create-egregore 0.21.6 → 0.22.0

package/runtime/pi/bin/publish-artifact.sh

@@ -25,6 +25,15 @@ set -euo pipefail
 #              Set automatically when publish-references.sh invokes us for a child,
 #              preventing recursion.
 #
+# --expires <days|never>: close the page's link that many days from now (1-365),
+#              or keep it open with never. Left out, a republish keeps the
+#              link's current closing date. Org pages only; close, reopen and
+#              see opens with bin/artifacts.sh close|reopen|opens <id>.
+#
+# --visible-to <@handle|email,...|public>: open the page only to these signed-in
+#              people (Connected only; refused in Local). public reopens it to
+#              anyone with the link; left out, a republish keeps the list.
+#
 # Outputs artifact URL on success, exits silently on soft failure (the server
 # could not be reached).
 # Designed for fire-and-forget use: `bash bin/publish-artifact.sh handoff file.md &`
@@ -40,6 +49,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 
 # --- Parse arguments ---
 TYPE=""
@@ -69,6 +80,8 @@ while [[ $# -gt 0 ]]; do
     --raw-html) RAW_HTML=1; shift ;;
     --allow-admin) ALLOW_ADMIN=1; shift ;;
     --no-references) SKIP_REFERENCES=1; shift ;;
+    --expires) EXPIRES="$2"; shift 2 ;;
+    --visible-to) VISIBLE_TO="$2"; shift 2 ;;
     *)
       if [ -z "$TYPE" ]; then
         TYPE="$1"
@@ -89,6 +102,14 @@ if [ -n "$ARTIFACT_ID" ] && ! [[ "$ARTIFACT_ID" =~ ^[a-zA-Z0-9_-]{1,50}$ ]]; the
   echo "--id must be 1-50 chars, alphanumeric/hyphen/underscore only" >&2
   exit 1
 fi
+if [ -n "${EXPIRES:-}" ] && ! [[ "$EXPIRES" =~ ^([1-9][0-9]{0,2}|never)$ && ( "$EXPIRES" == never || "$EXPIRES" -le 365 ) ]]; then
+  echo "--expires takes a number of days from 1 to 365, or never" >&2
+  exit 1
+fi
+if [ -n "${VISIBLE_TO:-}" ] && ! [[ "$VISIBLE_TO" =~ ^(public|[^,[:space:]]+(,[^,[:space:]]+){0,49})$ ]]; then
+  echo "--visible-to takes @handles or emails separated by commas, or public" >&2
+  exit 1
+fi
 if [ -n "$CANONICAL_ID" ] && ! [[ "$CANONICAL_ID" =~ ^[mh]-[0-9a-f]{12}$ ]]; then
   echo "--canonical-id must be a memory file id (m- or h- and 12 hex characters)" >&2
   exit 1
@@ -115,11 +136,24 @@ if [ ! -f "$CONFIG" ] || ! jq -e 'type == "object"' "$CONFIG" >/dev/null 2>&1; t
   exit 4
 fi
 
-API_URL="${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+# A refused address stops here: a Connected org's page must never fall back
+# to the public relay because its saved address is not plain.
+if ! API_URL="$(_hosted_api_url "${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}")"; then
+  echo "Not published — nothing left this machine." >&2
+  exit 4
+fi
 API_KEY="${EGREGORE_API_KEY:-}"
 ORG_SLUG="$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)"
 VIEW_BASE="https://egregore.xyz/view"
 
+# A page opened by identity needs the hosted sign-in, so it is org-only. The
+# public relay would show it to anyone with the link: refuse, upload nothing.
+if [ -n "${VISIBLE_TO:-}" ] && { [ -z "$API_URL" ] || [ -z "$API_KEY" ]; }; then
+  echo "Not published — nothing left this machine." >&2
+  echo "--visible-to opens a page by identity, which needs Connected mode. In Local mode, hand over the password-protected file instead." >&2
+  exit 4
+fi
+
 # Resolve "use published renderer" from env first, then egregore.json. The
 # env var lets individuals override per-shell; egregore.json lets an
 # instance (e.g. the upstream dev repo) opt in for every teammate.
@@ -132,7 +166,7 @@ fi
 
