wayfind 2.0.0 → 2.0.9

package/LICENSE

@@ -0,0 +1,200 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please also get it reviewed
+      by a counsel familiar with open source licensing.
+
+   Copyright 2025-2026 Greg Leizerowicz
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,197 @@
+# Wayfind
+
+**Team decision trail for AI-assisted development.**
+
+> AI makes individual engineers faster. Nobody has solved coherent, maintainable software built by a *team* over time. Every handoff loses context. Wayfind captures it.
+
+[![CI](https://github.com/usewayfind/wayfind/actions/workflows/ci.yml/badge.svg)](https://github.com/usewayfind/wayfind/actions/workflows/ci.yml)
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/wayfind)](https://www.npmjs.com/package/wayfind)
+
+---
+
+## Install
+
+```bash
+npm install -g wayfind
+wayfind init
+```
+
+Then in a Claude Code session:
+
+```
+/init-memory     # Persistent context for this repo
+```
+
+Your AI sessions now resume where you left off instead of cold-starting.
+
+---
+
+## What It Does
+
+### For You (solo engineer)
+
+- **Persistent memory** — sessions pick up where the last one ended
+- **Automatic journal** — decisions and rationale extracted from every session
+- **Searchable history** — `wayfind search-journals "auth refactor"`
+- **Drift detection** — AI flags when work drifts from the stated goal
+
+### For Your Team
+
+- **Digests** — weekly summaries tailored per role (engineering, product, design, strategy)
+- **Slack bot** — anyone on the team asks `@wayfind` and gets answers from the decision trail
+- **Signal connectors** — pull context from GitHub, Intercom, and Notion into digests
+- **Context shift detection** — surfaces significant pivots and architecture changes
+
+Only the engineer installs anything. Everyone else sees a Slack digest.
+
+```bash
+/init-team       # Set up team context, journals, and digests
+```
+
+---
+
+## How It Works
+
+### Plain Files, Not Databases
+
+All context is plain markdown in directories you control:
+
+```
+~/.claude/
+  global-state.md           # Thin index — always loaded at session start
+  memory/
+    journal/YYYY-MM-DD.md   # Daily decision log
+
+<repo>/.claude/
+  state.md                  # Per-repo: branch, status, next steps
+```
+
+No proprietary formats. No vendor lock-in. `grep` works if Wayfind breaks.
+
+### The Session Protocol
+
+**Start:** AI reads state files, summarizes context, asks "What's the goal?"
+
+**Mid-session:** If work drifts from the goal, the AI flags it.
+
+**End:** Decisions are extracted, written as journal entries, and synced to the team repo — automatically via hooks.
+
+### Digests
+
+Each role sees the same underlying data through a different lens:
+
+- **Engineering**: What shipped, what drifted, patterns
+- **Product**: What shipped vs. planned, discovery signals
+- **Design**: UX decisions, implementation gaps vs. design intent
+- **Strategy**: Cross-team patterns, drift trends, capability gaps
+
+### Signal Connectors
+
+```bash
+wayfind pull github       # Issues, PRs, Actions status
+wayfind pull intercom     # Support conversations, tags, response times
+wayfind pull notion       # Pages, databases, comments
+wayfind pull --all        # All configured channels
+```
+
+---
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `wayfind init` | Install for your AI tool |
+| `wayfind doctor` | Check installation health |
+| `wayfind update` | Update to latest version |
+| `wayfind status` | Cross-project status |
+| `wayfind team create` | Create a new team |
+| `wayfind team join` | Join an existing team |
+| `wayfind digest` | Generate persona-specific digests |
+| `wayfind digest --deliver` | Generate and post to Slack |
+| `wayfind bot` | Start the Slack bot |
+| `wayfind reindex` | Index journals + conversations |
+| `wayfind search-journals <q>` | Search decision history |
+| `wayfind pull <channel>` | Pull signals from a source |
+| `wayfind journal sync` | Sync journals to team repo |
+| `wayfind onboard <repo>` | Generate onboarding context pack |
+| `wayfind deploy init` | Scaffold Docker deployment |
+
+Run `wayfind help` for the full list.
+
+---
+
+## Environment Variables
+
+### For digests and bot
+
+| Variable | Description |
+|----------|-------------|
+| `ANTHROPIC_API_KEY` | Digest generation and bot answers |
+| `SLACK_BOT_TOKEN` | Slack bot token (`xoxb-...`) |
+| `SLACK_APP_TOKEN` | Slack app-level token (`xapp-...`) |
+| `GITHUB_TOKEN` | Signal data and journal sync |
+
+### Optional
+
+| Variable | Description |
+|----------|-------------|
+| `OPENAI_API_KEY` | Semantic search embeddings (full-text works without it) |
+| `TEAM_CONTEXT_LLM_MODEL` | LLM for digests (default: `claude-sonnet-4-5-20250929`) |
+| `TEAM_CONTEXT_DIGEST_SCHEDULE` | Cron schedule (default: `0 8 * * 1` — Monday 8am) |
+| `TEAM_CONTEXT_EXCLUDE_REPOS` | Repos to exclude from digests |
+| `TEAM_CONTEXT_TELEMETRY` | `true` for anonymous usage telemetry |
+
+---
+
+## Tool Support
+
+| Tool | Status | Setup |
+|------|--------|-------|
+| Claude Code | Full support | `wayfind init` |
+| Cursor | Session protocol | `wayfind init-cursor` |
+| Generic | Manual | See `specializations/generic/` |
+
+---
+
+## What's Open Source
+
+Everything that runs on your machine is open source (Apache 2.0).
+
+| Open Source (this repo) | Commercial (future) |
+|---|---|
+| CLI and all commands | Cloud-hosted team aggregation |
+| Session protocol and journal extraction | Managed digest delivery |
+| Content store and search | Web dashboard |
+| Signal connectors (GitHub, Intercom, Notion) | SSO and tenant isolation |
+| Digest generation (your API key) | |
+| Slack bot (self-hosted) | |
+| Multi-team support | |
+
+See [LICENSING.md](LICENSING.md) for details.
+
+---
+
+## Architecture
+
+- [Data Flow](docs/architecture/data-flow.md) — sessions to digests
+- [Principles](docs/architecture/architecture-principles.md) — the eight constraints
+- [Content Store](docs/architecture/content-store.md) — indexing, search, schema
+- [Signal Channels](docs/architecture/architecture-signal-channels.md) — connector architecture
+- [Signal Roadmap](docs/architecture/signal-source-roadmap.md) — planned connectors
+
+---
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Good first contributions:
+
+- **Specializations** for AI tools (Windsurf, Aider, Continue)
+- **Signal connectors** for new tools (Linear, Jira, Slack, HubSpot)
+- Bug reports and feature requests via [issues](https://github.com/usewayfind/wayfind/issues)
+
+---
+
+## License
+
+Apache 2.0. See [LICENSE](LICENSE) and [LICENSING.md](LICENSING.md).

