflow-settings.test.js"
   },
   "files": [
     "bin/",

package/runtime/claude/.claude/context/notification-consent.md

@@ -1,13 +1,28 @@
 # External notification consent
 
 This protocol applies to every Telegram, Teams, or other external notification
-in every harness. It applies even when the user asked to announce, notify,
+in every harness, except the configured issue system-event feed below. It applies even when the user asked to announce, notify,
 handoff, invite, or message someone, and even when the harness is running with
 broad tool permissions.
 
+## Configured issue system events
+
+The hosted Archive feed is an approved automatic system-event channel only for
+repositories explicitly listed in an org's `PR_FEED_CONFIG.issue_repos` with
+`issue_feed_policy: "issue-feed/v1"`. It reuses that feed's bot and archive
+channel. Allowed events: issue opened/reopened/closed, assignment changes,
+severity label changes, and newly created strict v1 observation comments.
+Only bounded sanitized metadata and validated links may leave; never report
+bodies, comment text, transcripts or logs. HMAC authentication, repository
+allowlisting and service-role transport receipts are required. Known rejected
+sends can be retried; uncertain sends require operator Archive reconciliation.
+Disabling the configuration revokes this exception. No other repository,
+destination, authored message, DM, announcement or background agent is approved.
+The remaining protocol applies unchanged to all agent-composed notifications.
+
 ## Invariant
 
-Never dispatch an external notification until the human has approved that one
+Outside the configured issue-feed exception, never dispatch an external notification until the human has approved that one
 exact delivery in a dedicated checkpoint. The checkpoint must show:
 
 - the organization;

package/runtime/claude/.claude/context/retrieval-investigation.md

@@ -0,0 +1,50 @@
+# Runtime retrieval
+
+Search organizational memory through Runtime; reuse evidence already in context.
+For exact handoff status/order, use `bash bin/search.sh handoffs --mine --status open --order newest --limit 1 --open`; adjust filters to the question.
+Choose a lookup and call `bash bin/search.sh find "<query>" --kind <kind>`:
+filename for known path fragments; literal for exact wording; dates for dated
+inventories; keyword for distinctive terms/names; semantic for paraphrases;
+hybrid for combined ranking. No mode must run first; keyword is the default.
+Add --recent-days N or --after/--before YYYY-MM-DD to preserve the requested period.
+For current work choose --recent-days (normally 30) and state that period.
+Keep the user's subject and known identity; never append the organization roster or unrelated names.
+Keep the date boundary across refinements. Empty results are an evidence gap:
+change the lookup rather than silently broadening it.
+Other filters: --prefix memory/... and --artifact-type TYPE; -n N limits results
+(default 8, maximum 20). Dates query matches literal text in paths/content;
+an exact active-actor ID/name/alias includes its known identity variants. A mention
+is not proof of authorship. Omit query only for an inventory of all subjects.
+Find returns canonical paths and excerpts. Answer from them when sufficient.
+When several sources need more context, open them together in ONE call:
+`bash bin/search.sh open memory/path-a.md memory/path-b.md memory/path-c.md`.
+Up to 10 sources per call; --offset N is a nonnegative character offset and
+--length N is 1–16000 characters per source. A batch shares a 16,000-byte
+result budget, so windows may be shorter. Follow the printed per-source
+continuation only when that source needs more context; do not assume a partial
+window is the complete document. Keep each source batch in its own tool result.
+In Codex, set the outer functions.exec output budget with
+`// @exec: {"max_output_tokens": 20000}` and exec_command.max_output_tokens to
+20000 for source reads; a larger inner limit alone cannot prevent outer truncation.
+Known paths may be opened directly. Use find --cursor TOKEN only when another
+page is needed. Do not fetch or reread this contract when it is already attached.
+Runtime retains date bounds and resolves the native session automatically.
+Do not supply episode IDs, request IDs, or gap explanations in normal calls.
+If native binding is unavailable, use this prompt's supplied --episode reference;
+never borrow another prompt's reference. A new prompt resets retrieval limits.
+Use a normal completion wait (at least 10 seconds for yield_time_ms); do not
+create polling turns with one-second waits. Batch independent work in the harness.
+Stop when the question is supported. Ranked matches are not exhaustive; verify
+coverage before claiming something is newest or absent. Document dates need not
+be event dates. Distinguish proposals/conditions from completed work and cite sources.
+For evolving plans, open directly relevant later records in the requested period
+before treating an earlier scope as current; a search excerpt may omit revisions.
+Reconcile material differences using record/event dates; cite unresolved alternatives.
+When an answer depends on not finding evidence, carry any material retrieval
+failure or index-coverage warning into the final answer. Say what could not be
+verified and how the gap limits that conclusion; do not turn a search gap into a fact.
+Authorization, source checks, retained evidence and budgets remain inside Runtime:
+8 discoveries, 20 source windows, 50 calls and 120,000 result characters per prompt.
+Never bypass Runtime with raw memory filesystem or direct QMD access. Code search
+and tests use ordinary tools. Emit the memory retrieval beat once per question.
+On Claude append --context-packet; never reproduce internal JSON or ranking traces.