create-egregore 0.21.6 → 0.22.0

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.6
+// egregore-launcher-version: 0.22.0
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.6";
+const VERSION = "0.22.0";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -113,6 +113,31 @@ const CONNECT_API_URL = (() => {
   }
 })();
 
+// Release-delivered snapshot. This adds no remote feed, telemetry, credential
+// repair, or reconnect action. The shared shell footer has parity tests.
+function hostedRecoveryNotice(apiUrl, now = Date.now()) {
+  if (!["https://api.egregore.xyz", "https://egregore-production-55f2.up.railway.app"]
+    .some(origin => apiUrl === origin || apiUrl === `${origin}/`)) return [];
+  const current = Number.isFinite(now) && now >= 1792627200000 && now < 1792800000000;
+  return [
+    current ? "◐ Service recovery · 22 Oct 2026" : "◐ Service recovery · last update 22 Oct 2026",
+    ...(current ? [
+      "Some connected services are temporarily unavailable",
+      "during security recovery.",
+    ] : [
+      "Some connected services were unavailable at this update.",
+      "Current hosted availability has not been checked.",
+    ]),
+    "Local memory and search remain available.",
+    "Keep your existing Egregore; you do not need to set it up again.",
+  ];
+}
+
+function instanceRecoveryNotice(instancePath) {
+  const config = readJsonFile(path.join(instancePath, "egregore.json"));
+  return config.mode === "connected" ? hostedRecoveryNotice(config.api_url) : [];
+}
+
 const NATIVE_CODEX_SKILLS = [
   "activity",
   "handoff",
@@ -998,11 +1023,26 @@ function installCodexSkills(egregoreDir) {
   }
 }
 
+// The SessionStart hook shows the startup card itself (bin/lib/card-delivery.sh),
+// so Claude opens straight to the card and the prompt. Submit `start` only when
+// the first screen still needs a model turn: onboarding is pending, or the
+// instance's framework (or a missing jq) still hands the card to the model as
+// text to display. Mirrors bin/session-start.sh: no state file, or one it cannot
+// read, counts as onboarded.
+function claudeNeedsStartPrompt(egregoreDir) {
+  if (!fs.existsSync(path.join(egregoreDir, "bin", "lib", "card-delivery.sh"))) return true;
+  if (!commandExists("jq")) return true;
+  try {
+    const state = JSON.parse(fs.readFileSync(path.join(egregoreDir, ".egregore-state.json"), "utf-8"));
+    return String(state && state.onboarding_complete) !== "true";
+  } catch {
+    return false;
+  }
+}
+
 function claudeLaunchArgs(egregoreDir) {
-  // Claude treats the positional value as the initial user prompt. Egregore
-  // deliberately submits `start` so the opening experience renders without
-  // requiring the user to type first.
-  const args = ["start"];
+  // Claude treats a positional value as the initial user prompt.
+  const args = claudeNeedsStartPrompt(egregoreDir) ? ["start"] : [];
   const memoryLink = path.join(egregoreDir, "memory");
   try {
     const memoryDir = fs.realpathSync(memoryLink);
@@ -1057,6 +1097,8 @@ async function launch(inst, runtimeOverride) {
   }
   const runtime = await chooseRuntimeForLaunch(inst, runtimeOverride);
   if (!runtime) return;
+  // Also reaches older installed runtime cards after only the launcher updates.
+  for (const line of instanceRecoveryNotice(inst.path)) console.log(`  ${line}`);
   if (runtime === "claude-code" && isLinkedGitWorktree(inst.path)) {
     die(
       "Claude Code automatically removes linked Git worktrees when its worktree session ends.\n" +
@@ -1830,6 +1872,9 @@ async function cmdConnect(args) {
   }
   if (!fs.existsSync(inst.path)) die(`instance path is missing: ${inst.path}`);
 
