create-egregore 0.21.0-runtime-mvp.18 → 0.21.0-runtime-mvp.20

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.18
+// egregore-launcher-version: 0.21.0-runtime-mvp.20
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.18";
+const VERSION = "0.21.0-runtime-mvp.20";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.18",
+  "version": "0.21.0-runtime-mvp.20",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/hooks/memory-read-guard.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# memory-read-guard.sh — PreToolUse hook for Read and Bash.
+#
+# After a Runtime retrieval, memory sources are opened through the private
+# evidence packet — `bash bin/search.sh open <path> --context-packet` — and
+# never dumped into the transcript with cat/sed/head/tail or the Read tool.
+# Instructions alone did not hold (2026-09-03: three `sed -n 1,140p` dumps of
+# memory files right after a clean search), so this hook enforces it.
+#
+# Scope: a retrieval episode. The guard engages only while this session's
+# retrieval episode is fresh (a search or open within the last
+# EGREGORE_RETRIEVAL_WINDOW_MIN minutes, default 15). Outside an episode — editing a decision record, a skill
+# reading memory, ordinary work — memory reads are untouched. Edit and Write
+# are never the guard's business. Searching memory with grep passes.
+#
+# Exit 0 = allow, exit 2 = block (reason on stderr). Any unexpected failure
+# falls through to allow; the hook must never block by crashing.
+set -u
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+[ -d "$PROJECT_DIR" ] || exit 0
+INPUT=$(cat 2>/dev/null) || exit 0
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in Bash|Read) ;; *) exit 0 ;; esac
+
+# --- Retrieval episode: this session's packet exists and is fresh ---------
+SESSION=$(cat "$PROJECT_DIR/.egregore-session-id" 2>/dev/null | tr -cd 'A-Za-z0-9_.-')
+[ -n "$SESSION" ] || exit 0
+# The packet itself is consumed by the PostToolUse hook the moment it is
+# attached, so the episode is recorded by a marker that bin/search.sh and the
+# PostToolUse hook both touch. The packet is checked too, for the window
+# between its write and its consumption.
+CTX_DIR="${TMPDIR:-/tmp}/egregore-retrieval-context"
+WINDOW_MIN="${EGREGORE_RETRIEVAL_WINDOW_MIN:-15}"
+_fresh() { [ -f "$1" ] && [ -n "$(find "$1" -mmin "-$WINDOW_MIN" 2>/dev/null)" ]; }
+_fresh "$CTX_DIR/$SESSION.episode" || _fresh "$CTX_DIR/$SESSION.context" || exit 0
+
+_block() {
+  printf 'Egregore: memory sources are opened through the private evidence packet, not printed into the transcript.\n' >&2
+  printf 'Run, one file per call:\n  bash bin/search.sh open %s --context-packet\n' "$1" >&2
+  printf 'Searching with grep is fine; dumping a file with cat/sed/head/tail or the Read tool is not.\n' >&2
+  exit 2
+}
+
+if [ "$TOOL" = "Read" ]; then
+  FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+  [ -n "$FILE" ] || exit 0
+  case "$FILE" in
+    "$PROJECT_DIR"/memory/*) _block "memory/${FILE#"$PROJECT_DIR"/memory/}" ;;
+    memory/*) _block "$FILE" ;;
+  esac
+  # The memory symlink's target (the sibling memory repository) counts too.
+  MEM_REAL=$(readlink -f "$PROJECT_DIR/memory" 2>/dev/null || true)
+  if [ -n "$MEM_REAL" ]; then
+    case "$FILE" in "$MEM_REAL"/*) _block "memory/${FILE#"$MEM_REAL"/}" ;; esac
+  fi
+  exit 0
+fi
+
+# --- Bash: a raw reader applied to a memory path -------------------------
+CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -n "$CMD" ] || exit 0
+case "$CMD" in *bin/search.sh*) exit 0 ;; esac
+MEM_PATH=$(printf '%s' "$CMD" | grep -oE 'memory/[A-Za-z0-9_./@:+-]+' | head -1)
+[ -n "$MEM_PATH" ] || exit 0
+if printf '%s' "$CMD" | grep -qE '(^|[;&|(][[:space:]]*)(cat|sed|head|tail|less|more|awk|bat|nl)([[:space:]]|$)'; then
+  _block "$MEM_PATH"
+fi
+exit 0

package/runtime/claude/.claude/hooks/retrieval-context.sh

@@ -39,5 +39,8 @@ jq -Rs '{
     )
   }
 }' "$PACKET"
+# The packet is one-shot, but the retrieval episode is not: leave a marker so
+# memory-read-guard.sh keeps routing raw memory reads through the opener.
+touch "${PACKET%.context}.episode" 2>/dev/null || true
 rm -f "$PACKET"
 exit 0

