create-egregore 0.21.6 → 0.22.0

package/runtime/codex/bin/search.sh

@@ -10,6 +10,7 @@
 #   bash bin/search.sh start
 #   bash bin/search.sh stop
 #   bash bin/search.sh open memory/path/to/source.md
+#   bash bin/search.sh mind publish
 #
 # The shell owns the established user-facing output. Retrieval infrastructure
 # is isolated behind the Egregore Retriever adapter.
@@ -47,6 +48,28 @@ _elapsed_s() {
   awk -v ms="$(( $(_now_ms) - $1 ))" 'BEGIN { printf "%.1f", ms / 1000 }'
 }
 
+# Run a Runtime operation as an OpenTelemetry span when the harness traces
+# this process (it exports TRACEPARENT). Untraced calls take the plain path.
+# Usage: _traced <span-name> <original-args-array-name> <command...>
+_traced() {
+  local name="$1" argv_ref="$2[@]"; shift 2
+  if [ -z "${TRACEPARENT:-}" ]; then "$@"; return $?; fi
+  local start out rc results degraded stale
+  start=$(_now_ms)
+  out=$(mktemp "${TMPDIR:-/tmp}/egregore-span.XXXXXX")
+  "$@" | tee "$out"
+  rc=${PIPESTATUS[0]}
+  results=$(grep -cE '^[0-9]+\. ' "$out" 2>/dev/null)
+  degraded=false; grep -q 'Search degraded' "$out" 2>/dev/null && degraded=true
+  stale=$(sed -nE 's/^Note: ([0-9]+) eligible document.*/\1/p' "$out" 2>/dev/null | head -1)
+  rm -f "$out"
+  ( python3 "$SCRIPT_DIR/bin/lib/otel_span.py" --name "$name" --start-ms "$start" \
+      --end-ms "$(_now_ms)" --rc "$rc" --attr "egregore.search.results=${results:-0}" \
+      --attr "egregore.search.degraded=$degraded" --attr "egregore.search.stale_documents=${stale:-}" \
+      --argv -- ${!argv_ref+"${!argv_ref}"} >/dev/null 2>&1 & ) 2>/dev/null
+  return "$rc"
+}
+
 _result_paths() {
   local line path canonical_prefix
   canonical_prefix="**file:** \`memory/"
@@ -71,7 +94,7 @@ _result_paths() {
 # calls there. The dormant graph configuration is preserved untouched for
 # rollback only.
 _upgrade_instance_key() {
-  # Mirrors egregore_runtime.upgrade.instance_key: stable org identity
+  # Mirrors egregore_runtime.installation.installation_key: stable org identity
   # composed with the main installation path. No org_id → fail closed.
   local org main gitdir
   org=$(jq -r '.org_id // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
@@ -371,11 +394,12 @@ case "${1:-}" in
     for arg in "$@"; do
       if [ "$arg" = --context-packet ]; then FIND_ARGS+=(--private-result); else FIND_ARGS+=("$arg"); fi
     done
-    _runtime find "${FIND_ARGS[@]}"
+    _traced egregore.search.find FIND_ARGS _runtime find "${FIND_ARGS[@]}"
     ;;
   investigate) shift; cmd_investigate "$@" ;;
   start) shift; _runtime start "$@" ;;
   stop) shift; _runtime stop "$@" ;;
+  mind) shift; _runtime mind "$@" ;;
   open)
     shift
     OPEN_PACKET=0; OPEN_PATHS=()
@@ -393,19 +417,21 @@ case "${1:-}" in
     [ "$OPEN_PACKET" = 1 ] && OPEN_BINDING+=(--private-result)
     # Older Bash treats an empty array as unset under nounset. Optional flags
     # must expand to zero arguments without requiring an explicit episode ID.
-    _runtime open ${OPEN_PATHS[@]+"${OPEN_PATHS[@]}"} ${OPEN_BINDING[@]+"${OPEN_BINDING[@]}"}
+    OPEN_ARGS=(${OPEN_PATHS[@]+"${OPEN_PATHS[@]}"} ${OPEN_BINDING[@]+"${OPEN_BINDING[@]}"})
+    _traced egregore.search.open OPEN_ARGS _runtime open ${OPEN_ARGS[@]+"${OPEN_ARGS[@]}"}
     ;;
   help|-h|--help)
     cat <<'USAGE'
-usage: bash bin/search.sh {find|investigate|query|handoffs|reindex|install|start|stop|status|readiness|open}
+usage: bash bin/search.sh {find|investigate|query|handoffs|reindex|install|start|stop|status|readiness|open|mind}
   find "terms" [--kind keyword|semantic|hybrid|filename|literal|dates] [--recent-days N]
   open memory/path.md [memory/other.md ...] [--offset N] [--length N]
   handoffs --mine --status open --order newest --limit 1 --open
   handoffs [--addressed-to NAME|--sent|--sent-by NAME] [--status STATUS] [--order newest|oldest] [--limit N] [--json]
+  mind publish
 USAGE
     ;;
   *)
-    echo "usage: bash bin/search.sh {find|investigate|query|handoffs|reindex|install|start|stop|status|readiness|open}" >&2
+    echo "usage: bash bin/search.sh {find|investigate|query|handoffs|reindex|install|start|stop|status|readiness|open|mind}" >&2
     exit 1
     ;;
 esac

