create-egregore 0.21.4 → 0.21.6

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.4
+// egregore-launcher-version: 0.21.6
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.4";
+const VERSION = "0.21.6";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -46,10 +46,72 @@ const UPDATE_REGISTRY_URL =
 const UPDATE_AVAILABLE_CACHE_TTL_MS = 6 * 60 * 60 * 1000;
 const UPDATE_FAILURE_CACHE_TTL_MS = 5 * 60 * 1000;
 const UPDATE_CHECK_TIMEOUT_MS = 1500;
-const CONNECT_API_URL = (
-  process.env.EGREGORE_CONNECT_API_URL ||
-  "https://egregore-production-55f2.up.railway.app"
-).replace(/\/+$/, "");
+// Hosted API address. The API moved to api.egregore.xyz after the October 2026
+// security reset; its old origin is retired and must never receive a token or
+// key, even from an egregore.json or environment saved before the move. The
+// launcher is installed standalone, so this is an inline copy of
+// lib/hosted-api.js; test/hosted-api.test.js holds the two in step and both
+// to the rule in bin/tests/fixtures/hosted-api-url-vectors.json.
+const HOSTED_API_ORIGIN = "https://api.egregore.xyz";
+const RETIRED_API_ORIGIN = "https://egregore-production-55f2.up.railway.app";
+const RETIRED_API_HOST = RETIRED_API_ORIGIN.slice("https://".length);
+const REFUSED_API_ADDRESS_NOTICE = "The hosted services address isn't a plain web address, so nothing was sent. "
+  + `Correct api_url in egregore.json; the hosted address is ${HOSTED_API_ORIGIN}.`;
+// A plain web address: http or https, an ASCII host of letters, digits, dots,
+// hyphens and underscores, an optional port and a plain path. Every transport
+// reads it the same way. Anything else is refused: curl, urllib and WHATWG
+// parsers disagree about where userinfo, backslashes, percent-encoding, glob
+// characters, queries, whitespace or non-ASCII send a request.
+const PLAIN_API_URL = /^https?:\/\/([A-Za-z0-9._-]+)(:[0-9]{1,5})?(\/[A-Za-z0-9._~/-]*)?$/;
+
+// Thrown for a refused address; callers send nothing.
+class RefusedApiAddressError extends Error {
+  constructor() {
+    super(REFUSED_API_ADDRESS_NOTICE);
+    this.name = "RefusedApiAddressError";
+    this.code = "EGREGORE_REFUSED_API_ADDRESS";
+  }
+}
+
+// The saved text without surrounding ASCII whitespace.
+function apiUrlText(value) {
+  const text = value === null || value === undefined ? "" : String(value);
+  return text.replace(/^[ \t\n\r\f\v]+|[ \t\n\r\f\v]+$/g, "");
+}
+
+// The plain address's host and path, the host flagged when it is the retired
+// one (case and trailing dots ignored), or null when the text is not plain.
+function plainApiUrl(text) {
+  const plain = PLAIN_API_URL.exec(text);
+  if (!plain) return null;
+  return { retired: plain[1].toLowerCase().replace(/\.+$/, "") === RETIRED_API_HOST, path: plain[3] || "" };
+}
+
+// True when the address is a plain address on the retired origin.
+function retiredApiUrl(value) {
+  const plain = plainApiUrl(apiUrlText(value));
+  return plain !== null && plain.retired;
+}
+
+// The address to send requests to, trailing slashes trimmed: a plain retired
+// address becomes the hosted API with its path kept; any other plain address
+// keeps its text; empty stays empty. Anything else throws
+// RefusedApiAddressError, whose message says why, and nothing is sent.
+function hostedApiUrl(value) {
+  const text = apiUrlText(value);
+  if (!text) return "";
+  const plain = plainApiUrl(text);
+  if (plain === null) throw new RefusedApiAddressError();
+  return (plain.retired ? HOSTED_API_ORIGIN + plain.path : text).replace(/\/+$/, "");
+}
+
+const CONNECT_API_URL = (() => {
+  // A refused override leaves no address, so connectedApiRequest sends nothing.
+  try { return hostedApiUrl(process.env.EGREGORE_CONNECT_API_URL || HOSTED_API_ORIGIN); } catch (error) {
+    if (error instanceof RefusedApiAddressError) return "";
+    throw error;
+  }
+})();
 
