create-egregore 0.21.6 → 0.22.0

package/runtime/claude/bin/pi-render-spec.mjs

@@ -75,7 +75,6 @@ function adapt(sourceSpec) {
     ["Egregore on Codex", "Egregore on Pi"],
     ["Codex-native", "Pi-native"],
     ["Codex sessions", "Pi sessions"],
-    ["On Codex", "On Pi"],
     ["bin/codex-session-start.sh", "bin/pi-session-start.sh"],
     [".codex/hooks/branch-guard.js", ".pi/extensions/egregore.ts"],
     ["PreToolUse hook (launcher `--enable hooks`)", "`tool_call` gate (loaded after Pi project trust)"],

package/runtime/claude/bin/pi-spirit-discovery.mjs

@@ -0,0 +1,34 @@
+// Pi and Prime share this thin adapter; the reader owns all evidence semantics.
+import { join } from 'node:path';
+export function registerSpiritDiscovery(pi, { root, runtime, Type }) {
+  if (!['pi', 'prime'].includes(runtime)) throw new Error('invalid discovery adapter');
+  pi.registerTool({
+    name: 'egregore_discover_capabilities', label: 'Egregore capabilities',
+    description: 'Inspect local installed-file evidence and separately authenticated spirit capabilities. Read-only; does not grant or execute work.',
+    parameters: Type.Object({ operation: Type.Union(['capabilities.list','capabilities.find','capabilities.describe','capabilities.explain','system.explain'].map(Type.Literal)),
+      query: Type.Optional(Type.String({ maxLength: 200 })), id: Type.Optional(Type.String({ maxLength: 160 })) }, { additionalProperties: false }),
+    async execute(_id, params) {
+      // JSON is argv data; the fixed adapter never accepts a root or runtime selector.
+      if (!params || typeof params !== 'object' || Array.isArray(params)
+        || !['capabilities.list','capabilities.find','capabilities.describe','capabilities.explain','system.explain'].includes(params.operation)) throw new Error('invalid discovery query');
+      const args = [join(root, 'bin', `spirit-discovery-${runtime}.sh`), params.operation];
+      const allowed = params.operation === 'capabilities.find' ? ['operation','query']
+        : ['capabilities.describe','capabilities.explain'].includes(params.operation) ? ['operation','id']
+        : params.operation === 'system.explain' && Object.hasOwn(params,'id') ? ['operation','id'] : ['operation'];
+      if (Object.keys(params).sort().join() !== allowed.sort().join()) throw new Error('invalid discovery query');
+      for (const [field, limit] of [['query', 200], ['id', 160]]) {
+        if (Object.hasOwn(params, field) && (typeof params[field] !== 'string' || !params[field].trim()
+          || Buffer.from(params[field], 'utf8').toString('utf8') !== params[field]
+          || Buffer.byteLength(params[field]) > limit || /[\x00-\x1f\x7f]/.test(params[field]))) throw new Error('invalid discovery query');
+      }
+      if (Object.hasOwn(params,'query')) args.push(params.query);
+      if (Object.hasOwn(params,'id')) args.push(params.id);
+      const response = await pi.exec('bash', args, { timeout: 15000 });
+      if (Number(response.code ?? response.status ?? 0) !== 0) throw new Error('discovery is unavailable');
+      let value;
+      try { value = JSON.parse(response.stdout); } catch { throw new Error('discovery is unavailable'); }
+      if (value.schema !== 'egregore.capability-query/v1') throw new Error('discovery is unavailable');
+      return { content: [{ type: 'text', text: JSON.stringify(value) }], details: value };
+    },
+  });
+}

package/runtime/claude/bin/post-update.sh

@@ -43,6 +43,187 @@ if [ ! -e "$SCRIPT_DIR/egregore_runtime" ] && \
   MIGRATED=1
 fi
 