package/runtime/codex/bin/session-autosave.sh

@@ -133,9 +133,12 @@ if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   fi
   if [ -n "$(git -C "$DIR/memory" log origin/main..HEAD --oneline 2>/dev/null)" ]; then
     for _try in 1 2 3; do
-      if git -C "$DIR/memory" pull --rebase origin main --quiet 2>/dev/null \
-         && git -C "$DIR/memory" push origin main --quiet 2>/dev/null; then
-        break
+      if git -C "$DIR/memory" pull --rebase origin main --quiet 2>/dev/null; then
+        if bash "$SCRIPT_ROOT/bin/memory-push.sh" --repository "$DIR/memory" --branch main >/dev/null 2>&1; then
+          break
+        else
+          case "$?" in 75) ;; *) break ;; esac
+        fi
       fi
       sleep 1
     done

package/runtime/codex/bin/session-id.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# session-id.sh — the calling harness session's own Egregore session id.
+#
+# Every session start mints an Egregore session id and writes it to the
+# checkout's .egregore-session-id, which each worktree links to. With several
+# sessions open on one machine, the latest start owns that file, so a commit
+# that reads it can carry another session's Egregore-Session trailer. This
+# script keeps one small map file per harness session and resolves the
+# caller's own id from the native session id its harness exports.
+#
+#   session-id.sh [--root DIR]
+#       Print the caller's Egregore session id; print nothing and exit 1
+#       when there is none. A native id in the environment whose map was
+#       recorded for DIR's repository wins; otherwise DIR/.egregore-session-id.
+#   session-id.sh record <harness> <native-id> <egregore-id> [--root DIR]
+#       Map a starting session (bin/lib/identity.sh), replacing an old map.
+#   session-id.sh bind <harness> <native-id> [--root DIR]
+#       Map a session first seen after its start (a Codex thread, at its
+#       first prompt) to the id it resolves to now. A map this repository
+#       can use is kept; one recorded for a moved checkout is replaced.
+#
+# Native ids, in order: EGREGORE_NATIVE_SESSION_ID under
+# EGREGORE_NATIVE_HARNESS (Claude, Pi and Prime tool commands), then
+# CLAUDE_CODE_SESSION_ID, then CODEX_THREAD_ID. A Codex worker started from a
+# Claude or Pi shell inherits that shell's ids and so resolves to the session
+# that started it.
+#
+# Map files: ~/.egregore/sessions/<harness>-<native-id>.id, two lines: the
+# Egregore id and the repository's physical git common dir, so a map never
+# applies to another repository (a test fixture, another instance). Names are
+# checked, never rewritten. Each record prunes maps unused for 30 days; every
+# resolve and bind that uses a map marks it used.
+set -u
+export LC_ALL=C
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+MAP_DIR=""
+[ -z "${HOME:-}" ] || MAP_DIR="$HOME/.egregore/sessions"
+SCOPE=""
+
+usage() {
+  awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "$0"
+}
+
+valid_harness() {
+  case "$1" in ''|*[!a-z0-9]*) return 1 ;; esac
+  [ "${#1}" -le 16 ]
+}
+
+valid_native() {
+  case "$1" in ''|.*|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  [ "${#1}" -le 128 ]
+}
+
+valid_session() {
+  case "$1" in ''|*[[:cntrl:]]*) return 1 ;; esac
+  [ "${#1}" -le 200 ]
