create-egregore 0.21.6 → 0.22.0

package/runtime/pi/bin/pi-branch-policy.mjs

@@ -30,6 +30,41 @@ function stripQuotedSegments(command) {
   return out;
 }
 
+// Heredoc bodies are stdin, not shell commands: a Markdown body's blockquote
+// (`> quote`), arrow (`A -> B`) or tag (`<br>`) is no redirect. Each opener
+// line stays, so its real output redirects are still checked. Same rule as
+// bin/branch-guard.cjs withoutHeredocBodies (Codex), so the runtimes agree.
+function withoutHeredocBodies(command) {
+  const pending = [];
+  const visible = [];
+  let quote = null;
+  for (const line of String(command).split("\n")) {
+    if (pending.length) {
+      const { delimiter, tabs } = pending[0];
+      if ((tabs ? line.replace(/^\t+/, "") : line) === delimiter) pending.shift();
+      continue;
+    }
+    visible.push(line);
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (ch === "\\" && quote !== "'") { i++; continue; }
+      if (quote) {
+        if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"') { quote = ch; continue; }
+      if (line.slice(i, i + 3) === "<<<") { i += 2; continue; }
+      if (line.slice(i, i + 2) !== "<<") continue;
+      const match = line.slice(i).match(/^<<(-)?[ \t]*(?:'([^']+)'|"([^"]+)"|([^\s;&|<>]+))/);
+      if (match) {
+        pending.push({ delimiter: match[2] || match[3] || match[4], tabs: Boolean(match[1]) });
+        i += match[0].length - 1;
+      }
+    }
+  }
+  return visible.join("\n");
+}
+
 function maskQuotedOperators(command) {
   let out = "";
   let quote = null;
@@ -124,6 +159,7 @@ export function isRuntimeStatePath(target, projectDir) {
 
 export function mutatesOnlyRuntimeState(command, projectDir) {
   if (!isMutatingBash(command)) return false;
+  command = withoutHeredocBodies(command);
   const visible = stripQuotedSegments(String(command));
   if (MUTATING_GIT.test(visible) || MUTATING_PACKAGES.test(visible) ||
       /\bsed\s+[^\n]*\s-i(?:\s|$)/.test(visible)) return false;
@@ -183,6 +219,7 @@ export function isConsentCommand(command, branch) {
 
 export function isMutatingBash(command) {
   if (!command) return false;
+  command = withoutHeredocBodies(command);
   const meaningfulRedirects = stripQuotedSegments(String(command))
     .replace(/(?:^|\s)\d*>>?\s*\/dev\/null\b/g, " ")
     .replace(/(?:^|\s)\d*>\s*&\d+\b/g, " ");

package/runtime/pi/bin/pi-observe-context.mjs

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, realpathSync, rmdirSync, writeSync } from "node:fs";
 
 const DEFAULT_TIMEOUT_MS = 45_000;
 
@@ -70,11 +71,103 @@ export function compileObserveContext({ root, harness, prompt, sessionId, prompt
   });
 }
 