 const NATIVE_CODEX_SKILLS = [
   "activity",
@@ -1482,7 +1544,7 @@ function githubRequest(token, method, apiPath, body) {
 }
 
 function apiRequest(apiUrl, apiKey, apiPath, body) {
-  const url = new URL(apiPath, apiUrl.replace(/\/+$/, "") + "/");
+  const url = new URL(apiPath, hostedApiUrl(apiUrl) + "/");
   return requestJson({
     hostname: url.hostname,
     port: url.port || undefined,
@@ -1494,6 +1556,7 @@ function apiRequest(apiUrl, apiKey, apiPath, body) {
 }
 
 function connectedApiRequest(githubToken, method, apiPath, body, headers = {}) {
+  if (!CONNECT_API_URL) return Promise.reject(new RefusedApiAddressError());
   const url = new URL(apiPath, CONNECT_API_URL + "/");
   return requestJson({
     hostname: url.hostname,
@@ -1652,8 +1715,14 @@ function adapterErrorText(detail) {
 
 function connectError(result, fallback) {
   if (!result) return fallback;
+  // Unavailability says nothing about the person's credentials, and an edge
+  // or proxy page (HTML or plain text) is never printed raw.
+  if ([502, 503, 504].includes(result.status)) {
+    return "Egregore's hosted services are temporarily unavailable. Local memory and search still work.";
+  }
   const data = result.data || {};
-  return adapterErrorText(data.detail || data.message || (typeof data === "string" ? data : fallback));
+  if (typeof data === "string") return fallback;
+  return adapterErrorText(data.detail || data.message || fallback);
 }
 
 function sleep(ms) {
@@ -1716,7 +1785,12 @@ function validatedConnectedClaim(config, response, expectedOrgIds = []) {
       typeof response?.api_key !== "string" || !response.api_key.trim()) {
     die("Connected did not return usable access settings. Local configuration is unchanged; run the same command to retry.");
   }
-  return { orgId, apiUrl: response.api_url, apiKey: response.api_key };
+  let apiUrl = "";
+  try { apiUrl = hostedApiUrl(response.api_url); } catch (error) {
+    if (!(error instanceof RefusedApiAddressError)) throw error;
+    die("Connected returned an address that isn't a plain web address. Local configuration is unchanged, and nothing was sent with its key.");
+  }
+  return { orgId, apiUrl, apiKey: response.api_key };
 }
 
 function hostedMemorySyncEnabled(config) {
@@ -1893,10 +1967,10 @@ async function cmdConnect(args) {
     !intentId ||
     !resumable
   ) {
-    // Local installs may have skipped platform registration (DO_NOT_TRACK
-    // gates it as telemetry). Connect requires it functionally, and choosing
-    // Connect is the consent — register on demand. Idempotent for members of
-    // already-registered orgs. Identity conflicts must stop before checkout.
+    // Local installs never register with the platform. Connect requires it
+    // functionally, and choosing Connect is the consent — register on demand.
+    // Idempotent for members of already-registered orgs. Identity conflicts
+    // must stop before checkout.
     const registration = await connectedApiRequest(githubToken, "POST", "/api/org/register", {
       org_name: cfg.org_name || inst.slug,
       github_org: cfg.github_org || "",
@@ -2239,7 +2313,7 @@ function tryNotifyInvite(inst, username, message, cfg, env) {
 }
 
 async function connectedInvite(inst, username, cfg, env) {
-  const apiUrl = cfg.api_url || "";
+  const apiUrl = hostedApiUrl(cfg.api_url);
   const apiKey = env.EGREGORE_API_KEY || "";
   const ghToken = env.GITHUB_TOKEN || "";
   if (!apiUrl || !apiKey || !ghToken) return null;

package/bin/cli.js

@@ -18,6 +18,7 @@ const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 const ui = require("../lib/ui");
 const { EgregoreAPI } = require("../lib/api");
+const { HOSTED_API_ORIGIN, hostedApiUrl } = require("../lib/hosted-api");
 const {
   canUseInteractiveBrowserFlow,
   deviceFlow,
@@ -40,7 +41,9 @@ const {
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
 const { commandExists } = require("../lib/path-lookup");
 