+}
+
+# The repository's git common dir, physical, so worktrees and every spelling
+# of one checkout agree.
+scope_of() {
+  local dir
+  dir="$(git -C "$1" rev-parse --git-common-dir 2>/dev/null)" || return 1
+  case "$dir" in /*) ;; *) dir="$1/$dir" ;; esac
+  (cd "$dir" 2>/dev/null && pwd -P)
+}
+
+# Print a map's Egregore id when the map belongs to this repository, and mark
+# it used so the age prune spares a session that is still working.
+lookup() {
+  local harness="$1" native="$2" file id="" scope=""
+  [ -n "$MAP_DIR" ] && valid_harness "$harness" && valid_native "$native" || return 1
+  file="$MAP_DIR/$harness-$native.id"
+  [ -f "$file" ] || return 1
+  { IFS= read -r id; IFS= read -r scope; } < "$file" 2>/dev/null
+  valid_session "$id" && [ -n "$scope" ] || return 1
+  [ -n "$SCOPE" ] || SCOPE="$(scope_of "$ROOT_DIR")" || return 1
+  [ "$scope" = "$SCOPE" ] || return 1
+  touch -c "$file" 2>/dev/null   # -c: a map pruned meanwhile stays gone, never empty
+  printf '%s\n' "$id"
+}
+
+resolve() {
+  local id=""
+  if [ -n "${EGREGORE_NATIVE_SESSION_ID:-}" ] && [ -n "${EGREGORE_NATIVE_HARNESS:-}" ]; then
+    if lookup "$EGREGORE_NATIVE_HARNESS" "$EGREGORE_NATIVE_SESSION_ID"; then return 0; fi
+  fi
+  if [ -n "${CLAUDE_CODE_SESSION_ID:-}" ]; then
+    if lookup claude "$CLAUDE_CODE_SESSION_ID"; then return 0; fi
+  fi
+  if [ -n "${CODEX_THREAD_ID:-}" ]; then
+    if lookup codex "$CODEX_THREAD_ID"; then return 0; fi
+  fi
+  [ -f "$ROOT_DIR/.egregore-session-id" ] || return 1
+  IFS= read -r id < "$ROOT_DIR/.egregore-session-id" 2>/dev/null
+  valid_session "$id" || return 1
+  printf '%s\n' "$id"
+}
+
+record() {
+  local harness="$1" native="$2" id="$3" scope tmp
+  [ -n "$MAP_DIR" ] && valid_harness "$harness" && valid_native "$native" && valid_session "$id" || return 1
+  scope="$(scope_of "$ROOT_DIR")" && [ -n "$scope" ] || return 1
+  mkdir -p "$MAP_DIR" 2>/dev/null || return 1
+  tmp="$MAP_DIR/.$harness-$native.$$"
+  printf '%s\n%s\n' "$id" "$scope" > "$tmp" 2>/dev/null \
+    && mv -f "$tmp" "$MAP_DIR/$harness-$native.id" 2>/dev/null || { rm -f "$tmp"; return 1; }
+  find "$MAP_DIR" -maxdepth 1 -type f \( -name '*.id' -o -name '.*' \) -mtime +30 \
+    -exec rm -f {} + 2>/dev/null
+  return 0
+}
+
+bind() {
+  local harness="$1" native="$2" id
+  [ -n "$MAP_DIR" ] && valid_harness "$harness" && valid_native "$native" || return 1
+  # A map this repository can use is kept; one recorded for a checkout that
+  # has since moved is replaced rather than left unusable.
+  lookup "$harness" "$native" >/dev/null && return 0
+  id="$(resolve)" || return 1
+  record "$harness" "$native" "$id"
+}
+
+ARGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root)
+      [ -n "${2:-}" ] || { echo "session-id.sh: --root needs a directory" >&2; exit 2; }
+      ROOT_DIR="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) ARGS+=("$1"); shift ;;
+  esac
+done
+set -- ${ARGS[@]+"${ARGS[@]}"}
+
+case "${1:-resolve}" in
+  resolve)
+    [ $# -le 1 ] || { usage >&2; exit 2; }
+    resolve ;;
+  record)
+    [ $# -eq 4 ] || { usage >&2; exit 2; }
+    record "$2" "$3" "$4" ;;
+  bind)
+    [ $# -eq 3 ] || { usage >&2; exit 2; }
+    bind "$2" "$3" ;;
+  *) usage >&2; exit 2 ;;
+esac

