create-egregore 0.21.0 → 0.21.1

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0
+// egregore-launcher-version: 0.21.1
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0";
+const VERSION = "0.21.1";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/egregore_runtime/identity_transfer.py

@@ -11,6 +11,7 @@ from dataclasses import replace
 import hashlib
 import json
 import os
+import re
 from pathlib import Path, PurePosixPath
 import tempfile
 from typing import Any, Mapping
@@ -101,6 +102,26 @@ def _changed_fields(fields: Mapping[str, Any], source_id: str, destination_id: s
     return updates
 
 
+def _malformed_transfer_candidate(markdown: str, source_id: str) -> bool:
+    """Identify an invalid document that could still require ownership transfer.
+
+    Existing memory can contain old or adversarial Markdown that is not a valid
+    Runtime artifact. Identity reconciliation must not fail because an unrelated
+    document is malformed, but it must fail closed when that document explicitly
+    names the current actor as a transferable owner.
+    """
+
+    if not source_id:
+        return False
+    actor = re.escape(source_id)
+    question = re.search(r"(?m)^type:\s*[\"']?question[\"']?\s*$", markdown)
+    recipient = re.search(rf"(?m)^to_actor_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    thread = re.search(r"(?m)^type:\s*[\"']?thread[\"']?\s*$", markdown)
+    steward = re.search(rf"(?m)^steward_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    stewards = re.search(rf"(?m)^steward_ids:\s*.*\b{actor}\b", markdown)
+    return bool((question and recipient) or (thread and (steward or stewards)))
+
+
 def _document(before: str, path: str, pair: Mapping[str, Any], transfer_id: str):
     fields, _ = split_frontmatter(before)
     updates = _changed_fields(fields, pair["source"]["actor_id"], pair["destination"]["actor_id"])
@@ -148,7 +169,18 @@ def _inventory(memory: Path, runtime, source: ActorContext, destination_id: str)
             if len(raw) > MAX_DOCUMENT_BYTES or size > MAX_SCAN_BYTES:
                 raise IdentityTransferError("ownership inventory exceeds its byte limit; retain the current identity")
             before = raw.decode("utf-8")
-            fields, _ = split_frontmatter(before)
+            try:
+                fields, _ = split_frontmatter(before)
+            except ValueError as error:
+                # A malformed legacy or test document outside the transfer
+                # contract must not block identity reconciliation. If it names
+                # the current owner, fail closed so ownership is never left
+                # half-transferred.
+                if _malformed_transfer_candidate(before, source.actor.actor_id):
+                    raise IdentityTransferError(
+                        f"ownership inventory cannot parse {relative}: {error}"
+                    ) from error
+                continue
             if (fields.get("org") or fields.get("org_id")) not in {None, source.profile.org_id}:
                 continue
             if _changed_fields(fields, source.actor.actor_id, destination_id):

package/runtime/codex/egregore_runtime/identity_transfer.py

@@ -11,6 +11,7 @@ from dataclasses import replace
 import hashlib
 import json
 import os
+import re
 from pathlib import Path, PurePosixPath
 import tempfile
 from typing import Any, Mapping
@@ -101,6 +102,26 @@ def _changed_fields(fields: Mapping[str, Any], source_id: str, destination_id: s
     return updates
 
 
+def _malformed_transfer_candidate(markdown: str, source_id: str) -> bool:
+    """Identify an invalid document that could still require ownership transfer.
+
+    Existing memory can contain old or adversarial Markdown that is not a valid
+    Runtime artifact. Identity reconciliation must not fail because an unrelated
+    document is malformed, but it must fail closed when that document explicitly
+    names the current actor as a transferable owner.
+    """
+
+    if not source_id:
+        return False
+    actor = re.escape(source_id)
+    question = re.search(r"(?m)^type:\s*[\"']?question[\"']?\s*$", markdown)
+    recipient = re.search(rf"(?m)^to_actor_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    thread = re.search(r"(?m)^type:\s*[\"']?thread[\"']?\s*$", markdown)
+    steward = re.search(rf"(?m)^steward_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    stewards = re.search(rf"(?m)^steward_ids:\s*.*\b{actor}\b", markdown)
+    return bool((question and recipient) or (thread and (steward or stewards)))
+
+
 def _document(before: str, path: str, pair: Mapping[str, Any], transfer_id: str):
     fields, _ = split_frontmatter(before)
     updates = _changed_fields(fields, pair["source"]["actor_id"], pair["destination"]["actor_id"])
@@ -148,7 +169,18 @@ def _inventory(memory: Path, runtime, source: ActorContext, destination_id: str)
             if len(raw) > MAX_DOCUMENT_BYTES or size > MAX_SCAN_BYTES:
                 raise IdentityTransferError("ownership inventory exceeds its byte limit; retain the current identity")
             before = raw.decode("utf-8")
-            fields, _ = split_frontmatter(before)
+            try:
+                fields, _ = split_frontmatter(before)
+            except ValueError as error:
+                # A malformed legacy or test document outside the transfer
+                # contract must not block identity reconciliation. If it names
+                # the current owner, fail closed so ownership is never left
+                # half-transferred.
+                if _malformed_transfer_candidate(before, source.actor.actor_id):
+                    raise IdentityTransferError(
+                        f"ownership inventory cannot parse {relative}: {error}"
+                    ) from error
+                continue
             if (fields.get("org") or fields.get("org_id")) not in {None, source.profile.org_id}:
                 continue
             if _changed_fields(fields, source.actor.actor_id, destination_id):

package/runtime/pi/egregore_runtime/identity_transfer.py

@@ -11,6 +11,7 @@ from dataclasses import replace
 import hashlib
 import json
 import os
+import re
 from pathlib import Path, PurePosixPath
 import tempfile
 from typing import Any, Mapping
@@ -101,6 +102,26 @@ def _changed_fields(fields: Mapping[str, Any], source_id: str, destination_id: s
     return updates
 
