create-egregore 0.21.0-runtime-mvp.18 → 0.21.0-runtime-mvp.19

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.18
+// egregore-launcher-version: 0.21.0-runtime-mvp.19
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.18";
+const VERSION = "0.21.0-runtime-mvp.19";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.18",
+  "version": "0.21.0-runtime-mvp.19",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/hooks/memory-read-guard.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# memory-read-guard.sh — PreToolUse hook for Read and Bash.
+#
+# After a Runtime retrieval, memory sources are opened through the private
+# evidence packet — `bash bin/search.sh open <path> --context-packet` — and
+# never dumped into the transcript with cat/sed/head/tail or the Read tool.
+# Instructions alone did not hold (2026-09-03: three `sed -n 1,140p` dumps of
+# memory files right after a clean search), so this hook enforces it.
+#
+# Scope: a retrieval episode. The guard engages only while this session's
+# evidence packet is fresh (written within the last EGREGORE_RETRIEVAL_WINDOW_MIN
+# minutes, default 15). Outside an episode — editing a decision record, a skill
+# reading memory, ordinary work — memory reads are untouched. Edit and Write
+# are never the guard's business. Searching memory with grep passes.
+#
+# Exit 0 = allow, exit 2 = block (reason on stderr). Any unexpected failure
+# falls through to allow; the hook must never block by crashing.
+set -u
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+[ -d "$PROJECT_DIR" ] || exit 0
+INPUT=$(cat 2>/dev/null) || exit 0
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in Bash|Read) ;; *) exit 0 ;; esac
+
+# --- Retrieval episode: this session's packet exists and is fresh ---------
+SESSION=$(cat "$PROJECT_DIR/.egregore-session-id" 2>/dev/null | tr -cd 'A-Za-z0-9_.-')
+[ -n "$SESSION" ] || exit 0
+PACKET="${TMPDIR:-/tmp}/egregore-retrieval-context/$SESSION.context"
+[ -f "$PACKET" ] || exit 0
+WINDOW_MIN="${EGREGORE_RETRIEVAL_WINDOW_MIN:-15}"
+[ -n "$(find "$PACKET" -mmin "-$WINDOW_MIN" 2>/dev/null)" ] || exit 0
+
+_block() {
+  printf 'Egregore: memory sources are opened through the private evidence packet, not printed into the transcript.\n' >&2
+  printf 'Run, one file per call:\n  bash bin/search.sh open %s --context-packet\n' "$1" >&2
+  printf 'Searching with grep is fine; dumping a file with cat/sed/head/tail or the Read tool is not.\n' >&2
+  exit 2
+}
+
+if [ "$TOOL" = "Read" ]; then
+  FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+  [ -n "$FILE" ] || exit 0
+  case "$FILE" in
+    "$PROJECT_DIR"/memory/*) _block "memory/${FILE#"$PROJECT_DIR"/memory/}" ;;
+    memory/*) _block "$FILE" ;;
+  esac
+  # The memory symlink's target (the sibling memory repository) counts too.
+  MEM_REAL=$(readlink -f "$PROJECT_DIR/memory" 2>/dev/null || true)
+  if [ -n "$MEM_REAL" ]; then
+    case "$FILE" in "$MEM_REAL"/*) _block "memory/${FILE#"$MEM_REAL"/}" ;; esac
+  fi
+  exit 0
+fi
+
+# --- Bash: a raw reader applied to a memory path -------------------------
+CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -n "$CMD" ] || exit 0
+case "$CMD" in *bin/search.sh*) exit 0 ;; esac
+MEM_PATH=$(printf '%s' "$CMD" | grep -oE 'memory/[A-Za-z0-9_./@:+-]+' | head -1)
+[ -n "$MEM_PATH" ] || exit 0
+if printf '%s' "$CMD" | grep -qE '(^|[;&|(][[:space:]]*)(cat|sed|head|tail|less|more|awk|bat|nl)([[:space:]]|$)'; then
+  _block "$MEM_PATH"
+fi
+exit 0

package/runtime/claude/.claude/settings.json

@@ -56,6 +56,15 @@
           }
         ]
       },
+      {
+        "matcher": "Read|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/memory-read-guard.sh"
+          }
+        ]
+      },
       {
         "matcher": "Edit|Write|Bash|EnterWorktree|EnterPlanMode",
         "hooks": [

package/runtime/claude/manifest.json

@@ -62,6 +62,7 @@
     ".claude/hooks/branch-guard.sh",
     ".claude/hooks/card-context.sh",
     ".claude/hooks/emissary-detect.sh",
+    ".claude/hooks/memory-read-guard.sh",
     ".claude/hooks/memory-refresh.sh",
     ".claude/hooks/onboarding-guard.sh",
     ".claude/hooks/retrieval-context.sh",