 # Public relay for OSS share endpoint. Unauthenticated: anything posted here is
 # readable by anyone holding the URL, for 7 days, with nothing in front of it.
-RELAY_URL="https://api.egregore.xyz"
+RELAY_URL="$EGREGORE_HOSTED_API_ORIGIN"
 
 # --- Artifact hosting off-switch (compliance / privacy) ---
 # An instance can disable ALL egregore.xyz publishing via `bin/settings.sh hosting off`
@@ -166,48 +200,40 @@ if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
   fi
 fi
 
-# --- Admin-content gate (the refusal documented in bin/lib/permissions.sh) --
-# `admin: true` sources — including backtick-referenced memory files — are
-# refused before any render or upload. An authorized admin (stable identity,
-# github.username alias against egregore.json admins) may proceed only with
-# the explicit --allow-admin confirmation, which is separate from and never
-# replaces normal publication approval. This protects the Egregore surface;
-# repository members can still read raw Git files.
-# shellcheck source=bin/lib/permissions.sh
-source "$SCRIPT_DIR/bin/lib/permissions.sh"
-ADMIN_MARKED=()
-if _is_admin_only_file "$FILE"; then
-  ADMIN_MARKED+=("$FILE")
+# --- Held-content gate: a publish is a hand-over -----------------------------
+# The source and every backtick-referenced memory file go through one
+# `access check --hand-over`: every held class is refused to a non-admin,
+# under every policy, and a failed check refuses too. An admin may publish
+# held material only with the explicit --allow-admin confirmation, which is
+# separate from and never replaces normal publication approval.
+MEMORY_REAL="$(cd "$SCRIPT_DIR/memory" 2>/dev/null && pwd -P || true)"
+SOURCE_REAL="$(cd "$(dirname "$FILE")" && pwd -P)/$(basename "$FILE")"
+if [ -n "$MEMORY_REAL" ] && [[ "$SOURCE_REAL" == "$MEMORY_REAL"/* ]]; then
+  SOURCES=("memory/${SOURCE_REAL#"$MEMORY_REAL"/}")
+else
+  SOURCES=("$SOURCE_REAL")
 fi
 if [ "$RAW_HTML" -eq 0 ]; then
   while IFS= read -r ref; do
-    [ -z "$ref" ] && continue
-    rel="${ref#\`}"
-    rel="${rel%\`}"
-    if [ -f "$SCRIPT_DIR/$rel" ] && _is_admin_only_file "$SCRIPT_DIR/$rel"; then
-      ADMIN_MARKED+=("$rel")
-    fi
+    rel="${ref//\`/}"
+    [ -f "$SCRIPT_DIR/$rel" ] && SOURCES+=("$rel")
   done < <(grep -Eo '`memory/[^`[:space:]]+\.(md|html)`' "$FILE" 2>/dev/null | sort -u)
 fi
-if [ "${#ADMIN_MARKED[@]}" -gt 0 ]; then
-  IS_ADMIN="false"
-  ADMIN_JSON=$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" \
-    PYTHONSAFEPATH=1 PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
-    python3 -m egregore_runtime.harness_cli admin-status 2>/dev/null) || true
-  IS_ADMIN=$(printf '%s' "$ADMIN_JSON" | jq -r '.admin // false' 2>/dev/null || echo "false")
-  if [ "$IS_ADMIN" != "true" ]; then
-    echo "publish refused: admin-marked content cannot be published by a non-admin member:" >&2
-    printf '  %s\n' "${ADMIN_MARKED[@]}" >&2
-    echo "(--allow-admin is available to organization admins only)" >&2
-    exit 5
-  fi
-  if [ "$ALLOW_ADMIN" -ne 1 ]; then
-    echo "publish refused: this content is admin-marked:" >&2
-    printf '  %s\n' "${ADMIN_MARKED[@]}" >&2
-    echo "re-run with --allow-admin to confirm publishing admin-marked content" >&2
-    echo "(this confirmation is separate from normal publication approval)" >&2
-    exit 5
-  fi
+HELD_CHECK=0
+CHECKED="$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" PYTHONSAFEPATH=1 \
+  PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+  python3 -m egregore_runtime.harness_cli access check --hand-over "${SOURCES[@]}" 2>/dev/null)" || HELD_CHECK=$?
+if [ "$HELD_CHECK" -ne 0 ] || [ -z "$CHECKED" ]; then
+  echo "publish refused: a non-admin cannot publish held material, or access could not be checked:" >&2
+  printf '%s\n' "$CHECKED" | awk -F '\t' '$3 != "allowed" && NF { print "  " $1 }' >&2
+  exit 5
+fi
+if [ "$ALLOW_ADMIN" -ne 1 ] && printf '%s\n' "$CHECKED" | grep -q ' for everyone else$'; then
+  echo "publish refused: this content is held from everyone but admins:" >&2
+  printf '%s\n' "$CHECKED" | awk -F '\t' '/ for everyone else$/ { print "  " $1 " (" $4 ")" }' >&2
+  echo "re-run with --allow-admin to confirm publishing it" >&2
+  echo "(this confirmation is separate from normal publication approval)" >&2
+  exit 5
 fi
 