-const API_URL = process.env.EGREGORE_API_URL || "https://egregore-production-55f2.up.railway.app";
+// Resolved when a hosted flow starts, so a refused EGREGORE_API_URL stops
+// that flow with the reason and never falls back to another address.
+function hostedApiSetting() { return hostedApiUrl(process.env.EGREGORE_API_URL || HOSTED_API_ORIGIN); }
 const INSTANCES_FILE = path.join(os.homedir(), ".egregore", "instances.json");
 
 function readLocalInstances() {
@@ -605,7 +608,7 @@ async function main() {
 
   if (args.token) {
     // ===== Connected mode: token provided =====
-    const api = new EgregoreAPI(args.api || API_URL);
+    const api = new EgregoreAPI(args.api || hostedApiSetting());
     await tokenFlow(api, args.token, ctx);
   } else if (args.subcommand === "join") {
     // ===== Local mode: join existing =====
@@ -617,7 +620,7 @@ async function main() {
     await localJoinFlow(args.joinOrg, ui, ctx);
   } else if (args.connected) {
     // ===== Connected/hosted interactive flow (explicit opt-in) =====
-    const api = new EgregoreAPI(args.api || API_URL);
+    const api = new EgregoreAPI(args.api || hostedApiSetting());
     await interactiveFlow(api, ctx);
   } else {
     // ===== Local founder is the DEFAULT — bare `npx create-egregore` and

package/lib/api.js

@@ -5,8 +5,22 @@
 
 const https = require("node:https");
 const { URL } = require("node:url");
-
-const DEFAULT_API = "https://egregore-production-55f2.up.railway.app";
+const { HOSTED_API_ORIGIN, hostedApiUrl } = require("./hosted-api");
+
+const UNAVAILABLE =
+  "Egregore's hosted services are temporarily unavailable. Local memory and search still work.";
+
+// A failed response becomes one short line. Proxy and edge pages are HTML or
+// plain text, so a body that is not JSON is never shown to the person.
+function responseError(statusCode, data) {
+  if ([502, 503, 504].includes(statusCode)) return new Error(UNAVAILABLE);
+  let detail = "";
+  try {
+    const json = JSON.parse(data);
+    if (json && typeof json.detail === "string") detail = json.detail;
+  } catch {}
+  return new Error(detail || `HTTP ${statusCode}`);
+}
 
 function request(method, url, { body, headers = {}, timeout = 30000 } = {}) {
   return new Promise((resolve, reject) => {
@@ -28,19 +42,14 @@ function request(method, url, { body, headers = {}, timeout = 30000 } = {}) {
       let data = "";
       res.on("data", (chunk) => (data += chunk));
       res.on("end", () => {
+        if (res.statusCode >= 400) {
+          reject(responseError(res.statusCode, data));
+          return;
+        }
         try {
-          const json = JSON.parse(data);
-          if (res.statusCode >= 400) {
-            reject(new Error(json.detail || `HTTP ${res.statusCode}`));
-          } else {
-            resolve(json);
-          }
+          resolve(JSON.parse(data));
         } catch {
-          if (res.statusCode >= 400) {
-            reject(new Error(`HTTP ${res.statusCode}: ${data}`));
-          } else {
-            resolve(data);
-          }
+          resolve(data);
         }
       });
     });
@@ -60,7 +69,9 @@ function request(method, url, { body, headers = {}, timeout = 30000 } = {}) {
 
 class EgregoreAPI {
   constructor(baseUrl) {
-    this.base = (baseUrl || DEFAULT_API).replace(/\/$/, "");
+    // A retired address (an old --api or EGREGORE_API_URL) never receives the
+    // GitHub token these calls carry.
+    this.base = hostedApiUrl(baseUrl || HOSTED_API_ORIGIN);
   }
 
   async claimToken(token, githubToken) {
@@ -99,13 +110,6 @@ class EgregoreAPI {
     });
   }
 