package/runtime/codex/bin/session-log.sh

@@ -21,6 +21,25 @@ INPUT=$(cat /dev/stdin 2>/dev/null || echo "{}")
 SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null || true)
 TRANSCRIPT_PATH=$(echo "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null || true)
 
+# Route known native transcript locations before reading their contents.
+RUNTIME=$(printf '%s' "$INPUT" | jq -r '.runtime // empty' 2>/dev/null || true)
+RECORD_TRANSCRIPT=false
+if [ -n "${HOME:-}" ]; then
+  if [[ "$TRANSCRIPT_PATH" == "$HOME/.claude/projects/"* ]] && \
+      printf '%s' "$INPUT" | jq -e 'has("hook_event_name")' >/dev/null 2>&1; then
+    RECORD_TRANSCRIPT=true
+  elif { [ "$RUNTIME" = pi ] && [[ "$TRANSCRIPT_PATH" == "$HOME/.pi/agent/sessions/"* ]]; } || \
+       { [ "$RUNTIME" = prime ] && [[ "$TRANSCRIPT_PATH" == "$HOME/.prime/agent/sessions/"* ]]; }; then
+    RECORD_TRANSCRIPT=true
+  fi
+fi
+if [ "$RECORD_TRANSCRIPT" = true ]; then
+  source "$SCRIPT_DIR/bin/lib/config.sh"
+  if _session_records_enabled; then
+    exec bash "$SCRIPT_DIR/bin/session-record.sh" --mode end <<< "$INPUT"
+  fi
+fi
+
 if [ -z "$SESSION_ID" ]; then
   exit 0
 fi

package/runtime/codex/bin/session-record.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Session-record admission is silent and detached for hooks. Python uses only
+# the standard library. Summarizer flags (all checked against claude --help):
+# Private trails, durable holds, stamps and locks live in $HOME/.egregore/trails.
+# --tools "" --strict-mcp-config --mcp-config '{"mcpServers":{}}'
+# --setting-sources "" --model MODEL --output-format text -p PROMPT
+# Built-in tools, MCP servers, project settings, hooks and plugins are disabled,
+# so the call is a single turn without a separate turn-limit flag.
+# A CLI missing any isolation flag (including the empty --tools allowlist)
+# is never invoked for a build; the record is deterministic instead.
+# Checkpoints only write the record file in the memory working tree. Session
+# end commits and pushes it with this person's earlier uncommitted records.
+# --mode sweep always refreshes local counts in a detached worker. Publication
+# requires an answered offer and enabled recording; only publication is
+# debounced for six hours unless --force is supplied.
+# Publications and hold markers use the same canonical memory lock; holds wait
+# for an active publication, then redact going forward without rewriting history.
+# The one thing a hook prints: at a checkpoint, the session's cost line, once
+# per mark ($200 priced, or ten million Codex input tokens) at the next stop.
+# Descriptor 3 carries the hook's stdout past the silenced streams for it.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)" || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+[ -n "${HOME:-}" ] || exit 0
+exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" record --root "$SCRIPT_DIR" --notice-fd 3 "$@" 3>&1 >/dev/null 2>&1

package/runtime/codex/bin/settings.sh

@@ -23,6 +23,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 
 # ── helpers ──────────────────────────────────────────────────────────────
 