 # --- Prepare HTML ---
@@ -291,8 +317,12 @@ fi
 RESPONSE=""
 
 if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
-  # Connected mode: permanent, org-scoped
-  RESPONSE=$(curl -s -X POST "${API_URL}/api/artifacts/publish" \
+  # Connected mode: permanent, org-scoped. A list goes to publish-restricted,
+  # which a server that cannot open pages by identity does not have: it
+  # refuses there instead of ignoring the list and opening the page to all.
+  PUBLISH_PATH="/api/artifacts/publish"
+  [ -z "${VISIBLE_TO:-}" ] || PUBLISH_PATH="/api/artifacts/publish-restricted"
+  RESPONSE=$(curl -s -X POST "${API_URL}${PUBLISH_PATH}" \
     -H "Authorization: Bearer $API_KEY" \
     -F "file=@${TMP_HTML}" \
     -F "artifact_type=${TYPE}" \
@@ -300,9 +330,14 @@ if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
     -F "author=${AUTHOR}" \
     -F "description=${DESCRIPTION}" \
     -F "artifact_id=${ARTIFACT_ID}" \
+    -F "expires_in_days=${EXPIRES:-}" \
+    --form-string "visible_to=${VISIBLE_TO:-}" \
     --max-time 15 2>/dev/null) || true
 else
   # OSS mode: ephemeral, 7-day TTL
+  if [ -n "${EXPIRES:-}" ]; then
+    echo "Note: --expires applies to organization pages; this public copy closes after 7 days." >&2
+  fi
   RESPONSE=$(curl -s -X POST "${RELAY_URL}/api/artifacts/share" \
     -F "file=@${TMP_HTML}" \
     -F "artifact_type=${TYPE}" \
@@ -334,6 +369,9 @@ if [ -n "$RESPONSE" ]; then
     # The server refused (409 for an id another org holds, 400, 413, 503…).
     # A distinct exit code lets callers that report stderr on failure show why.
     DETAIL=$(echo "$RESPONSE" | jq -r 'if (.detail | type) == "string" then .detail else empty end' 2>/dev/null || true)
+    if [ -n "${VISIBLE_TO:-}" ] && { [ "$DETAIL" = "Not Found" ] || [ "$DETAIL" = "Method Not Allowed" ]; }; then
+      DETAIL="the hosted service cannot open pages by identity yet, so nothing was stored."
+    fi
     echo "Not published: ${DETAIL:-the server answered without a URL.}" >&2
     exit 6
   fi
@@ -345,7 +383,16 @@ fi
 #   - parent publish failed (no URL),
 #   - --raw-html (HTML attachments don't embed markdown refs we'd parse),
 #   - --no-references (caller explicitly opts out / recursion guard).
-if [ -n "$URL" ] && [ "$RAW_HTML" -eq 0 ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
+#   - the page opens by identity (its stored list, so a republish that keeps
+#     the list counts): the files it links to would open to anyone.
+RESTRICTED=0
+if [ -n "$URL" ] && [ "$(echo "$RESPONSE" | jq -r '.visible_to | type' 2>/dev/null || true)" = "array" ]; then
+  RESTRICTED=1
+  if [ -n "$REF_IDS" ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
+    echo "Note: the files this page links to were not published; it opens only for the people it is shared with." >&2
+  fi
+fi
+if [ -n "$URL" ] && [ "$RESTRICTED" -eq 0 ] && [ "$RAW_HTML" -eq 0 ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
   EGREGORE_REF_IDS="$REF_IDS" bash "$SCRIPT_DIR/bin/publish-references.sh" "$FILE" >/dev/null 2>&1 &
   disown 2>/dev/null || true
 fi