-function bindNativeSession(ctx, harness) {
+const ALIAS_LIMIT = 1024 * 1024;
+
+function boundedFirstLine(path) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+    if (!fstatSync(descriptor).isFile()) return;
+    const buffer = Buffer.alloc(ALIAS_LIMIT + 1);
+    let size = 0;
+    while (size <= ALIAS_LIMIT) {
+      const count = readSync(descriptor, buffer, size, Math.min(4096, buffer.length - size), null);
+      if (!count) return buffer.subarray(0, size).toString("utf8");
+      const newline = buffer.indexOf(10, size);
+      size += count;
+      if (newline >= 0 && newline < size) return buffer.subarray(0, newline).toString("utf8");
+    }
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+}
+
+function instanceRoot(root) {
+  const physical = realpathSync(root || process.cwd());
+  try {
+    const line = boundedFirstLine(join(physical, ".git"));
+    if (line?.startsWith("gitdir: ")) {
+      const target = realpathSync(resolve(physical, line.slice(8).trim()));
+      const marker = `${sep}.git${sep}worktrees${sep}`;
+      const index = target.indexOf(marker);
+      if (index >= 0) return target.slice(0, index);
+    }
+  } catch {}
+  return physical;
+}
+
+// Preserve the producer's spelling as well as the header id. A later sweep can
+// then recognize a hold even when it discovers the session by a physical path.
+function rememberSessionAlias(root, harness, path, hash) {
+  let descriptor;
+  let lock;
+  try {
+    if (!path || !process.env.HOME || !["pi", "prime"].includes(harness)) return;
+    const header = JSON.parse(boundedFirstLine(path));
+    if (header?.type !== "session" || !Number.isInteger(header.version)
+        || typeof header.id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(header.id)
+        || typeof header.cwd !== "string" || !isAbsolute(header.cwd)) return;
+    const project = instanceRoot(root);
+    const cwd = realpathSync(header.cwd);
+    if (cwd !== project && !cwd.startsWith(project + sep)) return;
+    const trails = join(process.env.HOME, ".egregore", "trails");
+    mkdirSync(trails, { recursive: true, mode: 0o700 });
+    const folder = join(trails, project.replace(/[/.]/g, "-") + `--${harness}`);
+    try { mkdirSync(folder, { mode: 0o700 }); } catch (error) { if (error.code !== "EEXIST") throw error; }
+    if (!lstatSync(folder).isDirectory() || dirname(realpathSync(folder)) !== realpathSync(trails)) return;
+    const lockPath = join(folder, ".aliases.lock");
+    try {
+      mkdirSync(lockPath, { mode: 0o700 });
+    } catch (error) {
+      if (error.code !== "EEXIST") return;
+      const info = lstatSync(lockPath);
+      if (!info.isDirectory() || Date.now() - info.mtimeMs <= 60_000) return;
+      // A crashed writer must not block future bindings. Remove only an empty
+      // stale directory and retry acquisition once; a fresh owner wins.
+      try {
+        rmdirSync(lockPath);
+        mkdirSync(lockPath, { mode: 0o700 });
+      } catch { return; }
+    }
+    lock = lockPath;
+    descriptor = openSync(join(folder, "aliases.jsonl"),
+      constants.O_CREAT | constants.O_RDWR | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+    const info = fstatSync(descriptor);
+    if (!info.isFile() || info.size > ALIAS_LIMIT) return;
+    const content = Buffer.alloc(info.size);
+    readSync(descriptor, content, 0, info.size, 0);
+    if (content.toString("utf8").split("\n").some(line => {
+      try { return JSON.parse(line).hash === hash; } catch { return false; }
+    })) return;
+    const entry = JSON.stringify({ hash, path: String(path), session: header.id }) + "\n";
+    if (info.size + Buffer.byteLength(entry) > ALIAS_LIMIT) return;
+    fchmodSync(descriptor, 0o600);
+    writeSync(descriptor, entry);
+  } catch {
+    // Recording an identity alias must never interrupt the Observe boundary.
+  } finally {
+    if (descriptor !== undefined) try { closeSync(descriptor); } catch {}
+    if (lock) try { rmdirSync(lock); } catch {}
+  }
+}
+
+/** Put the session's own id in the environment of every command it runs. */
+export function bindNativeSession(ctx, harness, root) {
   const session = sessionIdentity(ctx);
   if (session) {
     process.env.EGREGORE_NATIVE_SESSION_ID = session;
     process.env.EGREGORE_NATIVE_HARNESS = String(harness || "pi");
+    rememberSessionAlias(root, String(harness || "pi"), ctx?.sessionManager?.getSessionFile?.(), session);
   } else {
     delete process.env.EGREGORE_NATIVE_SESSION_ID;
     delete process.env.EGREGORE_NATIVE_HARNESS;
@@ -95,7 +188,7 @@ export function registerUserCommand(pi, { root, harness }, name, command) {
       // Native commands bypass before_agent_start's Observe hook while their
       // workflow is active. Reset at the actual user entry, before dispatch;
       // generated workflow turns must not reset same-prompt limits.
-      const context = await compileObserveContext({ root, harness, prompt: "", sessionId: bindNativeSession(ctx, harness), signal: ctx?.signal });
+      const context = await compileObserveContext({ root, harness, prompt: "", sessionId: bindNativeSession(ctx, harness, root), signal: ctx?.signal });
       if (context) pi.sendMessage?.({ customType: "egregore-org-context", content: context, display: false });
       return command.handler(args, ctx);
     },
@@ -110,7 +203,7 @@ export function registerObserveHook(pi, { root, harness, shouldObserve } = {}) {
       root,
       harness,
       prompt: event.prompt,
-      sessionId: bindNativeSession(ctx, harness),
+      sessionId: bindNativeSession(ctx, harness, root),
       signal: ctx?.signal,
     });
     if (!context) return;