package/runtime/claude/.claude/settings.json

@@ -56,6 +56,15 @@
           }
         ]
       },
+      {
+        "matcher": "Read|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/memory-read-guard.sh"
+          }
+        ]
+      },
       {
         "matcher": "Edit|Write|Bash|EnterWorktree|EnterPlanMode",
         "hooks": [

package/runtime/claude/bin/search.sh

@@ -283,6 +283,10 @@ cmd_query() {
     }
     umask 077
     printf '%s\n' "$out" > "$packet"
+    # The PostToolUse hook consumes the packet the moment it attaches it; the
+    # episode marker outlives that so the memory-read guard knows a retrieval
+    # just happened.
+    touch "${packet%.context}.episode" 2>/dev/null || true
     _banner_and_emit "$label" "$t0" "$emit" "$out" 1
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
@@ -343,6 +347,7 @@ case "${1:-}" in
       umask 077
       if _runtime open "$OPEN_PATH" > "$packet" 2>"$packet.err"; then
         rm -f "$packet.err"
+        touch "${packet%.context}.episode" 2>/dev/null || true
         echo "↳ opened $OPEN_PATH · content attached privately"
       else
         cat "$packet.err" >&2 2>/dev/null

package/runtime/claude/manifest.json

@@ -62,6 +62,7 @@
     ".claude/hooks/branch-guard.sh",
     ".claude/hooks/card-context.sh",
     ".claude/hooks/emissary-detect.sh",
+    ".claude/hooks/memory-read-guard.sh",
     ".claude/hooks/memory-refresh.sh",
     ".claude/hooks/onboarding-guard.sh",
     ".claude/hooks/retrieval-context.sh",

package/runtime/codex/bin/search.sh

@@ -283,6 +283,10 @@ cmd_query() {
     }
     umask 077
     printf '%s\n' "$out" > "$packet"
+    # The PostToolUse hook consumes the packet the moment it attaches it; the
+    # episode marker outlives that so the memory-read guard knows a retrieval
+    # just happened.
+    touch "${packet%.context}.episode" 2>/dev/null || true
     _banner_and_emit "$label" "$t0" "$emit" "$out" 1
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
@@ -343,6 +347,7 @@ case "${1:-}" in
       umask 077
       if _runtime open "$OPEN_PATH" > "$packet" 2>"$packet.err"; then
         rm -f "$packet.err"
+        touch "${packet%.context}.episode" 2>/dev/null || true
         echo "↳ opened $OPEN_PATH · content attached privately"
       else
         cat "$packet.err" >&2 2>/dev/null

package/runtime/pi/bin/search.sh

@@ -283,6 +283,10 @@ cmd_query() {
     }
     umask 077
     printf '%s\n' "$out" > "$packet"
+    # The PostToolUse hook consumes the packet the moment it attaches it; the
+    # episode marker outlives that so the memory-read guard knows a retrieval
+    # just happened.
+    touch "${packet%.context}.episode" 2>/dev/null || true
     _banner_and_emit "$label" "$t0" "$emit" "$out" 1
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
@@ -343,6 +347,7 @@ case "${1:-}" in
       umask 077
       if _runtime open "$OPEN_PATH" > "$packet" 2>"$packet.err"; then
         rm -f "$packet.err"
+        touch "${packet%.context}.episode" 2>/dev/null || true
         echo "↳ opened $OPEN_PATH · content attached privately"
       else
         cat "$packet.err" >&2 2>/dev/null

package/runtime/prime/bin/search.sh

@@ -283,6 +283,10 @@ cmd_query() {
     }
     umask 077
     printf '%s\n' "$out" > "$packet"
+    # The PostToolUse hook consumes the packet the moment it attaches it; the
+    # episode marker outlives that so the memory-read guard knows a retrieval
+    # just happened.
+    touch "${packet%.context}.episode" 2>/dev/null || true
     _banner_and_emit "$label" "$t0" "$emit" "$out" 1
   else
     _banner_and_emit "$label" "$t0" "$emit" "$out"
@@ -343,6 +347,7 @@ case "${1:-}" in
       umask 077
       if _runtime open "$OPEN_PATH" > "$packet" 2>"$packet.err"; then
         rm -f "$packet.err"
+        touch "${packet%.context}.episode" 2>/dev/null || true
         echo "↳ opened $OPEN_PATH · content attached privately"
       else
         cat "$packet.err" >&2 2>/dev/null