+# --- Migration: saved hosted address after the October 2026 security reset ---
+# Connected setups before 22 Oct 2026 saved the hosted API's old Railway origin
+# in egregore.json. That origin is retired; requests already resolve it to the
+# hosted API (bin/lib/config.sh), and this rewrites the saved value once so the
+# committed file says where requests go. Only that origin, without a path,
+# changes; other keys, custom origins and Local configs are left alone.
+#
+# The working file and the index copy are handled separately, so /update
+# commits this change and never an unrelated edit someone left in the file.
+# Only the api_url string itself is replaced, byte for byte: formatting, key
+# order, line endings, a byte-order mark and the file mode all stay as they
+# were. An api_url written any other way (escaped, repeated) is left for the
+# person to change by hand. Nothing is rewritten when either copy is Local,
+# when egregore.json is a link (its target may belong to something else; the
+# warning says to change it there), or when the working file is missing or
+# unreadable. Nothing is staged for an untracked, sparse or assume-unchanged
+# file. The index copy is staged first and the working file written second; a
+# failed write restores the index, so the two never disagree about the
+# address. A skip warns on stderr and never stops /update: the resolver
+# already sends every request to the hosted API. Never at session start, where
+# a modified tracked file would stop the startup sync. A source instance
+# (upstream_url "none") skips the update commit, so it is left to the
+# resolver.
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
+address_warn() { echo "  ! $*" >&2; }
+# saved_api_url TEXT — the api_url string jq reads from TEXT, if any.
+saved_api_url() { jq -r '.api_url | strings' 2>/dev/null <<< "$1" || true; }
+# other_keys TEXT — everything jq reads from TEXT apart from api_url.
+other_keys() { jq -cS 'del(.api_url)' 2>/dev/null <<< "$1"; }
+# address_state TEXT — "retired" for a Connected config (the _detect_mode
+# test) whose saved address is the retired origin, "local" for a Local one,
+# "keep" for anything else, including text that is not a JSON object.
+address_state() {
+  local text="$1" saved
+  if ! jq -e 'type == "object"' >/dev/null 2>&1 <<< "$text"; then echo keep; return 0; fi
+  if ! jq -e "$EGREGORE_CONNECTED_JQ" >/dev/null 2>&1 <<< "$text"; then echo local; return 0; fi
+  saved="$(saved_api_url "$text")"
+  if [ "$(jq -r '.upstream_url | strings' 2>/dev/null <<< "$text" || true)" != none ] \
+     && _retired_api_url "$saved" \
+     && [ "$(_hosted_api_url "$saved" 2>/dev/null || true)" = "$EGREGORE_HOSTED_API_ORIGIN" ]; then
+    echo retired
+  else
+    echo keep
+  fi
+}
+# hosted_address_text TEXT — sets ADDRESS_TEXT to TEXT with only its api_url
+# string replaced by the hosted address. Fails, leaving it empty, unless TEXT
+# holds "api_url" exactly once, as a string without escapes that is the value
+# jq reads, and the replacement changes nothing else jq can see.
+hosted_address_text() {
+  local LC_ALL=C
+  local text="$1" key='"api_url"' value_re='^([[:space:]]*:[[:space:]]*")([^"\\]*)"' after updated before_keys after_keys
+  ADDRESS_TEXT=""
+  case "$text" in *"$key"*) ;; *) return 1 ;; esac
+  after="${text#*"$key"}"
+  case "$after" in *"$key"*) return 1 ;; esac
+  [[ "$after" =~ $value_re ]] || return 1
+  [ "${BASH_REMATCH[2]}" = "$(saved_api_url "$text")" ] || return 1
+  updated="${text%%"$key"*}$key${BASH_REMATCH[1]}$EGREGORE_HOSTED_API_ORIGIN\"${after#"${BASH_REMATCH[0]}"}"
+  [ "$(saved_api_url "$updated")" = "$EGREGORE_HOSTED_API_ORIGIN" ] || return 1
+  before_keys="$(other_keys "$text")" && after_keys="$(other_keys "$updated")" \
+    && [ "$before_keys" = "$after_keys" ] || return 1
+  ADDRESS_TEXT="$updated"
+}
+# read_exact FILE — sets EXACT_TEXT to FILE's bytes, trailing newlines kept.
+read_exact() {
+  local text
+  text="$(cat -- "$1" 2>/dev/null && printf .)" || return 1
+  EXACT_TEXT="${text%.}"
+}
+config_path="$SCRIPT_DIR/egregore.json"
+worktree_state=absent
+worktree_text=""
+if [ -L "$config_path" ]; then
+  worktree_state=link
+elif [ -f "$config_path" ]; then
+  if [ -r "$config_path" ] && read_exact "$config_path"; then
+    worktree_text="$EXACT_TEXT"
+    worktree_state="$(address_state "$worktree_text")"
+  else
+    worktree_state=unreadable
+  fi
+fi
+index_state=untracked
+index_stageable=false
+index_entry="$(git -C "$SCRIPT_DIR" ls-files -s -- egregore.json 2>/dev/null || true)"
+index_mode="${index_entry%% *}"
+index_sha="${index_entry#* }"
+index_sha="${index_sha%% *}"
+index_text=""
+case "$index_entry" in