package/runtime/pi/bin/qa-inventory.sh

@@ -236,7 +236,7 @@ if $requested_tree; then
     ($path | split("/")[-1]) as $basename | .[$basename] += [$path])' \
     "$scratch/head-paths" > "$scratch/head-basenames.json"
 else
-  for suite in "$SCRIPT_DIR"/tests/*.sh "$SCRIPT_DIR"/tests/*.py "$SCRIPT_DIR"/bin/tests/*.sh "$SCRIPT_DIR"/bin/tests/*.mjs; do
+  for suite in "$SCRIPT_DIR"/tests/*.sh "$SCRIPT_DIR"/tests/*.py "$SCRIPT_DIR"/tests/*.mjs "$SCRIPT_DIR"/bin/tests/*.sh "$SCRIPT_DIR"/bin/tests/*.mjs; do
     if [ -L "$suite" ]; then
       suite_paths_skipped=$((suite_paths_skipped + 1))
       continue
@@ -286,7 +286,7 @@ while IFS= read -r -d '' file; do
     code=0
     if $requested_tree; then
       git -C "$SCRIPT_DIR" grep -l -z -F "${patterns[@]}" "$head_oid" -- \
-        ':(top,glob)tests/*.sh' ':(top,glob)tests/*.py' \
+        ':(top,glob)tests/*.sh' ':(top,glob)tests/*.py' ':(top,glob)tests/*.mjs' \
         ':(top,glob)bin/tests/*.sh' ':(top,glob)bin/tests/*.mjs' > "$scratch/hits" || code=$?
       while IFS= read -r -d '' suite; do
         jq -cn --arg suite "${suite#"$head_oid":}" --arg match "$file" \

package/runtime/pi/bin/quest.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 export EGREGORE_ROOT="$ROOT"
-export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
+export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(bash "$ROOT/bin/session-id.sh" --root "$ROOT" 2>/dev/null || cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
 export PYTHONSAFEPATH=1 PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}"
 
 exec python3 -m egregore_runtime.quest_cli "$@"

package/runtime/pi/bin/records.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Personal controls and batch actions for session records.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)" || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+[ -n "${HOME:-}" ] || exit 0
+# The organization's vitals read the records and the gate ledger only.
+[ "${1:-}" = vitals ] && shift && exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" vitals --root "$SCRIPT_DIR" "$@"
+[ "${1:-}" = retrieval ] && shift && exec python3 "$SCRIPT_DIR/bin/lib/retrieval_scorecard.py" --root "$SCRIPT_DIR" "$@"
+exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" records --root "$SCRIPT_DIR" "$@"