 
+def _malformed_transfer_candidate(markdown: str, source_id: str) -> bool:
+    """Identify an invalid document that could still require ownership transfer.
+
+    Existing memory can contain old or adversarial Markdown that is not a valid
+    Runtime artifact. Identity reconciliation must not fail because an unrelated
+    document is malformed, but it must fail closed when that document explicitly
+    names the current actor as a transferable owner.
+    """
+
+    if not source_id:
+        return False
+    actor = re.escape(source_id)
+    question = re.search(r"(?m)^type:\s*[\"']?question[\"']?\s*$", markdown)
+    recipient = re.search(rf"(?m)^to_actor_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    thread = re.search(r"(?m)^type:\s*[\"']?thread[\"']?\s*$", markdown)
+    steward = re.search(rf"(?m)^steward_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    stewards = re.search(rf"(?m)^steward_ids:\s*.*\b{actor}\b", markdown)
+    return bool((question and recipient) or (thread and (steward or stewards)))
+
+
 def _document(before: str, path: str, pair: Mapping[str, Any], transfer_id: str):
     fields, _ = split_frontmatter(before)
     updates = _changed_fields(fields, pair["source"]["actor_id"], pair["destination"]["actor_id"])
@@ -148,7 +169,18 @@ def _inventory(memory: Path, runtime, source: ActorContext, destination_id: str)
             if len(raw) > MAX_DOCUMENT_BYTES or size > MAX_SCAN_BYTES:
                 raise IdentityTransferError("ownership inventory exceeds its byte limit; retain the current identity")
             before = raw.decode("utf-8")
-            fields, _ = split_frontmatter(before)
+            try:
+                fields, _ = split_frontmatter(before)
+            except ValueError as error:
+                # A malformed legacy or test document outside the transfer
+                # contract must not block identity reconciliation. If it names
+                # the current owner, fail closed so ownership is never left
+                # half-transferred.
+                if _malformed_transfer_candidate(before, source.actor.actor_id):
+                    raise IdentityTransferError(
+                        f"ownership inventory cannot parse {relative}: {error}"
+                    ) from error
+                continue
             if (fields.get("org") or fields.get("org_id")) not in {None, source.profile.org_id}:
                 continue
             if _changed_fields(fields, source.actor.actor_id, destination_id):

package/runtime/prime/egregore_runtime/identity_transfer.py

@@ -11,6 +11,7 @@ from dataclasses import replace
 import hashlib
 import json
 import os
+import re
 from pathlib import Path, PurePosixPath
 import tempfile
 from typing import Any, Mapping
@@ -101,6 +102,26 @@ def _changed_fields(fields: Mapping[str, Any], source_id: str, destination_id: s
     return updates
 
 
+def _malformed_transfer_candidate(markdown: str, source_id: str) -> bool:
+    """Identify an invalid document that could still require ownership transfer.
+
+    Existing memory can contain old or adversarial Markdown that is not a valid
+    Runtime artifact. Identity reconciliation must not fail because an unrelated
+    document is malformed, but it must fail closed when that document explicitly
+    names the current actor as a transferable owner.
+    """
+
+    if not source_id:
+        return False
+    actor = re.escape(source_id)
+    question = re.search(r"(?m)^type:\s*[\"']?question[\"']?\s*$", markdown)
+    recipient = re.search(rf"(?m)^to_actor_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    thread = re.search(r"(?m)^type:\s*[\"']?thread[\"']?\s*$", markdown)
+    steward = re.search(rf"(?m)^steward_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    stewards = re.search(rf"(?m)^steward_ids:\s*.*\b{actor}\b", markdown)
+    return bool((question and recipient) or (thread and (steward or stewards)))
+
+
 def _document(before: str, path: str, pair: Mapping[str, Any], transfer_id: str):
     fields, _ = split_frontmatter(before)
     updates = _changed_fields(fields, pair["source"]["actor_id"], pair["destination"]["actor_id"])
@@ -148,7 +169,18 @@ def _inventory(memory: Path, runtime, source: ActorContext, destination_id: str)
             if len(raw) > MAX_DOCUMENT_BYTES or size > MAX_SCAN_BYTES:
                 raise IdentityTransferError("ownership inventory exceeds its byte limit; retain the current identity")
             before = raw.decode("utf-8")
-            fields, _ = split_frontmatter(before)
+            try:
+                fields, _ = split_frontmatter(before)
+            except ValueError as error:
+                # A malformed legacy or test document outside the transfer
+                # contract must not block identity reconciliation. If it names
+                # the current owner, fail closed so ownership is never left
+                # half-transferred.
+                if _malformed_transfer_candidate(before, source.actor.actor_id):
+                    raise IdentityTransferError(
+                        f"ownership inventory cannot parse {relative}: {error}"
+                    ) from error
+                continue
             if (fields.get("org") or fields.get("org_id")) not in {None, source.profile.org_id}:
                 continue
             if _changed_fields(fields, source.actor.actor_id, destination_id):