+  100644\ *\ 0$'\t'egregore.json|100755\ *\ 0$'\t'egregore.json)
+    index_text="$(git -C "$SCRIPT_DIR" cat-file blob "$index_sha" 2>/dev/null && printf .)" || index_text=""
+    if [ -n "$index_text" ]; then
+      index_text="${index_text%.}"
+      index_state="$(address_state "$index_text")"
+      # Only a normal entry ("H"): skip-worktree and assume-unchanged files
+      # are set aside from this checkout, so their commits are not ours to make.
+      index_tag="$(git -C "$SCRIPT_DIR" ls-files -v -- egregore.json 2>/dev/null || true)"
+      [ "${index_tag%% *}" = H ] && index_stageable=true
+    else
+      index_state=other
+    fi
+    ;;
+  '') ;;
+  *) index_state=other ;;
+esac
+address_updated=false
+by_hand="set api_url to $EGREGORE_HOSTED_API_ORIGIN by hand"
+if [ "$worktree_state" = link ]; then
+  if read_exact "$config_path" && [ "$(address_state "$EXACT_TEXT")" = retired ]; then
+    address_warn "egregore.json is a link, so its saved hosted address was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Set api_url to it in the file the link points to."
+  fi
+elif [ "$worktree_state" = unreadable ]; then
+  address_warn "egregore.json can't be read, so its saved hosted address wasn't checked. If it names the retired address, $by_hand."
+elif [ "$worktree_state" = local ] || [ "$index_state" = local ]; then
+  if [ "$worktree_state" = retired ] || [ "$index_state" = retired ]; then
+    address_warn "egregore.json is Local in one copy and Connected in the other, so its saved hosted address was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN."
+  fi
+else
+  stage_index=false
+  write_worktree=false
+  if [ "$index_state" = retired ]; then
+    if [ "$worktree_state" = absent ]; then
+      address_warn "egregore.json is missing from this checkout, so its committed hosted address was left as is."
+    elif [ "$index_stageable" != true ]; then
+      address_warn "egregore.json is set aside from this checkout (sparse or assume-unchanged), so its committed hosted address was left as is."
+    else
+      stage_index=true
+    fi
+  fi
+  [ "$worktree_state" != retired ] || write_worktree=true
+  index_new=""
+  worktree_new=""
+  plan_ok=true
+  if [ "$stage_index" = true ]; then
+    if hosted_address_text "$index_text"; then index_new="$ADDRESS_TEXT"; else plan_ok=false; fi
+  fi
+  if [ "$write_worktree" = true ]; then
+    if hosted_address_text "$worktree_text"; then worktree_new="$ADDRESS_TEXT"; else plan_ok=false; fi
+  fi
+  if [ "$plan_ok" != true ]; then
+    address_warn "egregore.json's api_url is written in a way this update can't change safely, so it was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Please $by_hand."
+  elif [ "$stage_index" = true ] || [ "$write_worktree" = true ]; then
+    landed=true
+    index_staged=false
+    if [ "$stage_index" = true ]; then
+      if index_blob="$(printf '%s' "$index_new" | git -C "$SCRIPT_DIR" hash-object -w --no-filters --stdin 2>/dev/null)" \
+         && git -C "$SCRIPT_DIR" update-index --cacheinfo "$index_mode,$index_blob,egregore.json" 2>/dev/null; then
+        index_staged=true
+      else
+        landed=false
+        address_warn "Could not stage the hosted services address, so egregore.json was left as is; requests still use $EGREGORE_HOSTED_API_ORIGIN. Run /update again, or $by_hand."
+      fi
+    fi
+    if [ "$landed" = true ] && [ "$write_worktree" = true ]; then
+      config_mode="$(stat -c '%a' "$config_path" 2>/dev/null || stat -f '%Lp' "$config_path" 2>/dev/null || echo 644)"
+      config_tmp="$(mktemp "$config_path.XXXXXX" 2>/dev/null || true)"
+      if [ -n "$config_tmp" ] && printf '%s' "$worktree_new" > "$config_tmp" \
+         && chmod "$config_mode" "$config_tmp" && mv -f "$config_tmp" "$config_path"; then
+        :
+      else
+        landed=false
+        [ -z "$config_tmp" ] || rm -f "$config_tmp"
+        if [ "$index_staged" = true ] \
+           && ! git -C "$SCRIPT_DIR" update-index --cacheinfo "$index_mode,$index_sha,egregore.json" 2>/dev/null; then
+          address_warn "Could not update the hosted services address in egregore.json, and its staged copy could not be put back; run git restore --staged egregore.json, then $by_hand."
+        else
+          address_warn "Could not update the hosted services address in egregore.json; it is unchanged, and requests still use $EGREGORE_HOSTED_API_ORIGIN."
+        fi
+      fi
+    fi
+    [ "$landed" != true ] || address_updated=true
+  fi
+fi
+if [ "$address_updated" = true ]; then
+  echo "  ✓ Hosted services address updated after the October security reset"
+  MIGRATED=1
+fi
+
 # --- Future migrations go here ---
 # Each migration should:
 # 1. Check if it needs to run (idempotent guard)