@@ -54,7 +56,7 @@ _save() {
 # start's settings sync (bin/lib/settings-drift.sh).
 _control_plane_push() {
   local api_url api_key payload actor response revision
-  api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
+  api_url=$(_config_api_url) || return 0
   [ -n "$api_url" ] || return 0
   api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
@@ -70,10 +72,13 @@ _control_plane_push() {
     --data-binary "$payload" 2>/dev/null) || return 0
   revision=$(printf '%s' "$response" | jq -r '.settings_revision // empty' 2>/dev/null)
   if [ -n "$revision" ] && [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
-    local st
-    st="$(mktemp "$SCRIPT_DIR/.egregore-state.json.XXXXXX")" || return 0
-    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$SCRIPT_DIR/.egregore-state.json" > "$st" 2>/dev/null && [ -s "$st" ]; then
-      mv "$st" "$SCRIPT_DIR/.egregore-state.json"
+    local st state_file
+    # A worktree links the checkout's state file: the rename lands on the
+    # file it points to, so the link stays and the installation keeps one state.
+    state_file="$(realpath "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)" || state_file="$SCRIPT_DIR/.egregore-state.json"
+    st="$(mktemp "$state_file.XXXXXX")" || return 0
+    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$state_file" > "$st" 2>/dev/null && [ -s "$st" ]; then
+      mv "$st" "$state_file"
     else
       rm -f "$st"
     fi
@@ -394,7 +399,7 @@ _people_file() {
   fi
   ( cd "$SCRIPT_DIR/memory" 2>/dev/null && git add -A people/ 2>/dev/null \
       && git commit -q -m "chore(settings): $op $user in people" 2>/dev/null \
-      && git push -q 2>/dev/null ) || true
+      && bash "$SCRIPT_DIR/bin/memory-push.sh" --repository "$SCRIPT_DIR/memory" --branch main >/dev/null 2>&1 ) || true
 }
 
 cmd_people() {
@@ -469,7 +474,7 @@ set -- "${_args[@]+"${_args[@]}"}"
 # ── privacy & access (read snapshot) ─────────────────────────────────────
 # One composed JSON for the Settings Privacy & access panel. Identity,
 # membership, and capability values come from the Runtime authorization
-# backend (access-status); this shell layer adds only committed boundary
+# backend (access show --json); this shell layer adds only committed boundary
 # config, the personal boundary-local file, isolation state, and honest
 # constant statements. Never includes secrets, tokens, or internal paths.
 
@@ -499,7 +504,7 @@ cmd_privacy() {
   local access posture locked org_reads personal_reads denied digest graph
   access=$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" \
     PYTHONSAFEPATH=1 PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
-    python3 -m egregore_runtime.harness_cli access-status 2>/dev/null) || true
+    python3 -m egregore_runtime.harness_cli access show --json 2>/dev/null) || true
   printf '%s' "$access" | jq -e . >/dev/null 2>&1 || access='{"status":"attention"}'
   posture=$(jq -r '.boundary.posture // "standard"' "$CONFIG" 2>/dev/null || echo standard)
   locked=$(jq -r 'if (.boundary.locked // false) == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo false)

package/runtime/codex/bin/spirit-discovery-claude.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="claude"))' "$@"

package/runtime/codex/bin/spirit-discovery-codex.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="codex"))' "$@"

package/runtime/codex/bin/spirit-discovery-pi.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="pi"))' "$@"

package/runtime/codex/bin/spirit-discovery-prime.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="prime"))' "$@"

package/runtime/codex/bin/spirit-discovery.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime=None))' "$@"

package/runtime/codex/bin/startup-check.sh

@@ -13,7 +13,6 @@ STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
 [ -f "$ENV_FILE" ] || exit 0
 
 # --- Read config ---
-API_URL=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
 MODE=$(jq -r '.mode // "local"' "$CONFIG" 2>/dev/null)
 CONFIG_SLUG=$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)
 ORG_NAME=$(jq -r '.org_name // empty' "$CONFIG" 2>/dev/null)
@@ -21,6 +20,7 @@ GITHUB_ORG=$(jq -r '.github_org // empty' "$CONFIG" 2>/dev/null)
 
