create-egregore 0.21.6 → 0.22.0

package/runtime/claude/.claude/hooks/boundary-check.sh

@@ -1,333 +1,16 @@
 #!/usr/bin/env bash
-# boundary-check.sh — PreToolUse hook for environment isolation
-# Receives tool input JSON on stdin from Claude Code.
-# Exit 0 = allow, exit 2 = block (reason on stderr).
-# Must be fast (<50ms) — no network calls, just path checks.
-#
-# Two-tier model (decided 2026-07-08, harvest-2026-07-08-boundary-hook-refinement):
-#   HARD tier — paths of other Egregore instances (denied_paths): denied for
-#               every tool, always. No consent path exists.
-#   SOFT tier — everything else outside the boundary: consent-gated for every
-#               tool. Grants live in .egregore-boundary-consent (session-scoped,
-#               cleared by session-start) or in config read roots.
-# Posture (strict|standard|open), lock, and read roots are merged at session
-# start from egregore.json .boundary + .egregore-boundary.local.json into the
-# cached boundary JSON. Sessions running with permission_mode=bypassPermissions
-# skip the soft tier (never the hard tier) unless the org boundary is locked.
-
-# No set -e — hook must never accidentally block by crashing
-# If anything fails unexpectedly, fall through to exit 0 (allow)
-
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
-
-# --- Guard: if project dir no longer exists (worktree deleted), allow gracefully ---
-if [ ! -d "$PROJECT_DIR" ]; then
-  exit 0
-fi
-
-# --- Load boundary file (cached at session start) ---
-HASH=$(echo -n "$PROJECT_DIR" | md5 2>/dev/null || echo -n "$PROJECT_DIR" | md5sum 2>/dev/null | cut -d' ' -f1)
-BOUNDARY_FILE="/tmp/egregore-boundary-${HASH}.json"
-
-if [ ! -f "$BOUNDARY_FILE" ]; then
-  # No boundary computed yet (session-start hasn't run) — allow everything
-  exit 0
-fi
-
-# Read boundary once. Empty fields carry a "-" sentinel: tab counts as IFS
-# whitespace, so a genuinely empty @tsv field would collapse and shift every
-# following field left.
-BOUNDARY_JSON=$(cat "$BOUNDARY_FILE" 2>/dev/null) || exit 0
-IFS=$'\t' read -r B_PROJECT_DIR B_MEMORY_DIR POSTURE LOCKED HAS_READ_ROOTS < <(
-  echo "$BOUNDARY_JSON" | jq -r \
-    '[(.project_dir // "" | if . == "" then "-" else . end), (.memory_dir // "" | if . == "" then "-" else . end), (.posture // "standard"), ((.locked // false) | tostring), (has("read_roots") | tostring)] | @tsv' 2>/dev/null
-) || true
-[ "$B_PROJECT_DIR" = "-" ] && B_PROJECT_DIR=""
-[ "$B_MEMORY_DIR" = "-" ] && B_MEMORY_DIR=""
-case "$POSTURE" in strict|standard|open) ;; *) POSTURE="standard" ;; esac
-[ "$LOCKED" = "true" ] || LOCKED="false"
-
-# Read roots: from boundary JSON when present; legacy boundary files (no key)
-# get the inbox defaults, matching the default posture.
-if [ "$HAS_READ_ROOTS" = "true" ]; then
-  READ_ROOTS=$(echo "$BOUNDARY_JSON" | jq -r '.read_roots[]?' 2>/dev/null) || true
-elif [ "$POSTURE" != "strict" ]; then
-  READ_ROOTS="$HOME/Downloads
-$HOME/Desktop"
-else
-  READ_ROOTS=""
-fi
-
-DENIED_PATHS=$(echo "$BOUNDARY_JSON" | jq -r '.denied_paths[]?' 2>/dev/null) || true
-
-CONSENT_FILE="$PROJECT_DIR/.egregore-boundary-consent"
-
-# --- Read tool input from stdin ---
-INPUT=$(cat)
-IFS=$'\t' read -r TOOL_NAME PERM_MODE < <(
-  echo "$INPUT" | jq -r '[(.tool_name // "" | if . == "" then "-" else . end), (.permission_mode // "")] | @tsv' 2>/dev/null
-) || true
-[ "$TOOL_NAME" = "-" ] && TOOL_NAME=""
-
-if [ -z "$TOOL_NAME" ]; then
-  exit 0
-fi
-
-# Yolo inheritance: a session the user runs in bypassPermissions has already
-# declared maximal trust — Egregore doesn't re-ask (soft tier off). The hard