package/runtime/pi/bin/pi-render-spec.mjs

@@ -75,7 +75,6 @@ function adapt(sourceSpec) {
     ["Egregore on Codex", "Egregore on Pi"],
     ["Codex-native", "Pi-native"],
     ["Codex sessions", "Pi sessions"],
-    ["On Codex", "On Pi"],
     ["bin/codex-session-start.sh", "bin/pi-session-start.sh"],
     [".codex/hooks/branch-guard.js", ".pi/extensions/egregore.ts"],
     ["PreToolUse hook (launcher `--enable hooks`)", "`tool_call` gate (loaded after Pi project trust)"],

package/runtime/pi/bin/pi-session-start.sh

@@ -7,7 +7,10 @@ SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 
 case "${1:---card}" in
   --card|card)
-    exec bash "$SCRIPT_DIR/bin/codex-session-start.sh" --card
+    # The extension binds Pi's own session id first; identity.sh maps it to
+    # the Egregore id this start mints (bin/session-id.sh).
+    EGREGORE_START_HARNESS=pi EGREGORE_HARNESS="${EGREGORE_HARNESS:-pi}" \
+      exec bash "$SCRIPT_DIR/bin/codex-session-start.sh" --card
     ;;
   --prompt|prompt)
     cat <<'EOF'

package/runtime/pi/bin/pi-spirit-discovery.mjs

@@ -0,0 +1,34 @@
+// Pi and Prime share this thin adapter; the reader owns all evidence semantics.
+import { join } from 'node:path';
+export function registerSpiritDiscovery(pi, { root, runtime, Type }) {
+  if (!['pi', 'prime'].includes(runtime)) throw new Error('invalid discovery adapter');
+  pi.registerTool({
+    name: 'egregore_discover_capabilities', label: 'Egregore capabilities',
+    description: 'Inspect local installed-file evidence and separately authenticated spirit capabilities. Read-only; does not grant or execute work.',
+    parameters: Type.Object({ operation: Type.Union(['capabilities.list','capabilities.find','capabilities.describe','capabilities.explain','system.explain'].map(Type.Literal)),
+      query: Type.Optional(Type.String({ maxLength: 200 })), id: Type.Optional(Type.String({ maxLength: 160 })) }, { additionalProperties: false }),
+    async execute(_id, params) {
+      // JSON is argv data; the fixed adapter never accepts a root or runtime selector.
+      if (!params || typeof params !== 'object' || Array.isArray(params)
+        || !['capabilities.list','capabilities.find','capabilities.describe','capabilities.explain','system.explain'].includes(params.operation)) throw new Error('invalid discovery query');
+      const args = [join(root, 'bin', `spirit-discovery-${runtime}.sh`), params.operation];
+      const allowed = params.operation === 'capabilities.find' ? ['operation','query']
+        : ['capabilities.describe','capabilities.explain'].includes(params.operation) ? ['operation','id']
+        : params.operation === 'system.explain' && Object.hasOwn(params,'id') ? ['operation','id'] : ['operation'];
+      if (Object.keys(params).sort().join() !== allowed.sort().join()) throw new Error('invalid discovery query');
+      for (const [field, limit] of [['query', 200], ['id', 160]]) {
+        if (Object.hasOwn(params, field) && (typeof params[field] !== 'string' || !params[field].trim()
+          || Buffer.from(params[field], 'utf8').toString('utf8') !== params[field]
+          || Buffer.byteLength(params[field]) > limit || /[\x00-\x1f\x7f]/.test(params[field]))) throw new Error('invalid discovery query');
+      }
+      if (Object.hasOwn(params,'query')) args.push(params.query);
+      if (Object.hasOwn(params,'id')) args.push(params.id);
+      const response = await pi.exec('bash', args, { timeout: 15000 });
+      if (Number(response.code ?? response.status ?? 0) !== 0) throw new Error('discovery is unavailable');
+      let value;
+      try { value = JSON.parse(response.stdout); } catch { throw new Error('discovery is unavailable'); }
+      if (value.schema !== 'egregore.capability-query/v1') throw new Error('discovery is unavailable');
+      return { content: [{ type: 'text', text: JSON.stringify(value) }], details: value };
+    },
+  });
+}