 # shellcheck source=bin/lib/config.sh
 source "$SCRIPT_DIR/bin/lib/config.sh"
+API_URL=$(_config_api_url)
 
 # Runtime telemetry and diagnostics remain on-device by default. Historical
 # Connected health reporting is retained only as an explicit operator action;

package/runtime/codex/bin/telemetry.sh

@@ -7,6 +7,8 @@ set -euo pipefail
 umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 if [ -n "${EGREGORE_TELEMETRY_DIR:-}" ]; then
   BUFFER_DIR="$EGREGORE_TELEMETRY_DIR"
 else
@@ -516,12 +518,16 @@ cmd_export() {
 _resolve_share_target() {
   local requested_endpoint="$1"
   if [ -n "$requested_endpoint" ]; then
-    printf '%s\n' "$requested_endpoint"
-    return
+    # An explicit endpoint never gets the org key (cmd_share adds it only for
+    # the configured sink), so it needs the retired host mapped and nothing
+    # more; any other address goes to cmd_share's scheme check as typed.
+    _hosted_api_target "$requested_endpoint" 2>/dev/null || printf '%s\n' "$requested_endpoint"
+    return 0
   fi
   local api_url="" api_key=""
   if [ -f "$CONFIG" ]; then
-    api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null || true)
+    # A refused saved address names no sink: never fall through to the relay.
+    api_url=$(_hosted_api_url "$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null || true)") || return 0
   fi
   if [ -f "$ENV_FILE" ]; then
     api_key=$(grep '^EGREGORE_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)
@@ -691,7 +697,8 @@ cmd_share() {
     : > "$share_file"
   fi
 
-  local curl_args=(-s -o /dev/null -w '%{http_code}' -X POST "$endpoint"
+  # -q first (no ~/.curlrc), --globoff: the endpoint reaches the one host it names.
+  local curl_args=(-q --globoff -s -o /dev/null -w '%{http_code}' -X POST "$endpoint"
     -H "Content-Type: application/x-ndjson" --data-binary "@$share_file" --max-time 15)
   local api_key="" configured_endpoint=""
   configured_endpoint=$(_resolve_share_target "")

package/runtime/codex/bin/test-baseline.sh

@@ -39,6 +39,9 @@ json=false
 head_first=false
 strict_head=false
 timeout=""
+# A suite may declare a longer deadline than --timeout, up to 900 seconds,
+# with a line "# test-baseline: timeout=N" in its first 30 lines.
+child_limit=""
 selected=()
 add_suite() {
   local existing
@@ -147,8 +150,23 @@ run_dir=$(mktemp -d "${TMPDIR:-/tmp}/qa-baseline.XXXXXX") || error "cannot creat
 # Use the physical spelling consistently in Git, logs, and failure normalization.
 run_dir=$(cd -P "$run_dir" && pwd)
 mkdir -p "$run_dir/logs/base" "$run_dir/logs/head" || error "cannot create scratch logs"
-if ! git -C "$SCRIPT_DIR" worktree add --detach --quiet "$run_dir/base" "$base_oid" \
-    > "$run_dir/worktree.out" 2> "$run_dir/worktree.err"; then
+# A worktree another run is adding at the same moment can make Git read its