-# tier stays on. An org lock disables this relaxation.
-RELAXED="false"
-if [ "$LOCKED" != "true" ] && [ "$PERM_MODE" = "bypassPermissions" ]; then
-  RELAXED="true"
-fi
-
-# --- Helper: collapse /./ and component/../ sequences lexically ---
-# Used when the target does not exist on disk, so ../ escapes still normalize.
-normalize_lexical() {
-  local p="$1" prev=""
-  while [ "$p" != "$prev" ]; do
-    prev="$p"
-    p=$(printf '%s' "$p" | sed -E 's|/\./|/|g; s|/[^/]+/\.\./|/|; s|/[^/]+/\.\.$||' 2>/dev/null) || p="$prev"
-  done
-  while [[ "$p" == /../* ]]; do p="/${p#/../}"; done
-  [ -z "$p" ] && p="/"
-  printf '%s\n' "$p"
-}
-
-# --- Helper: resolve path ---
-resolve_path() {
-  local path="$1"
-  path="${path/#\~/$HOME}"
-  path="${path/#\$HOME/$HOME}"
-  if [[ "$path" != /* ]]; then
-    path="$PROJECT_DIR/$path"
-  fi
-  local resolved
-  resolved=$(realpath "$path" 2>/dev/null) && { echo "$resolved"; return; }
-  # Target may not exist yet (e.g. a write destination): resolve the nearest
-  # existing ancestor, then fall back to pure lexical normalization.
-  local dir base
-  dir=$(dirname "$path")
-  base=$(basename "$path")
-  resolved=$(realpath "$dir" 2>/dev/null) && { echo "$resolved/$base"; return; }
-  normalize_lexical "$path"
-}
-
-# --- Helper: HARD tier — another instance's path? ---
-# Self-scope carve-out, per entry: an ENCLOSING denied checkout (different or
-# unproven organization identity) never covers the project's own files — the
-# enclosing tree stays denied while the project stays usable. A denied entry
-# nested INSIDE the project is still enforced: residence under the project
-# proves nothing about identity.
-is_denied() {
-  local resolved="$1" denied in_project=1
-  if [ -n "${B_PROJECT_DIR:-}" ] && [[ "$resolved" == "$B_PROJECT_DIR" || "$resolved" == "$B_PROJECT_DIR/"* ]]; then
-    in_project=0
-  fi
-  for denied in $DENIED_PATHS; do
-    if [[ "$resolved" == "$denied" || "$resolved" == "$denied/"* ]]; then
-      if [ "$in_project" = "0" ] && [[ "$B_PROJECT_DIR" == "$denied" || "$B_PROJECT_DIR" == "$denied/"* ]]; then
-        continue
-      fi
-      return 0
-    fi
-  done
-  return 1
-}
-
-# --- Helper: core boundary (no consent needed, all tiers) ---
-in_core_boundary() {
-  local resolved="$1"
-
-  # Always-allowed system paths
-  case "$resolved" in
-    /tmp/*|/tmp|/private/*|/private) return 0 ;;
-    "$HOME/.claude"/*|"$HOME/.claude") return 0 ;;
-    /usr/*|/etc/*|/var/*|/bin/*|/sbin/*|/opt/*) return 0 ;;
-    /dev/*|/dev|/proc/*|/sys/*) return 0 ;;
-    /System/*|/Applications/*|/Library/*) return 0 ;;
-  esac
-
-  # Allow reading instance registry (needed for multi-instance features)
-  if [[ "$resolved" == "$HOME/.egregore"/* ]]; then
-    return 0
-  fi
-
-  # Project directory
-  if [ -n "${B_PROJECT_DIR:-}" ]; then
-    if [[ "$resolved" == "$B_PROJECT_DIR" || "$resolved" == "$B_PROJECT_DIR/"* ]]; then
-      return 0
-    fi
+# boundary-check.sh — Claude Code PreToolUse adapter for environment isolation.
+# Receives tool input JSON on stdin. Exit 0 = allow, exit 2 = block (reason on
+# stderr). The policy itself (two-tier instance wall, posture, consent) lives
+# in bin/boundary-guard.cjs, shared with the Codex hook and the Pi/Prime
+# tool_call gate; bin/boundary-hook.sh starts it and denies when it cannot run.
+# A missing guard blocks (exit 2) rather than failing as a non-blocking error.
+
+ROOT="$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)"
+for file in bin/boundary-hook.sh bin/boundary-guard.cjs; do
+  if [ -z "$ROOT" ] || [ ! -f "$ROOT/$file" ]; then