-  async registerOrg(githubToken, { org_name, github_org, slug, flow_variant, org_id, repo_name }) {
-    return request("POST", `${this.base}/api/org/register`, {
-      headers: { Authorization: `Bearer ${githubToken}` },
-      body: { org_name, github_org, slug, ...(org_id ? { org_id } : {}), ...(repo_name ? { repo_name } : {}), ...(flow_variant ? { flow_variant } : {}) },
-    });
-  }
-
   async exchangeCode(code) {
     return request("POST", `${this.base}/api/auth/github/callback`, {
       body: { code },
@@ -117,4 +121,4 @@ class EgregoreAPI {
   }
 }
 
-module.exports = { EgregoreAPI, request };
+module.exports = { EgregoreAPI, request, responseError, UNAVAILABLE };

package/lib/connect-runtime.js

@@ -8,6 +8,7 @@ const path = require("node:path");
 const { URL } = require("node:url");
 
 const PACKAGE = require("../package.json");
+const { RefusedApiAddressError, hostedApiUrl } = require("./hosted-api");
 const LOCAL_MANIFEST = path.join(".egregore", "connect-runtime-manifest.json");
 const PACK_PATH = "/api/runtime/connect-pack";
 const MAX_PACK_BYTES = 12 * 1024 * 1024;
@@ -63,12 +64,14 @@ function connectCredentials(egregoreDir) {
   }
   const apiKey = readApiKey(egregoreDir);
   if (!apiKey) return { eligible: false, reason: "missing-api-key" };
-  return {
-    eligible: true,
-    reason: "connected",
-    apiUrl: String(config.api_url).replace(/\/$/, ""),
-    apiKey,
-  };
+  // An address saved before the October 2026 reset never receives the key,
+  // and one that is not plain is refused: nothing is sent.
+  let apiUrl;
+  try { apiUrl = hostedApiUrl(config.api_url); } catch (error) {
+    if (error instanceof RefusedApiAddressError) return { eligible: false, reason: "refused-address" };
+    throw error;
+  }
+  return { eligible: true, reason: "connected", apiUrl, apiKey };
 }
 
 function connectEligibility(egregoreDir) {
@@ -152,8 +155,10 @@ function validateConnectPack(pack) {
 function requestConnectPack(apiUrl, apiKey, timeout = 30000) {
   return new Promise((resolve, reject) => {
     let parsed;
-    try { parsed = new URL(`${apiUrl}${PACK_PATH}`); }
-    catch { reject(new Error("Connected instance has an invalid API URL")); return; }
+    try { parsed = new URL(`${hostedApiUrl(apiUrl)}${PACK_PATH}`); } catch (error) {
+      reject(error instanceof RefusedApiAddressError ? error : new Error("Connected instance has an invalid API URL"));
+      return;
+    }
     const transport = parsed.protocol === "http:" ? http : https;
     const request = transport.request(parsed, {
       method: "GET",