package/backup/hooks/session-end.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Wayfind — Backup Push Hook
+# Runs at session end. Syncs ~/.claude/ memory files to backup repo and pushes.
+# Silently no-ops if backup isn't configured or nothing changed.
+
+set -euo pipefail
+
+MEMORY_DIR="$HOME/.claude"
+BACKUP_DIR_FILE="$MEMORY_DIR/.backup-dir"
+
+[ -f "$BACKUP_DIR_FILE" ] || exit 0
+BACKUP_DIR="$(cat "$BACKUP_DIR_FILE")"
+[ -d "$BACKUP_DIR/.git" ] || exit 0
+command -v git &>/dev/null || exit 0
+
+# Sync: ~/.claude/ -> backup repo
+rsync -a \
+    "$MEMORY_DIR/global-state.md" \
+    "$MEMORY_DIR/state.md" \
+    "$BACKUP_DIR/" 2>/dev/null || true
+
+if [ -d "$MEMORY_DIR/memory" ]; then
+    rsync -a "$MEMORY_DIR/memory/" "$BACKUP_DIR/memory/" 2>/dev/null || true
+fi
+
+# Commit and push if anything changed
+cd "$BACKUP_DIR" || { echo "ERROR: cannot cd to backup dir $BACKUP_DIR"; exit 1; }
+git add -A
+if git diff --cached --quiet; then
+    exit 0  # Nothing changed — skip silently
+fi
+
+git commit -m "auto: $(date '+%Y-%m-%d %H:%M')" --quiet
+
+# Push
+GIT_ERROR=$(git push origin "${BRANCH:-main}" --quiet 2>&1) && {
+    echo "$(date '+%Y-%m-%d %H:%M')" > "$HOME/.claude/.backup-last-push"
+    rm -f "$HOME/.claude/.backup-last-error"
+} || {
+    ERROR_MSG="$(date '+%Y-%m-%d %H:%M') — git push failed: $GIT_ERROR"
+    echo "$ERROR_MSG" > "$HOME/.claude/.backup-last-error"
+    echo "Warning: Backup push failed. Details: $HOME/.claude/.backup-last-error"
+    exit 1
+}