package/runtime/claude/bin/prime-render-spec.mjs

@@ -74,7 +74,6 @@ function adapt(sourceSpec) {
     ["Egregore on Codex", "Egregore on Prime Agent"],
     ["Codex-native", "Prime-native"],
     ["Codex sessions", "Prime Agent sessions"],
-    ["On Codex", "On Prime Agent"],
     ["bin/codex-session-start.sh", "bin/prime-session-start.sh"],
     [".codex/hooks/branch-guard.js", ".prime/agent/extensions/egregore.ts"],
     ["PreToolUse hook (launcher `--enable hooks`)", "`tool_call` gate (loaded from the project-local extension)"],

package/runtime/claude/bin/publish-artifact.sh

@@ -25,6 +25,15 @@ set -euo pipefail
 #              Set automatically when publish-references.sh invokes us for a child,
 #              preventing recursion.
 #
+# --expires <days|never>: close the page's link that many days from now (1-365),
+#              or keep it open with never. Left out, a republish keeps the
+#              link's current closing date. Org pages only; close, reopen and
+#              see opens with bin/artifacts.sh close|reopen|opens <id>.
+#
+# --visible-to <@handle|email,...|public>: open the page only to these signed-in
+#              people (Connected only; refused in Local). public reopens it to
+#              anyone with the link; left out, a republish keeps the list.
+#
 # Outputs artifact URL on success, exits silently on soft failure (the server
 # could not be reached).
 # Designed for fire-and-forget use: `bash bin/publish-artifact.sh handoff file.md &`
@@ -40,6 +49,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 
 # --- Parse arguments ---
 TYPE=""
@@ -69,6 +80,8 @@ while [[ $# -gt 0 ]]; do
     --raw-html) RAW_HTML=1; shift ;;
     --allow-admin) ALLOW_ADMIN=1; shift ;;
     --no-references) SKIP_REFERENCES=1; shift ;;
+    --expires) EXPIRES="$2"; shift 2 ;;
+    --visible-to) VISIBLE_TO="$2"; shift 2 ;;
     *)
       if [ -z "$TYPE" ]; then
         TYPE="$1"
@@ -89,6 +102,14 @@ if [ -n "$ARTIFACT_ID" ] && ! [[ "$ARTIFACT_ID" =~ ^[a-zA-Z0-9_-]{1,50}$ ]]; the
   echo "--id must be 1-50 chars, alphanumeric/hyphen/underscore only" >&2
   exit 1
 fi
+if [ -n "${EXPIRES:-}" ] && ! [[ "$EXPIRES" =~ ^([1-9][0-9]{0,2}|never)$ && ( "$EXPIRES" == never || "$EXPIRES" -le 365 ) ]]; then
+  echo "--expires takes a number of days from 1 to 365, or never" >&2
+  exit 1
+fi
+if [ -n "${VISIBLE_TO:-}" ] && ! [[ "$VISIBLE_TO" =~ ^(public|[^,[:space:]]+(,[^,[:space:]]+){0,49})$ ]]; then
+  echo "--visible-to takes @handles or emails separated by commas, or public" >&2
+  exit 1
+fi
 if [ -n "$CANONICAL_ID" ] && ! [[ "$CANONICAL_ID" =~ ^[mh]-[0-9a-f]{12}$ ]]; then
   echo "--canonical-id must be a memory file id (m- or h- and 12 hex characters)" >&2
   exit 1
@@ -115,11 +136,24 @@ if [ ! -f "$CONFIG" ] || ! jq -e 'type == "object"' "$CONFIG" >/dev/null 2>&1; t
   exit 4
 fi
 
-API_URL="${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
+# A refused address stops here: a Connected org's page must never fall back
+# to the public relay because its saved address is not plain.
+if ! API_URL="$(_hosted_api_url "${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}")"; then
+  echo "Not published — nothing left this machine." >&2
+  exit 4
+fi
 API_KEY="${EGREGORE_API_KEY:-}"
 ORG_SLUG="$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)"
 VIEW_BASE="https://egregore.xyz/view"
 
+# A page opened by identity needs the hosted sign-in, so it is org-only. The
+# public relay would show it to anyone with the link: refuse, upload nothing.
+if [ -n "${VISIBLE_TO:-}" ] && { [ -z "$API_URL" ] || [ -z "$API_KEY" ]; }; then
+  echo "Not published — nothing left this machine." >&2
+  echo "--visible-to opens a page by identity, which needs Connected mode. In Local mode, hand over the password-protected file instead." >&2
+  exit 4
+fi
+
 # Resolve "use published renderer" from env first, then egregore.json. The
 # env var lets individuals override per-shell; egregore.json lets an
 # instance (e.g. the upstream dev repo) opt in for every teammate.
@@ -132,7 +166,7 @@ fi
 