package/lib/hosted-api.js

@@ -0,0 +1,70 @@
+"use strict";
+
+// The hosted API moved to api.egregore.xyz after the October 2026 security
+// reset. Its old Railway origin is retired and no longer ours to trust: a
+// token or key sent there could reach whoever holds that address next. Every
+// request that carries a credential resolves its address here, so an
+// egregore.json or environment saved before the move never reaches it.
+//
+// The rule and the table every resolver follows:
+// bin/tests/fixtures/hosted-api-url-vectors.json. The launcher
+// (assets/egregore-launcher.js) is installed standalone and carries an inline
+// copy of the code below, and bin/connector-google/src/hosted-api.ts a typed
+// one; test/hosted-api.test.js holds all three to the table and to each other.
+
+const HOSTED_API_ORIGIN = "https://api.egregore.xyz";
+const RETIRED_API_ORIGIN = "https://egregore-production-55f2.up.railway.app";
+const RETIRED_API_HOST = RETIRED_API_ORIGIN.slice("https://".length);
+const REFUSED_API_ADDRESS_NOTICE = "The hosted services address isn't a plain web address, so nothing was sent. "
+  + `Correct api_url in egregore.json; the hosted address is ${HOSTED_API_ORIGIN}.`;
+// A plain web address: http or https, an ASCII host of letters, digits, dots,
+// hyphens and underscores, an optional port and a plain path. Every transport
+// reads it the same way. Anything else is refused: curl, urllib and WHATWG
+// parsers disagree about where userinfo, backslashes, percent-encoding, glob
+// characters, queries, whitespace or non-ASCII send a request.
+const PLAIN_API_URL = /^https?:\/\/([A-Za-z0-9._-]+)(:[0-9]{1,5})?(\/[A-Za-z0-9._~/-]*)?$/;
+
+// Thrown for a refused address; callers send nothing.
+class RefusedApiAddressError extends Error {
+  constructor() {
+    super(REFUSED_API_ADDRESS_NOTICE);
+    this.name = "RefusedApiAddressError";
+    this.code = "EGREGORE_REFUSED_API_ADDRESS";
+  }
+}
+
+// The saved text without surrounding ASCII whitespace.
+function apiUrlText(value) {
+  const text = value === null || value === undefined ? "" : String(value);
+  return text.replace(/^[ \t\n\r\f\v]+|[ \t\n\r\f\v]+$/g, "");
+}
+
+// The plain address's host and path, the host flagged when it is the retired
+// one (case and trailing dots ignored), or null when the text is not plain.
+function plainApiUrl(text) {
+  const plain = PLAIN_API_URL.exec(text);
+  if (!plain) return null;
+  return { retired: plain[1].toLowerCase().replace(/\.+$/, "") === RETIRED_API_HOST, path: plain[3] || "" };
+}
+
+// True when the address is a plain address on the retired origin.
+function retiredApiUrl(value) {
+  const plain = plainApiUrl(apiUrlText(value));
+  return plain !== null && plain.retired;
+}
+
+// The address to send requests to, trailing slashes trimmed: a plain retired
+// address becomes the hosted API with its path kept; any other plain address
+// keeps its text; empty stays empty. Anything else throws
+// RefusedApiAddressError, whose message says why, and nothing is sent.
+function hostedApiUrl(value) {
+  const text = apiUrlText(value);
+  if (!text) return "";
+  const plain = plainApiUrl(text);
+  if (plain === null) throw new RefusedApiAddressError();
+  return (plain.retired ? HOSTED_API_ORIGIN + plain.path : text).replace(/\/+$/, "");
+}
+
+module.exports = {
+  HOSTED_API_ORIGIN, RETIRED_API_ORIGIN, REFUSED_API_ADDRESS_NOTICE, RefusedApiAddressError, retiredApiUrl, hostedApiUrl,
+};

package/lib/local.js

@@ -35,7 +35,6 @@ const {
   ensureInstallerMemberRole,
   run,
 } = require("./setup");
-const { EgregoreAPI } = require("./api");
 const { joinCommand } = require("./commands");
 
 // Template repo for new egregore instances (OSS)
@@ -1157,8 +1156,6 @@ async function localFounderFlow(ui, ctx = {}) {
     base_branch: "main",
     repos: selectedRepos,
     upstream_url: "https://github.com/egregore-labs/egregore.git",
-    report_url: "https://xgksfrirtdumacvmfkzj.supabase.co",
-    report_key: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Inhna3NmcmlydGR1bWFjdm1ma3pqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5OTA1ODksImV4cCI6MjA4NjU2NjU4OX0.1UWNgER6nQazrayly1KDrswClURUkGKxeirZg5L8uk4",
   });
   // Joiners resolve the org by reading egregore.json from the remote — if
   // this push silently fails (observed: transient failure right after
@@ -1179,20 +1176,9 @@ async function localFounderFlow(ui, ctx = {}) {
     ui.info(`  Re-run this installer to retry, or push egregore.json from the cloned repo.`);
   }
 
-  // 8b. Register org with Egregore API (non-blocking — local mode works without it)
-  //     Respects DO_NOT_TRACK (https://consult.gov.uk/digital-communications/online-advertising/supporting_documents/DNT%20standard%20v10.pdf)
-  if (!process.env.DO_NOT_TRACK && !process.env.EGREGORE_NO_TELEMETRY) {
-    try {
-      const api = new EgregoreAPI();
-      await api.registerOrg(githubToken, {
-        org_name: orgName,
-        github_org: githubOrg,
-        slug,
-        org_id: egreConfig.org_id,
-        repo_name: repoName,
-      });
-    } catch {}
-  }
+  // A Local install registers nothing with a hosted service. The GitHub token
+  // goes to GitHub only; `egregore connect` registers the organization when a
+  // person explicitly chooses Connected.
 