package/runtime/pi/bin/post-update.sh

@@ -43,6 +43,187 @@ if [ ! -e "$SCRIPT_DIR/egregore_runtime" ] && \
   MIGRATED=1
 fi
 
+# --- Migration: saved hosted address after the October 2026 security reset ---
+# Connected setups before 22 Oct 2026 saved the hosted API's old Railway origin
+# in egregore.json. That origin is retired; requests already resolve it to the
+# hosted API (bin/lib/config.sh), and this rewrites the saved value once so the
+# committed file says where requests go. Only that origin, without a path,
+# changes; other keys, custom origins and Local configs are left alone.
+#
+# The working file and the index copy are handled separately, so /update
+# commits this change and never an unrelated edit someone left in the file.
+# Only the api_url string itself is replaced, byte for byte: formatting, key
+# order, line endings, a byte-order mark and the file mode all stay as they
+# were. An api_url written any other way (escaped, repeated) is left for the
+# person to change by hand. Nothing is rewritten when either copy is Local,
+# when egregore.json is a link (its target may belong to something else; the
+# warning says to change it there), or when the working file is missing or
+# unreadable. Nothing is staged for an untracked, sparse or assume-unchanged
+# file. The index copy is staged first and the working file written second; a
+# failed write restores the index, so the two never disagree about the
+# address. A skip warns on stderr and never stops /update: the resolver
+# already sends every request to the hosted API. Never at session start, where
+# a modified tracked file would stop the startup sync. A source instance
+# (upstream_url "none") skips the update commit, so it is left to the
+# resolver.
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
+address_warn() { echo "  ! $*" >&2; }
+# saved_api_url TEXT — the api_url string jq reads from TEXT, if any.
+saved_api_url() { jq -r '.api_url | strings' 2>/dev/null <<< "$1" || true; }
+# other_keys TEXT — everything jq reads from TEXT apart from api_url.
+other_keys() { jq -cS 'del(.api_url)' 2>/dev/null <<< "$1"; }
+# address_state TEXT — "retired" for a Connected config (the _detect_mode
+# test) whose saved address is the retired origin, "local" for a Local one,
+# "keep" for anything else, including text that is not a JSON object.
+address_state() {
+  local text="$1" saved
+  if ! jq -e 'type == "object"' >/dev/null 2>&1 <<< "$text"; then echo keep; return 0; fi
+  if ! jq -e "$EGREGORE_CONNECTED_JQ" >/dev/null 2>&1 <<< "$text"; then echo local; return 0; fi
+  saved="$(saved_api_url "$text")"
+  if [ "$(jq -r '.upstream_url | strings' 2>/dev/null <<< "$text" || true)" != none ] \
+     && _retired_api_url "$saved" \
+     && [ "$(_hosted_api_url "$saved" 2>/dev/null || true)" = "$EGREGORE_HOSTED_API_ORIGIN" ]; then
+    echo retired
+  else
+    echo keep
+  fi
+}
+# hosted_address_text TEXT — sets ADDRESS_TEXT to TEXT with only its api_url
+# string replaced by the hosted address. Fails, leaving it empty, unless TEXT
+# holds "api_url" exactly once, as a string without escapes that is the value
+# jq reads, and the replacement changes nothing else jq can see.
+hosted_address_text() {
+  local LC_ALL=C
+  local text="$1" key='"api_url"' value_re='^([[:space:]]*:[[:space:]]*")([^"\\]*)"' after updated before_keys after_keys