package/backup/hooks/session-start.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Wayfind — Backup Restore Hook
+# Runs at session start. Pulls latest from backup repo, then syncs to ~/.claude/
+# Silently no-ops if backup isn't configured or git isn't available.
+
+set -euo pipefail
+
+MEMORY_DIR="$HOME/.claude"
+BACKUP_DIR_FILE="$MEMORY_DIR/.backup-dir"
+
+[ -f "$BACKUP_DIR_FILE" ] || exit 0
+BACKUP_DIR="$(cat "$BACKUP_DIR_FILE")"
+[ -d "$BACKUP_DIR/.git" ] || exit 0
+command -v git &>/dev/null || exit 0
+
+# Warn if last push failed
+LAST_ERROR="$HOME/.claude/.backup-last-error"
+if [ -f "$LAST_ERROR" ]; then
+    echo "Warning: Backup: last push FAILED at $(cat "$LAST_ERROR")"
+    echo "  Fix and re-run: cd ~/.claude-backup && git push"
+fi
+
+# Pull latest (silently — don't block session start)
+git -C "$BACKUP_DIR" pull --quiet --ff-only 2>/dev/null || true
+
+# Restore: sync backup -> ~/.claude/
+rsync -a --update \
+    "$BACKUP_DIR/global-state.md" \
+    "$MEMORY_DIR/" 2>/dev/null || true
+
+rsync -a --update \
+    "$BACKUP_DIR/state.md" \
+    "$MEMORY_DIR/" 2>/dev/null || true
+
+if [ -d "$BACKUP_DIR/memory" ]; then
+    rsync -a --update "$BACKUP_DIR/memory/" "$MEMORY_DIR/memory/" 2>/dev/null || true
+fi