 # Public relay for OSS share endpoint. Unauthenticated: anything posted here is
 # readable by anyone holding the URL, for 7 days, with nothing in front of it.
-RELAY_URL="https://api.egregore.xyz"
+RELAY_URL="$EGREGORE_HOSTED_API_ORIGIN"
 
 # --- Artifact hosting off-switch (compliance / privacy) ---
 # An instance can disable ALL egregore.xyz publishing via `bin/settings.sh hosting off`
@@ -166,48 +200,40 @@ if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
   fi
 fi
 
-# --- Admin-content gate (the refusal documented in bin/lib/permissions.sh) --
-# `admin: true` sources — including backtick-referenced memory files — are
-# refused before any render or upload. An authorized admin (stable identity,
-# github.username alias against egregore.json admins) may proceed only with
-# the explicit --allow-admin confirmation, which is separate from and never
-# replaces normal publication approval. This protects the Egregore surface;
-# repository members can still read raw Git files.
-# shellcheck source=bin/lib/permissions.sh
-source "$SCRIPT_DIR/bin/lib/permissions.sh"
-ADMIN_MARKED=()
-if _is_admin_only_file "$FILE"; then
-  ADMIN_MARKED+=("$FILE")
+# --- Held-content gate: a publish is a hand-over -----------------------------
+# The source and every backtick-referenced memory file go through one
+# `access check --hand-over`: every held class is refused to a non-admin,
+# under every policy, and a failed check refuses too. An admin may publish
+# held material only with the explicit --allow-admin confirmation, which is
+# separate from and never replaces normal publication approval.
+MEMORY_REAL="$(cd "$SCRIPT_DIR/memory" 2>/dev/null && pwd -P || true)"
+SOURCE_REAL="$(cd "$(dirname "$FILE")" && pwd -P)/$(basename "$FILE")"
+if [ -n "$MEMORY_REAL" ] && [[ "$SOURCE_REAL" == "$MEMORY_REAL"/* ]]; then
+  SOURCES=("memory/${SOURCE_REAL#"$MEMORY_REAL"/}")
+else
+  SOURCES=("$SOURCE_REAL")
 fi
 if [ "$RAW_HTML" -eq 0 ]; then
   while IFS= read -r ref; do
-    [ -z "$ref" ] && continue
-    rel="${ref#\`}"
-    rel="${rel%\`}"
-    if [ -f "$SCRIPT_DIR/$rel" ] && _is_admin_only_file "$SCRIPT_DIR/$rel"; then
-      ADMIN_MARKED+=("$rel")
-    fi
+    rel="${ref//\`/}"
+    [ -f "$SCRIPT_DIR/$rel" ] && SOURCES+=("$rel")
   done < <(grep -Eo '`memory/[^`[:space:]]+\.(md|html)`' "$FILE" 2>/dev/null | sort -u)
 fi
-if [ "${#ADMIN_MARKED[@]}" -gt 0 ]; then
-  IS_ADMIN="false"
-  ADMIN_JSON=$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" \
-    PYTHONSAFEPATH=1 PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
-    python3 -m egregore_runtime.harness_cli admin-status 2>/dev/null) || true
-  IS_ADMIN=$(printf '%s' "$ADMIN_JSON" | jq -r '.admin // false' 2>/dev/null || echo "false")
-  if [ "$IS_ADMIN" != "true" ]; then
-    echo "publish refused: admin-marked content cannot be published by a non-admin member:" >&2
-    printf '  %s\n' "${ADMIN_MARKED[@]}" >&2
-    echo "(--allow-admin is available to organization admins only)" >&2
-    exit 5
-  fi
-  if [ "$ALLOW_ADMIN" -ne 1 ]; then
-    echo "publish refused: this content is admin-marked:" >&2
-    printf '  %s\n' "${ADMIN_MARKED[@]}" >&2
-    echo "re-run with --allow-admin to confirm publishing admin-marked content" >&2
-    echo "(this confirmation is separate from normal publication approval)" >&2
-    exit 5
-  fi
+HELD_CHECK=0
+CHECKED="$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" PYTHONSAFEPATH=1 \
+  PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+  python3 -m egregore_runtime.harness_cli access check --hand-over "${SOURCES[@]}" 2>/dev/null)" || HELD_CHECK=$?
+if [ "$HELD_CHECK" -ne 0 ] || [ -z "$CHECKED" ]; then
+  echo "publish refused: a non-admin cannot publish held material, or access could not be checked:" >&2
+  printf '%s\n' "$CHECKED" | awk -F '\t' '$3 != "allowed" && NF { print "  " $1 }' >&2
+  exit 5
+fi
+if [ "$ALLOW_ADMIN" -ne 1 ] && printf '%s\n' "$CHECKED" | grep -q ' for everyone else$'; then
+  echo "publish refused: this content is held from everyone but admins:" >&2
+  printf '%s\n' "$CHECKED" | awk -F '\t' '/ for everyone else$/ { print "  " $1 " (" $4 ")" }' >&2
+  echo "re-run with --allow-admin to confirm publishing it" >&2
+  echo "(this confirmation is separate from normal publication approval)" >&2
+  exit 5
 fi
 