+    echo "Environment isolation: boundary guard missing ($file) — run /update, then restart the session. Every action is blocked until the guard is back." >&2
+    exit 2
   fi
-
-  # Memory directory
-  if [ -n "${B_MEMORY_DIR:-}" ]; then
-    if [[ "$resolved" == "$B_MEMORY_DIR" || "$resolved" == "$B_MEMORY_DIR/"* ]]; then
-      return 0
-    fi
-  fi
-
-  # Managed repos
-  local repo_paths repo_path
-  repo_paths=$(echo "$BOUNDARY_JSON" | jq -r '.managed_repos[]?' 2>/dev/null) || true
-  for repo_path in $repo_paths; do
-    if [[ "$resolved" == "$repo_path" || "$resolved" == "$repo_path/"* ]]; then
-      return 0
-    fi
-  done
-
-  # Parent directory (for sibling repo operations). Denied paths are checked
-  # before this helper is ever consulted, so no denied check needed here.
-  local parent_dir
-  parent_dir="$(dirname "${B_PROJECT_DIR:-$PROJECT_DIR}")"
-  if [[ "$resolved" == "$parent_dir" || "$resolved" == "$parent_dir/"* ]]; then
-    return 0
-  fi
-
-  return 1
-}
-
-# --- Helper: SOFT tier grants ---
-in_read_roots() {
-  local resolved="$1" root
-  for root in $READ_ROOTS; do
-    if [[ "$resolved" == "$root" || "$resolved" == "$root/"* ]]; then
-      return 0
-    fi
-  done
-  return 1
-}
-
-is_consented() {
-  local resolved="$1" line
-  # A locked org boundary has no consent path — stale grant files are void.
-  [ "$LOCKED" = "true" ] && return 1
-  [ -f "$CONSENT_FILE" ] || return 1
-  while IFS= read -r line; do
-    [ -z "$line" ] && continue
-    line="${line/#\~/$HOME}"
-    if [[ "$resolved" == "$line" || "$resolved" == "$line/"* ]]; then
-      return 0
-    fi
-  done < "$CONSENT_FILE"
-  return 1
-}
-
-# --- Block messages ---
-block_hard() {
-  local resolved="$1"
-  echo "Environment isolation: $resolved belongs to another Egregore instance. Access is denied for every tool and cannot be consented — do not retry and do not attempt via other tools. If the user needs something from it, they must fetch it themselves in that instance." >&2
-  exit 2
-}
-
-block_soft() {
-  local resolved="$1" action="$2" dir
-  dir=$(dirname "$resolved")
-  if [ "$LOCKED" = "true" ]; then
-    echo "Environment isolation: $resolved is outside this instance's boundary and the org boundary is locked (egregore.json boundary.locked) — no consent path exists. Do not retry. Use AskUserQuestion with options: 'Paste contents inline' / 'Move the file into the repo and point me at the new path' / 'Cancel'." >&2
-  else
-    echo "Boundary consent needed: $resolved is outside this instance's $action surface (posture: $POSTURE). Do not retry yet and do not route around via other tools. Ask via AskUserQuestion with exactly these options: 'Allow $dir for this session' (on approval: append $dir as one line to $PROJECT_DIR/.egregore-boundary-consent, then retry) / 'Always allow on this instance' (on approval: add \"$dir\" to the read[] array in $PROJECT_DIR/.egregore-boundary.local.json, then retry) / 'Paste contents inline' / 'Cancel'. Never write a consent grant without the user's explicit approval in this exchange." >&2
-  fi
-  exit 2
-}
-
-# --- Check based on tool type ---
-case "$TOOL_NAME" in
-  Read|Glob|Grep)
-    if [ "$TOOL_NAME" = "Read" ]; then
-      FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null) || true
-    else
-      FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.path // empty' 2>/dev/null) || true
-    fi
-    if [ -z "${FILE_PATH:-}" ]; then
-      exit 0  # No path = CWD = project dir, allowed
-    fi
-
-    RESOLVED=$(resolve_path "$FILE_PATH")
-    is_denied "$RESOLVED" && block_hard "$RESOLVED"
-    in_core_boundary "$RESOLVED" && exit 0
-    [ "$POSTURE" = "open" ] && exit 0