   // 9. Init memory dirs on remote (so joiners get the structure)
   const memDirs = ["people", "identity", "invites", "handoffs", "knowledge/questions", "knowledge/decisions", "knowledge/patterns", "knowledge/findings", "quests", "wraps"];

package/lib/setup.js

@@ -8,6 +8,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const os = require("node:os");
 const { runRendererInstaller } = require("./renderer-install");
+const { RefusedApiAddressError, hostedApiUrl } = require("./hosted-api");
 const {
   hasCodexRuntimeSupport,
   installCodexRuntime,
@@ -849,7 +850,11 @@ function ensureConnectedConfig(repoDir, data, ui) {
   }
 
   let changed = false;
-  const tokenApiUrl = data.api_url ? String(data.api_url).replace(/\/$/, "") : "";
+  let tokenApiUrl = "";
+  try { tokenApiUrl = data.api_url ? hostedApiUrl(data.api_url) : ""; } catch (error) {
+    if (!(error instanceof RefusedApiAddressError)) throw error;
+    throw new Error("Connected setup returned an address that isn't a plain web address; egregore.json is unchanged.");
+  }
   if (tokenApiUrl && config.api_url !== tokenApiUrl) {
     config.api_url = tokenApiUrl;
     changed = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.4",
+  "version": "0.21.6",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -19,7 +19,7 @@
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "npm run test:runtime && node --test test/",
     "test:runtime": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-claude-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && bash ../../bin/tests/test-codex-native-skills.sh && bash ../../bin/tests/test-codex-spec-render.sh && node ../../bin/capability-distribution.mjs skill-contract --root ../.. --strict-contract && bash ../../bin/tests/test-bundle-skill-scripts.sh && node --test test/bundle-skill-scripts.test.js",
-    "test:package": "node --test --test-concurrency=1 test/invite-install.test.js test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/native-command-observe.test.js test/prime-rpc-driver.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-ownership.test.js test/installer-finalization.test.js test/renderer-install.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-runtime-candidate.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/harness-add.test.js test/connected-config.test.js test/workflow-settings.test.js"
+    "test:package": "node --test --test-concurrency=1 test/invite-install.test.js test/capability-distribution.test.js test/connect-runtime.test.js test/hosted-api.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/native-command-observe.test.js test/prime-rpc-driver.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-ownership.test.js test/installer-finalization.test.js test/renderer-install.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-runtime-candidate.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/harness-add.test.js test/connected-config.test.js test/workflow-settings.test.js"
   },
   "files": [
     "bin/",

package/runtime/claude/.claude/context/telemetry.md

@@ -162,21 +162,11 @@ can explicitly choose a public upstream report. An internal issue stays within
 its organization's memory or configured tracker; it does not automatically
 reach Egregore support. `/wrap` does not collect or submit session feedback.
 
-The older `bin/session-report.sh` is a feedback-storage compatibility helper,
-not a support-reporting route. It inserts selected feedback into `session_reports`
-when `report_url` and `report_key` are configured. A `submitted` receipt means
-only that storage accepted the feedback: no GitHub issue was created and no
-Telegram message was sent. The authenticated database callback acknowledges
-storage without planning or dispatching a notification to a named teammate.
-Transport failure saves feedback locally under `~/.egregore/reports/`; that
-does not establish remote storage or delivery. Missing configuration skips
-submission.
-
-Never invoke legacy feedback automatically, generate it from a transcript, or
-use it as a fallback when private support fails. Only explicitly selected and
-reviewed content may be shared. The helper adds legacy user and organization
-labels; it does not guarantee anonymization or scrub arbitrary input.
-
-Legacy feedback can be disabled with `EGREGORE_NO_REPORTS=1` or
-`DO_NOT_TRACK=1` in the process environment, or `"session_reports": false` in
-`.egregore-state.json`. These switches do not grant consent to submit content.
+Anonymous session feedback is retired. `bin/session-report.sh` remains only as
+a compatibility notice: it never reads the submitted content, sends a request,
+or saves a report. Old `report_url` and `report_key` configuration fields are
+ignored. Existing local feedback files are left untouched.
+
+Never invoke legacy feedback automatically or use it as a fallback when private
+support fails. Use the reviewed issue workflow above; private support retains
+its authenticated organization identity and exact preview/confirmation boundary.