+# half-written entry ("failed to read .git/worktrees/<name>/commondir"), so a
+# failed add is tried again before it counts as an environment failure.
+add_base_tree() {
+  local attempt
+  for attempt in 1 2 3; do
+    if git -C "$SCRIPT_DIR" worktree add --detach --quiet "$run_dir/base" "$base_oid" \
+        > "$run_dir/worktree.out" 2> "$run_dir/worktree.err"; then
+      return 0
+    fi
+    [ "$attempt" -lt 3 ] || return 1
+    git -C "$SCRIPT_DIR" worktree remove --force "$run_dir/base" >/dev/null 2>&1 || true
+    rm -rf "$run_dir/base"
+    sleep "$attempt"
+  done
+}
+if ! add_base_tree; then
   echo 'test-baseline: cannot create the base worktree:' >&2
   cat "$run_dir/worktree.err" >&2
   exit 2
@@ -169,13 +187,14 @@ run_child() {
   set -m
   (cd "$tree" && exec "$@") < /dev/null > "$log" 2>&1 &
   child_pid=$!
-  if [ -n "$timeout" ]; then
+  local limit="${child_limit:-$timeout}"
+  if [ -n "$limit" ]; then
     watched_pid=$child_pid
     (
       # This watchdog owns a separate group, including its sleep process, so
       # normal completion and external interruption cancel the whole timer.
       set +m
-      if ! sleep "$timeout"; then
+      if ! sleep "$limit"; then
         : > "$run_dir/timer-failed"
       fi
       if kill -0 -- "-$watched_pid" 2>/dev/null; then
@@ -270,6 +289,13 @@ for suite in "${selected[@]}"; do
   note=""
   status=""
   runner=""
+  suite_limit="$timeout"
+  if [ -n "$timeout" ] && [ -f "$SCRIPT_DIR/$suite" ]; then
+    declared=$(head -n 30 "$SCRIPT_DIR/$suite" | sed -n 's/^# test-baseline: timeout=\([1-9][0-9]*\)$/\1/p' | head -n 1)
+    if [ -n "$declared" ] && [ "$declared" -gt "$timeout" ]; then
+      suite_limit=$(( declared > 900 ? 900 : declared ))
+    fi
+  fi
   printf 'test-baseline: suite %s\n' "$suite" >&2
   case "$suite" in
     *.sh) runner=bash ;;
@@ -345,7 +371,9 @@ for suite in "${selected[@]}"; do
         bats) command_args=(bats) ;;
       esac
       printf 'test-baseline: %s %s starting\n' "$side" "$suite" >&2
+      child_limit="$suite_limit"
       run_child "$tree" "$run_dir/logs/$side/$log_name" "${command_args[@]}" "./$suite"
+      child_limit=""
       printf 'test-baseline: %s %s exit=%s seconds=%s timed_out=%s\n' \
         "$side" "$suite" "$run_exit" "$run_seconds" "$run_timed_out" >&2
       failure_lines "$run_dir/logs/$side/$log_name" "$run_dir/$side.lines"
@@ -355,7 +383,7 @@ for suite in "${selected[@]}"; do
         head_exit=$run_exit; head_seconds=$run_seconds; head_timed_out=$run_timed_out
       fi
       if $run_timed_out; then
-        status=blocked; note="$side timed out after ${timeout}s"; break
+        status=blocked; note="$side timed out after ${suite_limit}s"; break
       fi
       if $head_first && [ "$side" = head ] && [ "$head_exit" -eq 0 ]; then break; fi
     done