+  // A Local user explicitly choosing the hosted service needs the same context.
+  for (const line of hostedRecoveryNotice(CONNECT_API_URL)) console.log(`  ${line}`);
+
   const { cfg, state, env } = configForInstance(inst);
   const githubToken = env.GITHUB_TOKEN || "";
   if (!githubToken) {
@@ -3393,6 +3438,10 @@ function renderRuntimePanel({ inst, cursor, width, height }) {
     emptyBoxLine(innerWidth, margin),
   ];
 
+  for (const line of instanceRecoveryNotice(inst.path)) {
+    lines.push(boxLine(line, innerWidth, margin));
+  }
+
   for (let i = 0; i < runtimes.length; i++) {
     const runtime = runtimes[i];
     const selected = i === cursor;
@@ -4048,6 +4097,9 @@ async function browser(args = {}) {
       previewLines.push(pv.connected
         ? `  ${label("mode")} ${CYAN}◆ CONNECTED${RESET} ${DIM}${connectedModeSuffix(selected.path)}${RESET}`
         : `  ${label("mode")} ${DIM}◇ LOCAL · Markdown + Git${RESET}`);
+      for (const line of instanceRecoveryNotice(selected.path).slice(0, 2)) {
+        previewLines.push(`  ${truncate(line, Math.max(16, blockWidth - 4))}`);
+      }
       if (pv.branch) previewLines.push(`  ${label("branch")} ${BOLD}${pv.branch}${RESET}`);
       if (pv.lastCommit) previewLines.push(`  ${label("last")} ${DIM}${truncate(pv.lastCommit, valW)}${RESET}`);
       if (pv.repos && pv.repos.length) {

package/assets/egregore-launcher.sh

@@ -84,6 +84,18 @@ resolve_instance() {
   printf '%s' "$result"
 }
 
+# The SessionStart hook shows the startup card itself (bin/lib/card-delivery.sh),
+# so Claude opens straight to the card and the prompt. Succeeds when the first
+# screen still needs a model turn and `start` should be submitted: onboarding is
+# pending, the framework is older, or jq is missing (the card then reaches the
+# model as text to display). No state file, or an unreadable one, counts as
+# onboarded, as in bin/session-start.sh.
+claude_needs_start_prompt() {
+  [ -f "$1/bin/lib/card-delivery.sh" ] || return 0
+  command -v jq >/dev/null 2>&1 || return 0
+  jq -e '(.onboarding_complete | tostring) != "true"' "$1/.egregore-state.json" >/dev/null 2>&1
+}
+
 launch() {
   local target_path="$1"
   local target_slug="${2:-}"
@@ -93,14 +105,15 @@ launch() {
     printf '  %s→%s launching %s%s%s ...\n\n' "$DIM" "$RESET" "$BOLD" "$target_slug" "$RESET"
   fi
   cd "$target_path" || die "Could not cd into $target_path"
-  local -a claude_args=("start")
+  local -a claude_args=()
+  claude_needs_start_prompt "$target_path" && claude_args=("start")
   if [ -d "$target_path/memory" ]; then
     claude_args+=("--add-dir" "$target_path/memory")
   fi
   # The greeting renders in-chat — no pre-launch card. Claude Code ≥2.1.89
   # boots into the alternate screen buffer, which hides anything printed
   # here; the launcher-card fast path is parked in PR #1493.
-  exec claude "${claude_args[@]}"
+  exec claude ${claude_args[@]+"${claude_args[@]}"}
 }
 
 cmd_ls() {

package/lib/claude-runtime.js

@@ -15,6 +15,8 @@ const REQUIRED_RUNTIME_PATHS = [
   "CLAUDE.md",
   ".claude/settings.json",
   ".claude/hooks/boundary-check.sh",
+  "bin/boundary-hook.sh",
+  "bin/boundary-guard.cjs",
   ".claude/hooks/branch-guard.sh",
   ".claude/skills/activity/SKILL.md",
   "bin/session-start.sh",