package/runtime/pi/bin/reflexes/05-vitals.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# The organization's pulse: sessions by harness, cost, friction and the merge
+# gate's decisions over the last seven days beside the seven before, from the
+# session records and memory/sessions/gate.jsonl. Silent under two sessions.
+# Writes nothing. Contract: bin/reflexes/README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/session_record.py" ] && command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/session_record.py" vitals-line --root "$root" --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/pi/bin/reflexes/10-open-items.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Open items carried from the session records: how many, and the oldest. An
+# ownerless item past three days adds the count and the oldest's age; past
+# seven days the line ends with the command that drafts an issue for it.
+# Reads the records of the last fourteen days and the open-items ledger;
+# writes nothing. Contract: bin/reflexes/README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/session_record.py" ] || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/session_record.py" open-items-line --root "$root" \
+  --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/pi/bin/reflexes/15-retrieval.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Show: this installation's memory lookups and the organization's session reach
+# over seven days. Silent below two lookups or when organization records are off.
+# One line, at most 160 characters; writes nothing. Contract: README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/retrieval_scorecard.py" ] && command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/retrieval_scorecard.py" line --root "$root" --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/pi/bin/reflexes/20-nightly.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Reflex, show then propose: the runs of ci.yml on develop, the push run
+# each merge starts and the workflow_dispatch run the nightly dispatcher
+# requests. A run cancelled because a newer merge superseded it is no verdict
+# and is skipped.
+#
+# Silent while the latest finished run is green, or red once. Two or more red
+# runs running name the failing jobs of the latest run; three end with a
+# proposal to give the failure an owner.
+#
+# The answer is cached for six hours in tmp/reflexes/nightly.json, so a warm
+# card makes no gh call. A cold one makes one request, and a second for the
+# failing jobs only when the line will print; both go through gh's own
+# six-hour response cache, which outlives the sweep of tmp/ at session end.
+# Silent when gh or jq is missing, gh is signed out or offline, or the
+# request outlasts the runner's one-second budget.
+set -uo pipefail
+
+ROOT="${EGREGORE_ROOT:-$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)}"
+[ -n "$ROOT" ] && [ -d "$ROOT" ] || exit 0
+CACHE="$ROOT/tmp/reflexes/nightly.json"
+TTL=21600
+BRANCH=develop
+
+command -v jq >/dev/null 2>&1 || exit 0
+now="$(date +%s)"
+
+fresh() {