+  ADDRESS_TEXT=""
+  case "$text" in *"$key"*) ;; *) return 1 ;; esac
+  after="${text#*"$key"}"
+  case "$after" in *"$key"*) return 1 ;; esac
+  [[ "$after" =~ $value_re ]] || return 1
+  [ "${BASH_REMATCH[2]}" = "$(saved_api_url "$text")" ] || return 1
+  updated="${text%%"$key"*}$key${BASH_REMATCH[1]}$EGREGORE_HOSTED_API_ORIGIN\"${after#"${BASH_REMATCH[0]}"}"
+  [ "$(saved_api_url "$updated")" = "$EGREGORE_HOSTED_API_ORIGIN" ] || return 1
+  before_keys="$(other_keys "$text")" && after_keys="$(other_keys "$updated")" \
+    && [ "$before_keys" = "$after_keys" ] || return 1
+  ADDRESS_TEXT="$updated"
+}
+# read_exact FILE — sets EXACT_TEXT to FILE's bytes, trailing newlines kept.
+read_exact() {
+  local text
+  text="$(cat -- "$1" 2>/dev/null && printf .)" || return 1
+  EXACT_TEXT="${text%.}"
+}
+config_path="$SCRIPT_DIR/egregore.json"
+worktree_state=absent
+worktree_text=""
+if [ -L "$config_path" ]; then
+  worktree_state=link
+elif [ -f "$config_path" ]; then
+  if [ -r "$config_path" ] && read_exact "$config_path"; then
+    worktree_text="$EXACT_TEXT"
+    worktree_state="$(address_state "$worktree_text")"
+  else
+    worktree_state=unreadable
+  fi
+fi
+index_state=untracked
+index_stageable=false
+index_entry="$(git -C "$SCRIPT_DIR" ls-files -s -- egregore.json 2>/dev/null || true)"
+index_mode="${index_entry%% *}"
+index_sha="${index_entry#* }"
+index_sha="${index_sha%% *}"
+index_text=""
+case "$index_entry" in
+  100644\ *\ 0$'\t'egregore.json|100755\ *\ 0$'\t'egregore.json)
+    index_text="$(git -C "$SCRIPT_DIR" cat-file blob "$index_sha" 2>/dev/null && printf .)" || index_text=""
+    if [ -n "$index_text" ]; then
+      index_text="${index_text%.}"
+      index_state="$(address_state "$index_text")"
+      # Only a normal entry ("H"): skip-worktree and assume-unchanged files
+      # are set aside from this checkout, so their commits are not ours to make.
+      index_tag="$(git -C "$SCRIPT_DIR" ls-files -v -- egregore.json 2>/dev/null || true)"
+      [ "${index_tag%% *}" = H ] && index_stageable=true
+    else
+      index_state=other
+    fi
+    ;;
+  '') ;;
+  *) index_state=other ;;
+esac
+address_updated=false
+by_hand="set api_url to $EGREGORE_HOSTED_API_ORIGIN by hand"
+if [ "$worktree_state" = link ]; then
+  if read_exact "$config_path" && [ "$(address_state "$EXACT_TEXT")" = retired ]; then
+    address_warn "egregore.json is a link, so its saved hosted address was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Set api_url to it in the file the link points to."
+  fi
+elif [ "$worktree_state" = unreadable ]; then
+  address_warn "egregore.json can't be read, so its saved hosted address wasn't checked. If it names the retired address, $by_hand."
+elif [ "$worktree_state" = local ] || [ "$index_state" = local ]; then
+  if [ "$worktree_state" = retired ] || [ "$index_state" = retired ]; then
+    address_warn "egregore.json is Local in one copy and Connected in the other, so its saved hosted address was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN."
+  fi
+else
+  stage_index=false
+  write_worktree=false
+  if [ "$index_state" = retired ]; then
+    if [ "$worktree_state" = absent ]; then
+      address_warn "egregore.json is missing from this checkout, so its committed hosted address was left as is."
+    elif [ "$index_stageable" != true ]; then