package/backup/setup.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# Wayfind — Backup Setup
+# Wires a private GitHub repo as your memory backup.
+#
+# Usage: bash backup/setup.sh <repo-url>
+# Example: bash backup/setup.sh git@github.com:you/claude-memory.git
+#          bash backup/setup.sh https://github.com/you/claude-memory.git
+#
+# What this does:
+#   1. Clones your backup repo to ~/.claude-backup/
+#   2. Does an initial sync of your memory files into it
+#   3. Installs session-start (restore) and session-end (push) hooks
+#   4. Registers both hooks in ~/.claude/settings.json
+
+set -euo pipefail
+
+REPO_URL="${1:-}"
+BACKUP_DIR="$HOME/.claude-backup"
+MEMORY_DIR="$HOME/.claude"
+HOOKS_DIR="$HOME/.claude/hooks"
+SETTINGS="$HOME/.claude/settings.json"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; RESET='\033[0m'
+log()  { echo -e "${GREEN}✓${RESET} $1"; }
+warn() { echo -e "${YELLOW}⚠${RESET}  $1"; }
+err()  { echo -e "${RED}✗${RESET} $1"; exit 1; }
+
+# ── Validate ──────────────────────────────────────────────────────────────────
+
+if [ -z "$REPO_URL" ]; then
+    err "No repo URL provided.\nUsage: bash backup/setup.sh <repo-url>"
+fi
+
+if ! command -v git &>/dev/null; then
+    err "git is required but not installed."
+fi
+
+if ! command -v rsync &>/dev/null; then
+    err "rsync is required but not installed. On macOS: brew install rsync"
+fi
+
+# ── Clone or init backup repo ─────────────────────────────────────────────────
+
+echo ""
+echo "Wayfind — Backup Setup"
+echo ""
+
+if [ -d "$BACKUP_DIR/.git" ]; then
+    warn "Backup repo already exists at $BACKUP_DIR — pulling latest"
+    git -C "$BACKUP_DIR" pull --quiet
+else
+    echo "Cloning backup repo..."
+    if git clone "$REPO_URL" "$BACKUP_DIR" 2>/dev/null; then
+        log "Cloned $REPO_URL → $BACKUP_DIR"
+    else
+        # Repo exists on GitHub but is empty — clone fails. Init locally instead.
+        mkdir -p "$BACKUP_DIR"
+        git -C "$BACKUP_DIR" init
+        git -C "$BACKUP_DIR" remote add origin "$REPO_URL"
+        log "Initialized empty backup repo at $BACKUP_DIR"
+    fi
+fi
+
+# ── Initial sync ──────────────────────────────────────────────────────────────
+
+echo "Syncing memory files to backup repo..."
+
+# Files to back up: global index, admin state, and the entire memory/ directory
+mkdir -p "$BACKUP_DIR"
+rsync -a \
+    "$MEMORY_DIR/global-state.md" \
+    "$MEMORY_DIR/state.md" \
+    "$BACKUP_DIR/" 2>/dev/null || true
+
+if [ -d "$MEMORY_DIR/memory" ]; then
+    mkdir -p "$BACKUP_DIR/memory"
+    rsync -a "$MEMORY_DIR/memory/" "$BACKUP_DIR/memory/" 2>/dev/null || true
+fi
+
+# Initial commit
+cd "$BACKUP_DIR"
+git add -A
+if ! git diff --cached --quiet; then
+    git commit -m "initial backup — $(date '+%Y-%m-%d')"
+    git push -u origin main 2>/dev/null || git push -u origin master 2>/dev/null || \
+        warn "Push failed — check your repo URL and SSH/token auth, then run: git -C $BACKUP_DIR push"
+    log "Initial backup pushed"
+else
+    log "Nothing to commit in initial sync"
+fi
+
+# ── Install hook scripts ──────────────────────────────────────────────────────
+
+mkdir -p "$HOOKS_DIR"
+
+cp "$SCRIPT_DIR/hooks/session-start.sh" "$HOOKS_DIR/backup-restore.sh"
+chmod +x "$HOOKS_DIR/backup-restore.sh"
+log "Installed: $HOOKS_DIR/backup-restore.sh"
+
+cp "$SCRIPT_DIR/hooks/session-end.sh" "$HOOKS_DIR/backup-push.sh"
+chmod +x "$HOOKS_DIR/backup-push.sh"
+log "Installed: $HOOKS_DIR/backup-push.sh"
+
+# Store the backup dir path so hooks know where to find it
+echo "$BACKUP_DIR" > "$MEMORY_DIR/.backup-dir"
+log "Stored backup dir config: $MEMORY_DIR/.backup-dir"
+
+# ── Register hooks in settings.json ──────────────────────────────────────────
+
+if [ ! -f "$SETTINGS" ]; then
+    cp "$SCRIPT_DIR/../specializations/claude-code/settings.json" "$SETTINGS"
+fi
+
+python3 - <<PYEOF
+import json, os
+
+settings_path = os.path.expanduser("$SETTINGS")
+with open(settings_path) as f:
+    s = json.load(f)
+
+hooks = s.setdefault("hooks", {})
+
+# SessionStart: restore (pull) — prepend so it runs before check-global-state
+start_hooks = hooks.setdefault("SessionStart", [])
+restore_cmd = {"type": "command", "command": "bash ~/.claude/hooks/backup-restore.sh"}
+if not any(h.get("command", "").endswith("backup-restore.sh") for h in start_hooks):
+    start_hooks.insert(0, restore_cmd)
+    print("  + Registered backup-restore.sh in SessionStart")
+else:
+    print("  - backup-restore.sh already in SessionStart")
+
+# Stop: push — runs when Claude session ends
+stop_hooks = hooks.setdefault("Stop", [])
+push_cmd = {"type": "command", "command": "bash ~/.claude/hooks/backup-push.sh"}
+if not any(h.get("command", "").endswith("backup-push.sh") for h in stop_hooks):
+    stop_hooks.append(push_cmd)
+    print("  + Registered backup-push.sh in Stop")
+else:
+    print("  - backup-push.sh already in Stop")
+
+with open(settings_path, "w") as f:
+    json.dump(s, f, indent=2)
+    f.write("\n")
+PYEOF
+
+log "Updated $SETTINGS"
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "Backup setup complete."
+echo "  Backup repo:    $BACKUP_DIR  →  $REPO_URL"
+echo "  Restore hook:   runs at session start (pulls latest)"
+echo "  Push hook:      runs at session end (commits + pushes changes)"
+echo ""