+  local at
+  at="$(jq -r '.fetched_at // 0 | floor' "$CACHE" 2>/dev/null)" || return 1
+  case "$at" in ''|*[!0-9]*) return 1 ;; esac
+  [ $((at + TTL)) -gt "$now" ]
+}
+
+# Reads run conclusions, latest first; prints how many in a row are red.
+red_streak() {
+  local conclusion count=0 open=1
+  while IFS= read -r conclusion; do
+    [ "$open" -eq 1 ] || continue
+    case "$conclusion" in
+      failure|timed_out|action_required|startup_failure) count=$((count + 1)) ;;
+      *) open=0 ;;
+    esac
+  done
+  printf '%s\n' "$count"
+}
+
+refresh() {
+  local runs jobs='[]' streak latest tmp
+  command -v gh >/dev/null 2>&1 || return 1
+  [ -f "$ROOT/.github/workflows/ci.yml" ] || return 1
+  runs="$(cd "$ROOT" && gh api --cache 6h \
+      "repos/{owner}/{repo}/actions/workflows/ci.yml/runs?branch=$BRANCH&per_page=10" 2>/dev/null \
+    | jq -c '[.workflow_runs[]? | select(.status == "completed" and .conclusion != "cancelled")
+              | {conclusion, createdAt: .created_at, databaseId: .id}] | .[:3]')" || return 1
+  streak="$(jq -r '.[].conclusion' <<<"$runs" | red_streak)"
+  if [ "$streak" -ge 2 ]; then
+    latest="$(jq -r '.[0].databaseId' <<<"$runs")"
+    case "$latest" in ''|*[!0-9]*) return 1 ;; esac
+    jobs="$(cd "$ROOT" && gh api --cache 6h "repos/{owner}/{repo}/actions/runs/$latest/jobs?per_page=100" 2>/dev/null \
+      | jq -c '[.jobs[]? | select(.conclusion == "failure" or .conclusion == "timed_out"
+                                  or .conclusion == "startup_failure" or .conclusion == "action_required")
+                | .name | gsub("\\s*[—–-]*\\s*[0-9a-f]{40}"; "")]')" || return 1
+  fi
+  mkdir -p "${CACHE%/*}" 2>/dev/null || return 1
+  tmp="$(mktemp "${CACHE%/*}/.nightly.XXXXXX" 2>/dev/null)" || return 1
+  if jq -n --argjson at "$now" --arg branch "$BRANCH" --argjson runs "$runs" --argjson jobs "$jobs" \
+       '{fetched_at: $at, branch: $branch, runs: $runs, failing_jobs: $jobs}' >"$tmp" 2>/dev/null; then
+    mv -f "$tmp" "$CACHE" || { rm -f "$tmp"; return 1; }
+  else
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+render() {
+  local streak prefix suffix="" names="" name budget extra=0
+  streak="$(jq -r '.runs[]?.conclusion' "$CACHE" 2>/dev/null | red_streak)"
+  [ "$streak" -ge 2 ] || return 0
+  [ "$streak" -lt 3 ] || suffix=" · propose an owner: /issue"
+  prefix="$(jq -r '.branch // "develop"' "$CACHE") red $streak runs running: "
+  # The runner cuts a line at 160 characters; keep the proposal inside it.
+  budget=$((160 - ${#prefix} - ${#suffix} - 12))
+  while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    if [ -z "$names" ]; then
+      names="$name"
+    elif [ $((${#names} + 2 + ${#name})) -le "$budget" ]; then
+      names="$names, $name"
+    else
+      extra=$((extra + 1))
+    fi
+  done < <(jq -r '.failing_jobs[]?' "$CACHE" 2>/dev/null)
+  [ "$extra" -eq 0 ] || names="$names and $extra more"
+  [ -n "$names" ] || names="$(jq -r '.runs[0].conclusion // "failure"' "$CACHE")"
+  printf '%s%s%s\n' "$prefix" "$names" "$suffix"
+}
+
+fresh || refresh || exit 0
+render