-    [ "$RELAXED" = "true" ] && exit 0
-    in_read_roots "$RESOLVED" && exit 0
-    is_consented "$RESOLVED" && exit 0
-    block_soft "$RESOLVED" "read"
-    ;;
-
-  Edit|Write)
-    FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null) || true
-    if [ -z "${FILE_PATH:-}" ]; then
-      exit 0
-    fi
-
-    RESOLVED=$(resolve_path "$FILE_PATH")
-    is_denied "$RESOLVED" && block_hard "$RESOLVED"
-    in_core_boundary "$RESOLVED" && exit 0
-    # Read roots and posture=open grant reads only — writes always need
-    # consent (or a bypassPermissions session, unless locked).
-    [ "$RELAXED" = "true" ] && exit 0
-    is_consented "$RESOLVED" && exit 0
-    block_soft "$RESOLVED" "write"
-    ;;
-
-  Bash)
-    COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null) || true
-    if [ -z "${COMMAND:-}" ]; then
-      exit 0
-    fi
-
-    # HARD tier — never relaxed by posture or bypassPermissions.
-    # Pass 1: denied instance paths as literals, matched on a path boundary so
-    # a denied path never matches a longer sibling name sharing its prefix.
-    for denied in ${DENIED_PATHS:-}; do
-      # When the project itself sits inside this denied checkout, a literal
-      # match cannot tell the enclosing tree's files from the project's own
-      # (the project path continues the denied prefix). Pass 2 resolves every
-      # path token and enforces these entries with the self-scope carve-out.
-      if [ -n "${B_PROJECT_DIR:-}" ] && [[ "$B_PROJECT_DIR" == "$denied" || "$B_PROJECT_DIR" == "$denied/"* ]]; then
-        continue
-      fi
-      if echo "$COMMAND" | grep -qF "$denied" 2>/dev/null; then
-        DENIED_ESC=$(printf '%s' "$denied" | sed -E 's|[^A-Za-z0-9/_-]|\\&|g' 2>/dev/null) || DENIED_ESC=""
-        if [ -n "$DENIED_ESC" ] && echo "$COMMAND" | grep -qE "${DENIED_ESC}(\$|[^A-Za-z0-9._-])" 2>/dev/null; then
-          block_hard "$denied"
-        fi
-      fi
-    done
-
-    # Pass 2: resolve path-like tokens — absolute, ~, $HOME, ../ traversal,
-    # and plain relative tokens containing a slash (a denied entry can sit
-    # inside the project, so "relative stays inside the project" is not a
-    # safety argument) — and deny any that resolve into a foreign instance.
-    # Relative tokens resolve against the project dir (the tool's working
-    # directory), best effort.
-    HARD_CANDIDATES=$(echo "$COMMAND" | grep -oE '(~|\$HOME)?/[A-Za-z0-9._/-]+|[A-Za-z0-9._/-]*\.\./[A-Za-z0-9._/-]+|[A-Za-z0-9._-]+/[A-Za-z0-9._/-]+' 2>/dev/null | sort -u | head -40) || true
-    for c in $HARD_CANDIDATES; do
-      RESOLVED=$(resolve_path "$c")
-      is_denied "$RESOLVED" && block_hard "$RESOLVED"
-    done
-
-    # SOFT tier: best-effort. Only user-home-area path literals are checked —
-    # system paths are core-allowed and relative paths stay inside the project.
-    # A missed path degrades to "no prompt", never to a hard-tier breach.
-    [ "$POSTURE" = "open" ] && exit 0
-    [ "$RELAXED" = "true" ] && exit 0
-
-    CANDIDATES=$(echo "$COMMAND" | grep -oE '(~|\$HOME|/Users/[A-Za-z0-9._-]+)/[A-Za-z0-9._/-]+' 2>/dev/null | sort -u | head -20) || true
-    for c in $CANDIDATES; do
-      RESOLVED=$(resolve_path "$c")
-      is_denied "$RESOLVED" && block_hard "$RESOLVED"
-      in_core_boundary "$RESOLVED" && continue
-      in_read_roots "$RESOLVED" && continue
-      is_consented "$RESOLVED" && continue
-      block_soft "$RESOLVED" "shell"
-    done
-    ;;
-
-  *)
-    # Other tools (WebFetch, etc.) — allow
-    exit 0
-    ;;
-esac
-
-# Default: allow
-exit 0
+done
+exec bash "$ROOT/bin/boundary-hook.sh" claude