package/runtime/claude/.claude/skills/emissary/SKILL.md

@@ -206,7 +206,7 @@ Below the box, one line:
 [open emissary →]({url})
 ```
 
-Share the bare page link — not a `/raw` URL or a "Run this … packet" prompt. With the emissary skill installed, pasting the link is enough; this de-alarmed handover (see the data-room variant-A flow in `bin/build-sealed-dataroom.mjs`) avoids tripping a recipient agent's prompt-injection alarms.
+Share the bare page link — not a `/raw` URL or a "Run this … packet" prompt. With the emissary skill installed, pasting the link is enough; this de-alarmed handover avoids tripping a recipient agent's prompt-injection alarms.
 
 If natural, add one short sentence of sign-off — what the recipient should do next, or "shared publicly — anyone with the link can run it."
 

package/runtime/claude/.claude/skills/telemetry/SKILL.md

@@ -86,9 +86,9 @@ command containing its one-time token. A changed target, changed buffer,
 expired token, or bad token requires a new proposal. Local events remain after
 a successful share.
 
-Local instances have no default outbound sink. They may export, name an
-explicit endpoint, or explicitly opt into the legacy public relay with
-`--legacy-public-relay`; never select that relay automatically.
+Local instances have no default outbound sink. They may export or name an
+explicit endpoint. The former public relay is retired: `--legacy-public-relay`
+now refuses and sends nothing.
 
 ### clear
 

package/runtime/claude/.claude/skills/update/SKILL.md

@@ -137,32 +137,6 @@ if [ '{in_worktree}' = "true" ]; then
 fi
 ```
 
-If `{in_worktree}` is `true`, review the changes and continue the worktree update:
-
-```bash
-if [ '{in_worktree}' = "true" ]; then
-  # Show what changed
-  git -C '{main_dir}' diff --stat HEAD
-
-  # Commit on base branch in main repo (.codex/skills/ carries the
-  # regenerated adapters)
-  git -C '{main_dir}' add -A .claude/ .pi/ .prime/ bin/ loom/ CLAUDE.md skills/ AGENTS.md .codex/spec-manifest.json .codex/skills/ 2>/dev/null
-  if ! git -C '{main_dir}' diff --cached --quiet 2>/dev/null; then
-    EGREGORE_FRAMEWORK_UPDATE=1 git -C '{main_dir}' commit -m "Update Egregore framework from upstream"
-    git -C '{main_dir}' push origin '{base}' --quiet 2>/dev/null || true
-  fi
-
-  # Rebase worktree branch onto updated base
-  git stash --quiet 2>/dev/null || true
-  git fetch origin '{base}' --quiet
-  if ! git rebase 'origin/{base}' --quiet 2>/dev/null; then
-    git rebase --abort 2>/dev/null || true
-    echo '⚠ Rebase had conflicts — aborted. Run: git rebase origin/{base} and resolve manually.'
-  fi
-  git stash pop --quiet 2>/dev/null || true
-fi
-```
-
 ### Non-worktree path
 
 If `{in_worktree}` is `false`, use `false` as `{switched}` initially.
@@ -219,30 +193,70 @@ if [ '{in_worktree}' = "false" ]; then
 fi
 ```
 
-**Framework paths synced:** `bin/`, `.claude/commands/`, `.claude/skills/`, `.claude/hooks/`, `.claude/context/`, `.claude/agents/`, `.pi/`, `.prime/`, `loom/`, `CLAUDE.md`, `skills/`
+**Framework paths synced:** `bin/`, `egregore_runtime/`, `.claude/commands/`, `.claude/skills/`, `.claude/hooks/`, `.claude/context/`, `.claude/agents/`, `.pi/`, `.prime/`, `loom/`, `CLAUDE.md`, `skills/`
 **Regenerated:** `AGENTS.md` + `.codex/spec-manifest.json` via `bin/codex-render-spec.mjs`, `.pi/APPEND_SYSTEM.md` + `.pi/spec-manifest.json` via `bin/pi-render-spec.mjs`, `.prime/agent/APPEND_SYSTEM.md` + `.prime/agent/spec-manifest.json` via `bin/prime-render-spec.mjs`, then generated Codex adapter skills via `bin/codex-sync-skills.sh`, so all derived harnesses stay aligned with `CLAUDE.md` and the canonical skills.
 **Never touched:** `egregore.json`, `.env`, `memory/`, `.egregore-state.json`, `.mcp.json`
 **Org-owned skills:** names in `egregore.json` → `owned_skills[]` are restored from the org's committed state after the overlay (`bin/restore-owned-skills.sh`) — upstream never overwrites them; collisions are reported instead.
 
 ## Step 3: Post-update migrations
 
-After syncing, run `bin/post-update.sh` if it exists. In worktrees, run from `{main_dir}` to ensure the updated version executes even if the rebase didn't complete.
+After syncing, run the updated `bin/post-update.sh` before committing or rebasing.
+The first update through an older overlay can add the missing Runtime core here.
+In worktrees, run in `{main_dir}` so migrations affect the main checkout.
+Stop on migration failure; do not commit or rebase a partial update.
 