 # --- Prepare HTML ---
@@ -291,8 +317,12 @@ fi
 RESPONSE=""
 
 if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
-  # Connected mode: permanent, org-scoped
-  RESPONSE=$(curl -s -X POST "${API_URL}/api/artifacts/publish" \
+  # Connected mode: permanent, org-scoped. A list goes to publish-restricted,
+  # which a server that cannot open pages by identity does not have: it
+  # refuses there instead of ignoring the list and opening the page to all.
+  PUBLISH_PATH="/api/artifacts/publish"
+  [ -z "${VISIBLE_TO:-}" ] || PUBLISH_PATH="/api/artifacts/publish-restricted"
+  RESPONSE=$(curl -s -X POST "${API_URL}${PUBLISH_PATH}" \
     -H "Authorization: Bearer $API_KEY" \
     -F "file=@${TMP_HTML}" \
     -F "artifact_type=${TYPE}" \
@@ -300,9 +330,14 @@ if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
     -F "author=${AUTHOR}" \
     -F "description=${DESCRIPTION}" \
     -F "artifact_id=${ARTIFACT_ID}" \
+    -F "expires_in_days=${EXPIRES:-}" \
+    --form-string "visible_to=${VISIBLE_TO:-}" \
     --max-time 15 2>/dev/null) || true
 else
   # OSS mode: ephemeral, 7-day TTL
+  if [ -n "${EXPIRES:-}" ]; then
+    echo "Note: --expires applies to organization pages; this public copy closes after 7 days." >&2
+  fi
   RESPONSE=$(curl -s -X POST "${RELAY_URL}/api/artifacts/share" \
     -F "file=@${TMP_HTML}" \
     -F "artifact_type=${TYPE}" \
@@ -334,6 +369,9 @@ if [ -n "$RESPONSE" ]; then
     # The server refused (409 for an id another org holds, 400, 413, 503…).
     # A distinct exit code lets callers that report stderr on failure show why.
     DETAIL=$(echo "$RESPONSE" | jq -r 'if (.detail | type) == "string" then .detail else empty end' 2>/dev/null || true)
+    if [ -n "${VISIBLE_TO:-}" ] && { [ "$DETAIL" = "Not Found" ] || [ "$DETAIL" = "Method Not Allowed" ]; }; then
+      DETAIL="the hosted service cannot open pages by identity yet, so nothing was stored."
+    fi
     echo "Not published: ${DETAIL:-the server answered without a URL.}" >&2
     exit 6
   fi
@@ -345,7 +383,16 @@ fi
 #   - parent publish failed (no URL),
 #   - --raw-html (HTML attachments don't embed markdown refs we'd parse),
 #   - --no-references (caller explicitly opts out / recursion guard).
-if [ -n "$URL" ] && [ "$RAW_HTML" -eq 0 ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
+#   - the page opens by identity (its stored list, so a republish that keeps
+#     the list counts): the files it links to would open to anyone.
+RESTRICTED=0
+if [ -n "$URL" ] && [ "$(echo "$RESPONSE" | jq -r '.visible_to | type' 2>/dev/null || true)" = "array" ]; then
+  RESTRICTED=1
+  if [ -n "$REF_IDS" ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
+    echo "Note: the files this page links to were not published; it opens only for the people it is shared with." >&2
+  fi
+fi
+if [ -n "$URL" ] && [ "$RESTRICTED" -eq 0 ] && [ "$RAW_HTML" -eq 0 ] && [ "$SKIP_REFERENCES" -eq 0 ]; then
   EGREGORE_REF_IDS="$REF_IDS" bash "$SCRIPT_DIR/bin/publish-references.sh" "$FILE" >/dev/null 2>&1 &
   disown 2>/dev/null || true
 fi