package/runtime/pi/bin/reflexes/20-sandbox.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Reflex (show): a session inside a sandbox says what runs degraded and
+# what will not work.
+#
+# Positive markers only, the predicate bin/lib/secret_entry.py and
+# egregore_runtime/sandbox.py use: CODEX_SANDBOX set to anything but empty,
+# none, false or 0, or APP_SANDBOX_CONTAINER_ID set. No marker, no line, on
+# every harness; a missing DISPLAY or a failing write never names a sandbox.
+# With a marker, one file is created and removed where the runtime keeps its
+# per-user state (search and telemetry, resolved as egregore_runtime does).
+# The line follows the result: writable state, and search and browser checks
+# will not work; refused state, and search runs degraded on the workspace
+# copy, with a second line saying that state is read-only here.
+set -u
+
+marker="$(printf '%s' "${CODEX_SANDBOX:-}" | tr '[:upper:]' '[:lower:]')"
+case "$marker" in
+  ""|none|false|0) [ -n "${APP_SANDBOX_CONTAINER_ID:-}" ] || exit 0 ;;
+esac
+
+# Create and remove one file in the nearest existing ancestor of a directory;
+# fails when that location refuses the write or keeps the file. A probe file
+# that outlives its test is removed again on the way out, and that retry
+# never fails the probe, even under an inherited errexit.
+probe_file=""
+trap 'if [ -n "$probe_file" ]; then rm -f "$probe_file" 2>/dev/null || true; fi' EXIT
+writable() {
+  local dir="$1" parent
+  case "$dir" in \~/*) dir="${HOME:-}/${dir#\~/}" ;; esac
+  # A relative override is relative to the current directory, as the runtime
+  # resolves it; the walk must reach that directory, never stop short of it.
+  case "$dir" in /*) ;; *) dir="$PWD/$dir" ;; esac
+  while [ ! -e "$dir" ]; do
+    parent="${dir%/*}"
+    [ -n "$parent" ] || parent=/
+    [ "$parent" != "$dir" ] || break
+    dir="$parent"
+  done
+  [ -d "$dir" ] || return 0
+  probe_file="$(mktemp "$dir/.egregore-write-probe.XXXXXX" 2>/dev/null)" || { probe_file=""; return 1; }
+  rm -f "$probe_file" 2>/dev/null || return 1
+  probe_file=""
+}
+
+# Both stores key their per-user directory by the resolved memory checkout
+# (QmdLocalRetriever._instance_hash, LocalTelemetrySink's namespace).
+root="${EGREGORE_ROOT:-.}"
+memory="$(cd "$root/memory" 2>/dev/null && pwd -P)" \
+  || memory="$(cd "$root" 2>/dev/null && pwd -P)/memory"
+digest=""
+if command -v shasum >/dev/null 2>&1; then
+  digest="$(printf '%s' "$memory" | LC_ALL=C shasum -a 256 2>/dev/null)"
+elif command -v sha256sum >/dev/null 2>&1; then
+  digest="$(printf '%s' "$memory" | sha256sum 2>/dev/null)"
+fi
+digest="${digest%% *}"
+
+search_state="${EGREGORE_QMD_RUNTIME_DIR:-}"
+telemetry_state="${EGREGORE_TELEMETRY_DIR:-}"
+if [ -n "${HOME:-}" ]; then
+  [ -n "$search_state" ] || search_state="$HOME/.egregore/runtime/qmd${digest:+/${digest:0:16}}"
+  [ -n "$telemetry_state" ] || telemetry_state="$HOME/.egregore/telemetry${digest:+/${digest:0:20}}"
+fi
+
+refused=""
+for state in "$search_state" "$telemetry_state"; do
+  [ -n "$state" ] || continue
+  if ! writable "$state"; then
+    refused=1
+    break
+  fi
+done
+
+# shellcheck disable=SC2016  # the backticks are part of each line
+if [ -n "$refused" ]; then
+  # The runtime falls back to the workspace copy: lexical search, telemetry
+  # kept there. The read-only fact gets its own line, because this one uses
+  # 157 of the runner's 160 characters.
+  printf '%s\n' 'this session runs in a sandbox: search runs degraded, telemetry stays in the workspace and browser checks will not work · start through `egregore` to lift it'
+  printf '%s\n' 'per-user state is read-only here'
+else
+  # Per-user state stays in use, but the sandbox refuses the loopback port
+  # of the query worker, so search fails instead of degrading.
+  printf '%s\n' 'this session runs in a sandbox: search and browser checks will not work · start through `egregore` to lift it'
+fi