 ```bash
 if [ '{in_worktree}' = "true" ]; then
-  [ -x '{main_dir}/bin/post-update.sh' ] && bash '{main_dir}/bin/post-update.sh'
+  if [ -f '{main_dir}/bin/post-update.sh' ]; then
+    (cd '{main_dir}' && bash bin/post-update.sh) || exit 1
+  fi
 else
-  [ -x bin/post-update.sh ] && bash bin/post-update.sh
+  if [ -f bin/post-update.sh ]; then
+    bash bin/post-update.sh || exit 1
+  fi
 fi
 ```
 
-## Step 4: Commit and switch back (non-worktree only)
+## Step 4: Commit and restore the working branch
+
+If `{upstream_url}` is `none`, skip this step and continue with Step 5; no
+framework overlay was applied. Otherwise, commit the overlay and migrations
+together before the working branch receives the update.
+
+If `{in_worktree}` is `true`, review the changes and continue the worktree update:
+
+```bash
+if [ '{in_worktree}' = "true" ]; then
+  # Show what changed
+  git -C '{main_dir}' diff --stat HEAD
+
+  # Commit on base branch in main repo (.codex/skills/ carries the
+  # regenerated adapters)
+  git -C '{main_dir}' add -A .claude/ .pi/ .prime/ bin/ loom/ CLAUDE.md skills/ AGENTS.md .codex/spec-manifest.json .codex/skills/ 2>/dev/null
+  # Older upstreams lack the Runtime core; a missing pathspec would abort the add.
+  [ ! -e '{main_dir}/egregore_runtime' ] || git -C '{main_dir}' add -A -- egregore_runtime/ 2>/dev/null
+  if ! git -C '{main_dir}' diff --cached --quiet 2>/dev/null; then
+    EGREGORE_FRAMEWORK_UPDATE=1 git -C '{main_dir}' commit -m "Update Egregore framework from upstream"
+    git -C '{main_dir}' push origin '{base}' --quiet 2>/dev/null || true
+  fi
+
+  # Rebase worktree branch onto updated base
+  git stash --quiet 2>/dev/null || true
+  git fetch origin '{base}' --quiet
+  if ! git rebase 'origin/{base}' --quiet 2>/dev/null; then
+    git rebase --abort 2>/dev/null || true
+    echo '⚠ Rebase had conflicts — aborted. Run: git rebase origin/{base} and resolve manually.'
+  fi
+  git stash pop --quiet 2>/dev/null || true
+fi
+```
 
-Worktree path already committed in Step 2. This handles the non-worktree case:
+For the non-worktree case:
 
 ```bash
 if [ '{in_worktree}' = "false" ]; then
   git add -A .claude/ .pi/ .prime/ bin/ loom/ CLAUDE.md skills/ AGENTS.md .codex/spec-manifest.json 2>/dev/null
+  [ ! -e egregore_runtime ] || git add -A -- egregore_runtime/ 2>/dev/null
   if ! git diff --cached --quiet 2>/dev/null; then
     EGREGORE_FRAMEWORK_UPDATE=1 git commit -m "Update Egregore framework from upstream"
     git push origin '{base}' --quiet 2>/dev/null || true