@tanagram/lore 0.1.54 → 0.1.56

package/README.md

@@ -2,6 +2,41 @@
 
 The command-line interface for Lore.
 
+## Privacy: Lore only uploads from directories you allow
+
+By default the Lore daemon does **not** auto-upload any Claude Code
+session. You have to opt in per directory. This is the consent-first
+contract:
+
+- Sessions whose cwd is not under one of your upload directories are
+  ignored by the daemon — they stay on your machine.
+- The explicit commands (`lore export`, `lore share-codex`,
+  `lore share-cowork`) are user-initiated and bypass the upload-dir
+  gate. You can always opt-in per session.
+- The allowlist lives in `~/.lore/upload_dirs.json` (`~/.lore-dev/` in
+  dev), written with 0600 mode so other users on the same machine can't
+  read it.
+
+Adding directories takes a single keystroke on first login — the TUI
+shows your most-recent Claude Code project cwds with the top three
+pre-checked, and pressing Enter accepts them. After that, manage the
+list with `lore listen`:
+
+```sh
+lore listen create ~/code/projectA            # watch ~/code/projectA
+lore listen create ~/work --org acme          # route work to a non-default org
+lore listen list                              # tabular output
+lore listen list --json                       # for scripts
+lore listen update ~/work --org other-corp    # reassign org
+lore listen delete ~/code/projectA            # stop uploading from
+```
+
+Matching uses path-separator-aware **prefix-tree** semantics, so adding
+`~/code` covers `~/code/projectA`, `~/code/projectA/src`, etc., but
+deliberately does **not** cover `~/code-other`. The most-specific
+matching entry wins, so you can have a broad personal `~/` allow plus a
+narrower `~/work` override that routes to a different org.
+
 ## Interactive TUI
 
 Running `lore` with no subcommand drops you into an interactive Ink
@@ -40,6 +75,9 @@ through Ink in TTY mode:
 - **`lore login`** — three labelled steps (negotiating with WorkOS →
   device code panel → polling), then a success box with the resolved
   LaunchAgent paths. Distinct copy for timed-out / denied / expired.
+  On first login the device-code flow is followed by a one-screen
+  "Configure upload directories" wizard so the daemon has explicit
+  consent to upload anything (see Privacy section above).
 - **`lore enable` / `disable` / `restart`** — spinner with mode-specific
   copy while launchctl works, then a success or error MessageBox.
 - **`lore status`** — two-panel view (health on the left, paths on the
@@ -87,6 +125,14 @@ screens, the presentation/handler split, and the TTY-detection contract.
 - `lore disable` — stops and removes the macOS background uploader.
 - `lore restart` — restarts the macOS background uploader.
 - `lore status` / `lore status --json` — shows background uploader health.
+- `lore listen create <path> [--org <name>]` — allowlist a directory for
+  daemon auto-uploads. Defaults to your active organization; pass
+  `--org` to route a directory at a non-default workspace.
+- `lore listen list [--json]` — print the directories the daemon may
+  auto-upload from, with their target org.
+- `lore listen update <path> --org <name>` — reassign an existing
+  upload directory to a different organization.
+- `lore listen delete <path>` — stop uploading from a directory.
 - `lore organizations list` — calls `/api/whoami` and prints the WorkOS
   organizations the authenticated user currently belongs to.
 - `lore export` — uploads a single Claude Code session on demand and prints a