package/lib/codex-runtime.js

@@ -16,6 +16,8 @@ const REQUIRED_RUNTIME_PATHS = [
   ".codex/config.toml",
   ".codex/hooks.json",
   ".codex/hooks/branch-guard.js",
+  "bin/boundary-guard.cjs",
+  "bin/boundary-hook.sh",
   ".codex/skills",
   "bin/agent.sh",
   "bin/codex-install-skills.sh",

package/lib/setup.js

@@ -1125,10 +1125,26 @@ function primeTrustArgs() {
   }
 }
 
+// The SessionStart hook shows the startup card itself (bin/lib/card-delivery.sh),
+// so Claude opens straight to the card and the prompt. Submit `start` only when
+// the first screen still needs a model turn: onboarding is pending, or the
+// instance's framework (or a missing jq) still hands the card to the model as
+// text to display. Mirrors bin/session-start.sh: no state file, or one it cannot
+// read, counts as onboarded.
+function claudeNeedsStartPrompt(egregoreDir) {
+  if (!fs.existsSync(path.join(egregoreDir, "bin", "lib", "card-delivery.sh"))) return true;
+  if (!commandExists("jq")) return true;
+  try {
+    const state = JSON.parse(fs.readFileSync(path.join(egregoreDir, ".egregore-state.json"), "utf-8"));
+    return String(state && state.onboarding_complete) !== "true";
+  } catch {
+    return false;
+  }
+}
+
 function claudeLaunchArgs(egregoreDir) {
-  // Submit Egregore's intentional initial prompt so Claude opens directly into
-  // the organization start experience.
-  const args = ["start"];
+  // Claude treats a positional value as the initial user prompt.
+  const args = claudeNeedsStartPrompt(egregoreDir) ? ["start"] : [];
   const memoryLink = path.join(egregoreDir, "memory");
   try {
     const memoryDir = fs.realpathSync(memoryLink);
@@ -1820,6 +1836,7 @@ module.exports = {
   installShellAlias,
   installLauncherBinary,
   launchOrInstruct,
+  claudeLaunchArgs,
   buildOnboardingState,
   initializeOrganizationConfig,
   organizationIdentityDocument,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.6",
+  "version": "0.22.0",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -19,7 +19,7 @@
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "npm run test:runtime && node --test test/",
     "test:runtime": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-claude-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && bash ../../bin/tests/test-codex-native-skills.sh && bash ../../bin/tests/test-codex-spec-render.sh && node ../../bin/capability-distribution.mjs skill-contract --root ../.. --strict-contract && bash ../../bin/tests/test-bundle-skill-scripts.sh && node --test test/bundle-skill-scripts.test.js",
-    "test:package": "node --test --test-concurrency=1 test/invite-install.test.js test/capability-distribution.test.js test/connect-runtime.test.js test/hosted-api.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/native-command-observe.test.js test/prime-rpc-driver.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-ownership.test.js test/installer-finalization.test.js test/renderer-install.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-runtime-candidate.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/harness-add.test.js test/connected-config.test.js test/workflow-settings.test.js"
+    "test:package": "node --test --test-concurrency=1 test/invite-install.test.js test/capability-distribution.test.js test/spirit-discovery-parity.test.js test/connect-runtime.test.js test/hosted-api.test.js test/hosted-api-connector.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/runtime-identity.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/claude-runtime.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/pi-observe-context.test.js test/native-command-observe.test.js test/prime-rpc-driver.test.js test/pi-session-smoke.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/runtime-ownership.test.js test/installer-finalization.test.js test/renderer-install.test.js test/runtime-readiness.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-telemetry.test.js test/launcher-runtime.test.js test/launcher-settings.test.js test/launcher-runtime-candidate.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/harness-add.test.js test/connected-config.test.js test/workflow-settings.test.js"
   },
   "files": [
     "bin/",