package/runtime/claude/bin/qa-inventory.sh

@@ -236,7 +236,7 @@ if $requested_tree; then
     ($path | split("/")[-1]) as $basename | .[$basename] += [$path])' \
     "$scratch/head-paths" > "$scratch/head-basenames.json"
 else
-  for suite in "$SCRIPT_DIR"/tests/*.sh "$SCRIPT_DIR"/tests/*.py "$SCRIPT_DIR"/bin/tests/*.sh "$SCRIPT_DIR"/bin/tests/*.mjs; do
+  for suite in "$SCRIPT_DIR"/tests/*.sh "$SCRIPT_DIR"/tests/*.py "$SCRIPT_DIR"/tests/*.mjs "$SCRIPT_DIR"/bin/tests/*.sh "$SCRIPT_DIR"/bin/tests/*.mjs; do
     if [ -L "$suite" ]; then
       suite_paths_skipped=$((suite_paths_skipped + 1))
       continue
@@ -286,7 +286,7 @@ while IFS= read -r -d '' file; do
     code=0
     if $requested_tree; then
       git -C "$SCRIPT_DIR" grep -l -z -F "${patterns[@]}" "$head_oid" -- \
-        ':(top,glob)tests/*.sh' ':(top,glob)tests/*.py' \
+        ':(top,glob)tests/*.sh' ':(top,glob)tests/*.py' ':(top,glob)tests/*.mjs' \
         ':(top,glob)bin/tests/*.sh' ':(top,glob)bin/tests/*.mjs' > "$scratch/hits" || code=$?
       while IFS= read -r -d '' suite; do
         jq -cn --arg suite "${suite#"$head_oid":}" --arg match "$file" \

package/runtime/claude/bin/quest.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 export EGREGORE_ROOT="$ROOT"
-export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
+export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(bash "$ROOT/bin/session-id.sh" --root "$ROOT" 2>/dev/null || cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
 export PYTHONSAFEPATH=1 PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}"
 
 exec python3 -m egregore_runtime.quest_cli "$@"

package/runtime/claude/bin/records.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Personal controls and batch actions for session records.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)" || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+[ -n "${HOME:-}" ] || exit 0
+# The organization's vitals read the records and the gate ledger only.
+[ "${1:-}" = vitals ] && shift && exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" vitals --root "$SCRIPT_DIR" "$@"
+[ "${1:-}" = retrieval ] && shift && exec python3 "$SCRIPT_DIR/bin/lib/retrieval_scorecard.py" --root "$SCRIPT_DIR" "$@"
+exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" records --root "$SCRIPT_DIR" "$@"

package/runtime/claude/bin/reflexes/05-vitals.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# The organization's pulse: sessions by harness, cost, friction and the merge
+# gate's decisions over the last seven days beside the seven before, from the
+# session records and memory/sessions/gate.jsonl. Silent under two sessions.
+# Writes nothing. Contract: bin/reflexes/README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/session_record.py" ] && command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/session_record.py" vitals-line --root "$root" --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/claude/bin/reflexes/10-open-items.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Open items carried from the session records: how many, and the oldest. An
+# ownerless item past three days adds the count and the oldest's age; past
+# seven days the line ends with the command that drafts an issue for it.
+# Reads the records of the last fourteen days and the open-items ledger;
+# writes nothing. Contract: bin/reflexes/README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/session_record.py" ] || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/session_record.py" open-items-line --root "$root" \
+  --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/claude/bin/reflexes/15-retrieval.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Show: this installation's memory lookups and the organization's session reach
+# over seven days. Silent below two lookups or when organization records are off.
+# One line, at most 160 characters; writes nothing. Contract: README.md.
+set -uo pipefail
+root="${EGREGORE_ROOT:-}"
+[ -n "$root" ] && [ -f "$root/bin/lib/retrieval_scorecard.py" ] && command -v python3 >/dev/null 2>&1 || exit 0
+exec python3 "$root/bin/lib/retrieval_scorecard.py" line --root "$root" --memory "${EGREGORE_MEMORY:-$root/memory}"