+      address_warn "egregore.json is set aside from this checkout (sparse or assume-unchanged), so its committed hosted address was left as is."
+    else
+      stage_index=true
+    fi
+  fi
+  [ "$worktree_state" != retired ] || write_worktree=true
+  index_new=""
+  worktree_new=""
+  plan_ok=true
+  if [ "$stage_index" = true ]; then
+    if hosted_address_text "$index_text"; then index_new="$ADDRESS_TEXT"; else plan_ok=false; fi
+  fi
+  if [ "$write_worktree" = true ]; then
+    if hosted_address_text "$worktree_text"; then worktree_new="$ADDRESS_TEXT"; else plan_ok=false; fi
+  fi
+  if [ "$plan_ok" != true ]; then
+    address_warn "egregore.json's api_url is written in a way this update can't change safely, so it was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Please $by_hand."
+  elif [ "$stage_index" = true ] || [ "$write_worktree" = true ]; then
+    landed=true
+    index_staged=false
+    if [ "$stage_index" = true ]; then
+      if index_blob="$(printf '%s' "$index_new" | git -C "$SCRIPT_DIR" hash-object -w --no-filters --stdin 2>/dev/null)" \
+         && git -C "$SCRIPT_DIR" update-index --cacheinfo "$index_mode,$index_blob,egregore.json" 2>/dev/null; then
+        index_staged=true
+      else
+        landed=false
+        address_warn "Could not stage the hosted services address, so egregore.json was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Run /update again, or $by_hand."
+      fi
+    fi
+    if [ "$landed" = true ] && [ "$write_worktree" = true ]; then
+      config_mode="$(stat -c '%a' "$config_path" 2>/dev/null || stat -f '%Lp' "$config_path" 2>/dev/null || echo 644)"
+      config_tmp="$(mktemp "$config_path.XXXXXX" 2>/dev/null || true)"
+      if [ -n "$config_tmp" ] && printf '%s' "$worktree_new" > "$config_tmp" \
+         && chmod "$config_mode" "$config_tmp" && mv -f "$config_tmp" "$config_path"; then
+        :
+      else
+        landed=false
+        [ -z "$config_tmp" ] || rm -f "$config_tmp"
+        if [ "$index_staged" = true ] \
+           && ! git -C "$SCRIPT_DIR" update-index --cacheinfo "$index_mode,$index_sha,egregore.json" 2>/dev/null; then
+          address_warn "Could not update the hosted services address in egregore.json, and its staged copy could not be put back; run git restore --staged egregore.json, then $by_hand."
+        else
+          address_warn "Could not update the hosted services address in egregore.json; it is unchanged, and requests still use $EGREGORE_HOSTED_API_ORIGIN."
+        fi
+      fi
+    fi
+    [ "$landed" != true ] || address_updated=true
+  fi
+fi
+if [ "$address_updated" = true ]; then
+  echo "  ✓ Hosted services address updated after the October security reset"
+  MIGRATED=1
+fi
+
 # --- Future migrations go here ---
 # Each migration should:
 # 1. Check if it needs to run (idempotent guard)

package/runtime/pi/bin/prime-render-spec.mjs

@@ -74,7 +74,6 @@ function adapt(sourceSpec) {
     ["Egregore on Codex", "Egregore on Prime Agent"],
     ["Codex-native", "Prime-native"],
     ["Codex sessions", "Prime Agent sessions"],
-    ["On Codex", "On Prime Agent"],
     ["bin/codex-session-start.sh", "bin/prime-session-start.sh"],
     [".codex/hooks/branch-guard.js", ".prime/agent/extensions/egregore.ts"],
     ["PreToolUse hook (launcher `--enable hooks`)", "`tool_call` gate (loaded from the project-local extension)"],