package/runtime/pi/bin/reflexes/30-cost.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""Reflex: your session cost over seven days. Show tier.
+
+Reads the current person's session records from the last seven days, today
+included, and only the files whose names fall in that window. A priced record
+counts under its harness (a record priced at list price is a Codex session);
+an unpriced record counts apart, with the input tokens from its Cost section.
+Prints one line, leaving out the parts that are zero, and nothing without
+records. Numbers only: no topic, branch or prompt text.
+"""
+import datetime
+import json
+import math
+import os
+import re
+import sys
+from pathlib import Path
+
+DAYS = 7
+READ_LIMIT = 256 * 1024
+PRICED = ("ledger", "estimate", "list price")
+LABELS = {"claude": "Claude", "codex": "Codex", "pi": "Pi", "prime": "Prime", "other": "Other"}
+TOKENS = re.compile(r"^- tokens: (\d+) input\b", re.M)
+
+
+def front_matter(text):
+    if not text.startswith("---\n"):
+        return {}
+    block = text[4:].partition("\n---")[0]
+    fields = {}
+    for line in block.splitlines():
+        key, sep, value = line.partition(":")
+        if not sep:
+            continue
+        value = value.strip()
+        try:
+            value = json.loads(value)
+        except ValueError:
+            pass
+        fields[key.strip()] = value
+    return fields
+
+
+def amount(value):
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        return 0.0
+    return number if math.isfinite(number) and number > 0 else 0.0
+
+
+def compact(count):
+    value, unit = float(count), ""
+    for name in ("K", "M", "B"):
+        if round(value, 1) < 1000:
+            break
+        value, unit = value / 1000, name
+    return (f"{value:.1f}".removesuffix(".0") if unit else str(count)) + unit
+
+
+def main():
+    memory = os.environ.get("EGREGORE_MEMORY", "")
+    author = re.sub(r"[^a-z0-9_-]", "", os.environ.get("EGREGORE_AUTHOR", "").strip().lower())
+    sessions = Path(memory) / "sessions" if memory else None
+    if not author or sessions is None or not sessions.is_dir():
+        return 0
+    today = datetime.date.today()
+    priced = dict.fromkeys(LABELS.values(), 0.0)
+    unpriced, tokens, seen = 0, 0, set()
+    for offset in range(DAYS):
+        day = today - datetime.timedelta(days=offset)
+        try:
+            paths = sorted((sessions / day.strftime("%Y-%m")).glob(day.strftime("%d-") + author + "-*.md"))
+        except OSError:
+            continue
+        for path in paths:
+            try:
+                with path.open("rb") as stream:
+                    text = stream.read(READ_LIMIT).decode("utf-8", errors="replace")
+            except OSError:
+                continue
+            meta = front_matter(text)
+            owner = str(meta.get("from", "")).strip().lower()
+            # Producer-bearing records are never a person's session, including
+            # malformed metadata and records copied without a private adapter.
+            if any(key.strip().strip("\"'").casefold() in
+                   {"producer", "producer_principal_id", "producer_identity", "record_owner_actor_id", "subject_kind"}
+                   and (key != "subject_kind" or value != "human-session") for key, value in meta.items()):
+                continue
+            session = str(meta.get("session", path.name))
+            if meta.get("kind") != "session-record" or owner != author or session in seen:
+                continue
+            seen.add(session)
+            source = meta.get("cost_source", "estimate")
+            if source in PRICED:
+                harness = "codex" if source == "list price" else str(meta.get("harness") or "claude").lower()
+                priced[LABELS.get(harness, "Other")] += amount(meta.get("cost_usd"))
+                continue
+            unpriced += 1
+            match = TOKENS.search(text.partition("\n## Cost\n")[2])
+            tokens += int(match.group(1)) if match else 0
+    parts = []
+    total = sum(priced.values())
+    if round(total, 2) > 0:
+        split = ", ".join(f"{label} ${value:,.2f}" for label, value in priced.items() if round(value, 2) > 0)
+        parts.append(f"${total:,.2f} priced ({split})")
+    if unpriced:
+        part = f"{unpriced} unpriced session" + ("" if unpriced == 1 else "s")
+        parts.append(part + (f", {compact(tokens)} input tokens" if tokens else ""))
+    if parts:
+        print("7 days: " + " · ".join(parts))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/runtime/pi/bin/reflexes/40-shells.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Reflex: refused shell shapes. Show tier.
+
+Reads yesterday's session records of the current person and sums the
+`worktree-guard refusals` counter from their Friction sections. Three or
+more prints one line with the count and the pointer to the plain forms.
+"""
+import datetime
+import os
+import re
+import sys
+from pathlib import Path
+
+COUNTER = re.compile(r"^- worktree-guard refusals: (\d+)\s*$", re.M)
+FROM = re.compile(r"^from:\s*(.+?)\s*$", re.M)
+
+
+def main():
+    memory = os.environ.get("EGREGORE_MEMORY", "")
+    author = os.environ.get("EGREGORE_AUTHOR", "").strip().casefold()
+    sessions = Path(memory) / "sessions" if memory else None
+    if sessions is None or not sessions.is_dir():
+        return 0
+    yesterday = datetime.date.today() - datetime.timedelta(days=1)
+    folder = sessions / yesterday.strftime("%Y-%m")
+    total, files = 0, 0
+    try:
+        paths = sorted(folder.glob(yesterday.strftime("%d-") + "*.md"))
+    except OSError:
+        return 0
+    for path in paths:
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")[:200000]
+        except OSError:
+            continue
+        head = text.partition("\n---")[0]
+        owner = FROM.search(head)
+        if author and owner and owner.group(1).strip("\"'").casefold() != author:
+            continue
+        match = COUNTER.search(text)
+        if match:
+            total += int(match.group(1))
+            files += 1
+    if total >= 3:
+        noun = "session" if files == 1 else "sessions"
+        print(f"{total} refused shell commands yesterday across {files} {noun} · plain forms: .claude/context/plain-shell.md")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())