package/runtime/claude/bin/reflexes/20-nightly.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Reflex, show then propose: the runs of ci.yml on develop, the push run
+# each merge starts and the workflow_dispatch run the nightly dispatcher
+# requests. A run cancelled because a newer merge superseded it is no verdict
+# and is skipped.
+#
+# Silent while the latest finished run is green, or red once. Two or more red
+# runs running name the failing jobs of the latest run; three end with a
+# proposal to give the failure an owner.
+#
+# The answer is cached for six hours in tmp/reflexes/nightly.json, so a warm
+# card makes no gh call. A cold one makes one request, and a second for the
+# failing jobs only when the line will print; both go through gh's own
+# six-hour response cache, which outlives the sweep of tmp/ at session end.
+# Silent when gh or jq is missing, gh is signed out or offline, or the
+# request outlasts the runner's one-second budget.
+set -uo pipefail
+
+ROOT="${EGREGORE_ROOT:-$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)}"
+[ -n "$ROOT" ] && [ -d "$ROOT" ] || exit 0
+CACHE="$ROOT/tmp/reflexes/nightly.json"
+TTL=21600
+BRANCH=develop
+
+command -v jq >/dev/null 2>&1 || exit 0
+now="$(date +%s)"
+
+fresh() {
+  local at
+  at="$(jq -r '.fetched_at // 0 | floor' "$CACHE" 2>/dev/null)" || return 1
+  case "$at" in ''|*[!0-9]*) return 1 ;; esac
+  [ $((at + TTL)) -gt "$now" ]
+}
+
+# Reads run conclusions, latest first; prints how many in a row are red.
+red_streak() {
+  local conclusion count=0 open=1
+  while IFS= read -r conclusion; do
+    [ "$open" -eq 1 ] || continue
+    case "$conclusion" in
+      failure|timed_out|action_required|startup_failure) count=$((count + 1)) ;;
+      *) open=0 ;;
+    esac
+  done
+  printf '%s\n' "$count"
+}
+
+refresh() {
+  local runs jobs='[]' streak latest tmp
+  command -v gh >/dev/null 2>&1 || return 1
+  [ -f "$ROOT/.github/workflows/ci.yml" ] || return 1
+  runs="$(cd "$ROOT" && gh api --cache 6h \
+      "repos/{owner}/{repo}/actions/workflows/ci.yml/runs?branch=$BRANCH&per_page=10" 2>/dev/null \
+    | jq -c '[.workflow_runs[]? | select(.status == "completed" and .conclusion != "cancelled")
+              | {conclusion, createdAt: .created_at, databaseId: .id}] | .[:3]')" || return 1
+  streak="$(jq -r '.[].conclusion' <<<"$runs" | red_streak)"
+  if [ "$streak" -ge 2 ]; then
+    latest="$(jq -r '.[0].databaseId' <<<"$runs")"
+    case "$latest" in ''|*[!0-9]*) return 1 ;; esac
+    jobs="$(cd "$ROOT" && gh api --cache 6h "repos/{owner}/{repo}/actions/runs/$latest/jobs?per_page=100" 2>/dev/null \
+      | jq -c '[.jobs[]? | select(.conclusion == "failure" or .conclusion == "timed_out"
+                                  or .conclusion == "startup_failure" or .conclusion == "action_required")
+                | .name | gsub("\\s*[—–-]*\\s*[0-9a-f]{40}"; "")]')" || return 1
+  fi
+  mkdir -p "${CACHE%/*}" 2>/dev/null || return 1
+  tmp="$(mktemp "${CACHE%/*}/.nightly.XXXXXX" 2>/dev/null)" || return 1
+  if jq -n --argjson at "$now" --arg branch "$BRANCH" --argjson runs "$runs" --argjson jobs "$jobs" \
+       '{fetched_at: $at, branch: $branch, runs: $runs, failing_jobs: $jobs}' >"$tmp" 2>/dev/null; then
+    mv -f "$tmp" "$CACHE" || { rm -f "$tmp"; return 1; }
+  else
+    rm -f "$tmp"
+    return 1
+  fi
+}
+
+render() {
+  local streak prefix suffix="" names="" name budget extra=0
+  streak="$(jq -r '.runs[]?.conclusion' "$CACHE" 2>/dev/null | red_streak)"
+  [ "$streak" -ge 2 ] || return 0
+  [ "$streak" -lt 3 ] || suffix=" · propose an owner: /issue"
+  prefix="$(jq -r '.branch // "develop"' "$CACHE") red $streak runs running: "
+  # The runner cuts a line at 160 characters; keep the proposal inside it.
+  budget=$((160 - ${#prefix} - ${#suffix} - 12))
+  while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    if [ -z "$names" ]; then
+      names="$name"
+    elif [ $((${#names} + 2 + ${#name})) -le "$budget" ]; then
+      names="$names, $name"
+    else
+      extra=$((extra + 1))
+    fi
+  done < <(jq -r '.failing_jobs[]?' "$CACHE" 2>/dev/null)
+  [ "$extra" -eq 0 ] || names="$names and $extra more"
+  [ -n "$names" ] || names="$(jq -r '.runs[0].conclusion // "failure"' "$CACHE")"
+  printf '%s%s%s\n' "$prefix" "$names" "$suffix"
+}
+
+fresh || refresh || exit 0
+render