package/runtime/codex/bin/todo.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 export EGREGORE_ROOT="$ROOT"
-export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
+export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(bash "$ROOT/bin/session-id.sh" --root "$ROOT" 2>/dev/null || cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
 export PYTHONSAFEPATH=1 PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}"
 
 exec python3 -m egregore_runtime.todo_cli "$@"

package/runtime/codex/bin/worktree-create.sh

@@ -94,52 +94,22 @@ fi
 # egregore.json
 [ -f "$REPO_ROOT/egregore.json" ] && [ ! -f "$WT_PATH/egregore.json" ] && ln -sfn "$REPO_ROOT/egregore.json" "$WT_PATH/egregore.json"
 
+# Installed tools (node_modules, .egregore/tools), so tests and the renderer
+# run without an install step. Same helper as worktree.sh setup, loaded from
+# this script's own bin/. Its one diagnostic, a link git cannot be made to
+# ignore, goes to stderr, keeping stdout the worktree path only.
+# shellcheck source=bin/lib/worktree-links.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib/worktree-links.sh" && egregore_link_tools "$WT_PATH" "$REPO_ROOT" >&2
+
 # --- Compute boundary for worktree (so isolation hook works) ---
-# session-start.sh doesn't re-run for worktrees, so we compute it here.
-HASH=$(echo -n "$WT_PATH" | md5 2>/dev/null || echo -n "$WT_PATH" | md5sum 2>/dev/null | cut -d' ' -f1)
-BOUNDARY_FILE="/tmp/egregore-boundary-${HASH}.json"
-MEMORY_DIR=""
-[ -L "$WT_PATH/memory" ] && MEMORY_DIR=$(realpath "$WT_PATH/memory" 2>/dev/null || true)
-# Managed repos: include main repo (worktree symlinks resolve there) + sibling repos
-MANAGED_REPOS_JSON="[\"$REPO_ROOT\""
-PARENT_DIR="$(dirname "$REPO_ROOT")"
-_repos=$(jq -r '(.repos[]? // empty) | if type == "object" then .name else . end' "$WT_PATH/egregore.json" 2>/dev/null || true)
-for _r in $_repos; do
-  [[ "$_r" == *".."* ]] && continue
-  _resolved=$(realpath "$PARENT_DIR/$_r" 2>/dev/null || true)
-  [ -z "$_resolved" ] && continue
-  MANAGED_REPOS_JSON="$MANAGED_REPOS_JSON,\"$_resolved\""
-done
-MANAGED_REPOS_JSON="$MANAGED_REPOS_JSON]"
-# Denied paths: shared computation (bin/boundary.sh compute-denied). The main
-# repo is passed as the caller-proven same-instance allowance — this worktree
-# was just created from it and physically shares its git dir — so it stays
-# excluded even on legacy registries whose entries carry no org_id yet.
-DENIED_JSON="[]"
-REGISTRY="$HOME/.egregore/instances.json"
-if [ -f "$REGISTRY" ]; then
-  WT_ORG=$(jq -r '.org_id // empty' "$WT_PATH/egregore.json" 2>/dev/null || true)
-  DENIED_JSON=$(bash "$REPO_ROOT/bin/boundary.sh" compute-denied \
-    "$REGISTRY" "$WT_PATH" "$WT_ORG" "$REPO_ROOT" 2>/dev/null || echo "[]")
-  case "$DENIED_JSON" in "["*) ;; *) DENIED_JSON="[]" ;; esac
-fi
-# Inherit posture, locked, and read roots from the main checkout's boundary
-# cache: a worktree that silently dropped them fell back to `standard` and
-# stopped honoring `locked: true` (found in the 6b.3 enforcement audit).
-MAIN_DIGEST=$(printf '%s' "$REPO_ROOT" | md5 2>/dev/null || printf '%s' "$REPO_ROOT" | md5sum | cut -d' ' -f1)
-MAIN_BOUNDARY="/tmp/egregore-boundary-${MAIN_DIGEST}.json"
-POSTURE_JSON='{}'
-if [ -f "$MAIN_BOUNDARY" ]; then
-  POSTURE_JSON=$(jq -c '{posture: (.posture // "standard"), locked: (.locked // false), read_roots: (.read_roots // [])}' "$MAIN_BOUNDARY" 2>/dev/null || echo '{}')
-fi
-jq -n \
-  --arg project_dir "$WT_PATH" \
-  --arg memory_dir "$MEMORY_DIR" \
-  --argjson managed_repos "$MANAGED_REPOS_JSON" \
-  --argjson denied_paths "$DENIED_JSON" \
-  --argjson inherited "$POSTURE_JSON" \
-  '{project_dir: $project_dir, memory_dir: $memory_dir, managed_repos: $managed_repos, denied_paths: $denied_paths} + $inherited' \
-  > "$BOUNDARY_FILE.tmp" 2>/dev/null && mv "$BOUNDARY_FILE.tmp" "$BOUNDARY_FILE" 2>/dev/null || true
+# session-start.sh doesn't re-run for worktrees, so we compute it here through
+# the shared computation (bin/boundary-guard.cjs write-cache). It recognizes a
+# linked worktree: the main checkout it physically shares a git dir with is the
+# caller-proven same instance (excluded from denied paths even on legacy
+# registries without org_id) and a managed repo, and posture, lock and read
+# roots come from the main checkout's config — a worktree that dropped them
+# fell back to `standard` and stopped honoring `locked: true` (6b.3 audit).
+bash "$REPO_ROOT/bin/node-run.sh" "$REPO_ROOT/bin/boundary-guard.cjs" write-cache "$WT_PATH" >/dev/null 2>&1 || true
 
 # --- Session topic on the graph (fire-and-forget, detached) ---
 # CLAUDE.md used to ask the model to run this after EnterWorktree with a

package/runtime/codex/bin/worktree.sh

@@ -57,6 +57,12 @@ case "$CMD" in
       ln -sfn "$MAIN_DIR/egregore.json" "$WT_PATH/egregore.json"
     fi
 
+    # Installed tools (node_modules, .egregore/tools), through the same helper
+    # as the WorktreeCreate hook; a link git cannot be made to ignore is
+    # reported on stderr.
+    # shellcheck source=bin/lib/worktree-links.sh
+    source "$(dirname "${BASH_SOURCE[0]}")/lib/worktree-links.sh" && egregore_link_tools "$WT_PATH" "$MAIN_DIR"
+
     # Find terminal TTY for statusline matching
     _pid=$$
     _tty=""