package/runtime/claude/.claude/context/commit-format.md

@@ -59,11 +59,14 @@ Egregore-Session: <session id>
 Co-Authored-By: <harness identity>
 ```
 
-- `Egregore-Session` is the id from `.egregore-session-id`. It links
-  the commit to its session in the graph — commit → session → handoff
-  lineage becomes queryable:
+- `Egregore-Session` is the id `bash bin/session-id.sh` prints: this
+  harness session's own id, resolved from the harness's native session
+  id. Never read `.egregore-session-id` for it — every worktree shares
+  that file and the latest session start anywhere rewrites it. The
+  trailer links the commit to its session in the graph — commit →
+  session → handoff lineage becomes queryable:
   `git log --format='%(trailers:key=Egregore-Session,valueonly)'`.
-  Omit only when no session id exists (bare scripts, CI). A commit
+  Omit only when it prints nothing (bare scripts, CI). A commit
   carrying work from several sessions repeats the trailer, one per
   session; squashes keep every contributing session's trailer, and a
   cherry-pick keeps the source commit's.

package/runtime/claude/.claude/context/handoff-claiming.md

@@ -0,0 +1,32 @@
+# Picking up an addressed handoff
+
+Use when the startup context lists handoffs addressed to the user
+(`addressed_to_user`) and the user picks one up. Run these steps after the task
+branch or worktree exists.
+
+1. Create the IMPLEMENTS link:
+
+   ```bash
+   bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
+   ```
+
+2. Check out the handoff's repo branches. When its `addressed_rich` entry
+   carries a non-empty `repoState`, check out each entry's branch in that
+   managed repo:
+
+   ```bash
+   PARENT_DIR="$(cd .. && pwd)"
+   # For each entry in repoState:
+   REPO_DIR="$PARENT_DIR/$REPO_NAME"
+   if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
+     git -C "$REPO_DIR" fetch origin "$BRANCH" --quiet 2>/dev/null
+     git -C "$REPO_DIR" checkout "$BRANCH" 2>/dev/null || \
+       git -C "$REPO_DIR" checkout -b "$BRANCH" "origin/$BRANCH" 2>/dev/null
+   fi
+   ```
+
+   Report `✓ Checked out {branch} in {repo1}, {repo2}`. If a branch no longer
+   exists because its PR merged: `◐ {repo}: PR #{N} merged — on {base}`. This
+   is plain Git and works in Local and Connected modes.
+
+   If `repoState` is absent or empty (older handoffs), skip this step silently.

package/runtime/claude/.claude/context/notification-consent.md

@@ -39,26 +39,29 @@ to send one immutable message.
 
 1. Finish the message first. Publish any artifact and insert its real URL
    before planning; never change the message after preview.
-2. Resolve the exact delivery without sending:
+2. Resolve the exact delivery without sending. Write the recipient and the
+   message as literal arguments; the command prints the plan as JSON:
 
    ```bash
-   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   bash bin/notify.sh plan send '<recipient>' '<message>'
    # or
-   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   bash bin/notify.sh plan group '<message>'
    ```
 
-3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+3. Read `plan_id` and `digest` from the printed plan. Show the organization,
    recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
    Send / Edit / Cancel question. Use the harness's structured question UI
    when available. Otherwise show the same fields in plain text and stop for
    the user's answer.
-4. Only if the user selects Send for that exact preview:
+4. Only if the user selects Send for that exact preview, record the approval
+   to a file and dispatch from that file. Two plain commands, no shell
+   variable and no substitution: a worktree-isolated session refuses those
+   shapes (`.claude/context/plain-shell.md`), and the file carries the
+   single-use token between the two steps:
 
    ```bash
-   APPROVAL_JSON=$(bash bin/notify.sh approve \
-     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
-   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
-   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   bash bin/notify.sh approve <plan-id> <digest> APPROVE_EXACT_NOTIFICATION --out tmp/notify-approval.json
+   bash bin/notify.sh dispatch <plan-id> --approval-file tmp/notify-approval.json
    ```
 
 5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and