package/runtime/claude/.claude/hooks/memory-read-guard.sh

@@ -28,9 +28,17 @@ WINDOW_MIN="${EGREGORE_RETRIEVAL_WINDOW_MIN:-15}"
 _fresh() { [ -f "$1" ] && [ -n "$(find "$1" -mmin "-$WINDOW_MIN" 2>/dev/null)" ]; }
 NATIVE_SESSION=$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
 EPISODE=""
+# Prompt bindings are kept once per installation: a linked worktree reads its
+# main checkout's store (the same climb as bin/search.sh).
+STORE_ROOT="$PROJECT_DIR"
+if [ -f "$PROJECT_DIR/.git" ]; then
+  GITDIR=$(sed -n 's/^gitdir: //p' "$PROJECT_DIR/.git" 2>/dev/null)
+  case "$GITDIR" in /*|'') ;; *) GITDIR="$PROJECT_DIR/$GITDIR" ;; esac
+  case "$GITDIR" in */.git/worktrees/*) STORE_ROOT="${GITDIR%/.git/worktrees/*}" ;; esac
+fi
 if [ -n "$NATIVE_SESSION" ]; then
   BINDING_KEY=$(printf 'claude:%s' "$NATIVE_SESSION" | shasum -a 256 | cut -d' ' -f1)
-  EPISODE=$(jq -r '.episode_id // empty' "$PROJECT_DIR/.egregore/runtime/bindings/$BINDING_KEY.current" 2>/dev/null)
+  EPISODE=$(jq -r '.episode_id // empty' "$STORE_ROOT/.egregore/runtime/bindings/$BINDING_KEY.current" 2>/dev/null)
 fi
 if [ -n "$EPISODE" ]; then
   STATE_KEY=$(printf '%s' "$EPISODE" | shasum -a 256 | cut -d' ' -f1)

package/runtime/claude/.claude/rules/voice-bedrock.md

@@ -9,6 +9,10 @@ Canonical identity and aesthetic foundation. All voice skills derive from this.
 
 ## Identity Canon
 
+Egregore's durable agents are called **Egregore spirits**. Use research spirit,
+PM spirit, or issue spirit when naming their roles. Pi Durable names the underlying
+execution framework; preserve technical package names and internal identifiers.
+
 Egregore is a shared intelligence layer for organizations using Claude Code. It is infrastructure, not a feature. Not a chatbot, not a wiki, not a tool. A new primitive — nothing like this exists.
 
 What it does: turns the traces of a team's work into persistent collective cognition. Knowledge capture is a byproduct of work, not a separate task. The act of working IS the documentation. Context grows combinatorially across a team, not linearly for one person.
@@ -43,7 +47,7 @@ Egregore speaks in different registers depending on context. The identity is con
 
 Visual rendering skills (not tonal, but aesthetic):
 - `tui-design` — terminal box drawing, sigils, section markers
-- `dark-mode` — browser CSS, warm palette, token system
+- `dark-mode` — browser CSS, theme tokens from the design system
 - `visual-explain` — ASCII diagrams, flow charts
 
 Cross-referencing convention between skills:
@@ -88,6 +92,6 @@ form, and the test suite holds the two in step.
 
 The warmth is real and runs through everything. It is the unifying aesthetic across all registers.
 
-In external prose it coexists with precision in the same sentence. In the terminal it comes from restraint and sigils, not decoration. In the character it comes from genuine curiosity. In product copy it comes from treating the user as a peer, not a customer. In the visual palette it is warm-brown (#1D1611), not cold-black. Terracotta (#D4875A) as accent.
+In external prose it coexists with precision in the same sentence. In the terminal it comes from restraint and sigils, not decoration. In the character it comes from genuine curiosity. In product copy it comes from treating the user as a peer, not a customer. In rendered visuals it comes from restraint, spacing and type, not a brown ground. Colors come from the design system registry (`packages/design-system/themes/registry.json`, default pair `sovereign`).
 
 The tonal palette and the visual palette express the same thing.

package/runtime/claude/.claude/settings.json

@@ -48,7 +48,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "Read|Edit|Write|Bash|Glob|Grep",
+        "matcher": "Read|Edit|Write|NotebookEdit|Bash|Glob|Grep",
         "hooks": [
           {
             "type": "command",

package/runtime/claude/.claude/skills/commit/SKILL.md

@@ -53,14 +53,16 @@ Full spec: `.claude/context/commit-format.md`. Wording:
   paragraph:
 
   ```bash
-  cat .egregore-session-id
+  bash bin/session-id.sh
   git commit -m "feat(mcp): add API key authentication" -m "Egregore-Session: {session-id}
   Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
   ```
 
   Read the id with the first command (a plain command) and paste it as
-  `{session-id}`. When the file is absent, omit the `Egregore-Session` line;
-  use your harness's own identity line. Humans committing by hand skip trailers.
+  `{session-id}`. It prints this session's own id; the shared
+  `.egregore-session-id` names whichever session started last. When it
+  prints nothing, omit the `Egregore-Session` line; use your harness's own
+  identity line. Humans committing by hand skip trailers.
 - One logical change per commit — split when the parts are
   independently revertable.