package/bin/content-store.js

@@ -39,7 +39,11 @@ const ENTRY_HEADER_RE = /^##\s+(.+?)\s+[—–]\s+(.+)$/;
 const FIELD_RE = /^\*\*([^*:]+):\*\*\s*(.*)$/;
 const DATE_FILE_RE = /^(\d{4}-\d{2}-\d{2})(?:-([a-z0-9._-]+))?\.md$/;
 
-// Repo exclusion list (comma-separated, case-insensitive, supports org/repo or just repo)
+// Repo exclusion list (comma-separated, case-insensitive, supports org/repo or just repo).
+// NOTE: Team boundaries are now enforced at export/sync time via opt-in .claude/wayfind.json
+// bindings (see buildRepoToTeamResolver in team-context.js). This env var is still useful
+// for filtering repos out of indexing and queries entirely, but is no longer needed for
+// preventing unbound repos from leaking into team digests.
 const EXCLUDE_REPOS = (process.env.TEAM_CONTEXT_EXCLUDE_REPOS || '')
   .split(',').map(r => r.trim().toLowerCase()).filter(Boolean);
 
@@ -1560,6 +1564,7 @@ async function indexConversationsWithExport(options = {}) {
   // Write pending exports — route to per-team journal files
   for (const { date, repo, decisions } of pendingExports) {
     const teamId = repoToTeam(repo);
+    if (!teamId) continue;  // Unbound repo — skip export (opt-in via .claude/wayfind.json)
     exportDecisionsAsJournal(date, repo, decisions, exportDir, teamId, author);
     exported += decisions.length;
     for (const d of decisions) {

package/bin/team-context.js

@@ -1175,8 +1175,11 @@ async function runReindex(args) {
 /**
  * Build a repo-to-team resolver function.
  * Scans context.json teams and all known repo bindings to map repo names → team IDs.
- * Falls back to default team if no binding is found.
- * @returns {function(string): string|null} - Maps repo name (e.g. "acme-corp/api") to team ID
+ * Returns null for unbound repos — they are invisible to export/sync.
+ * NOTE: config.default is intentionally NOT used here. The "default" field in context.json
+ * exists for the `context bind` command's UX (pre-selecting a team), not for implicit
+ * routing of unknown repos. Repos must opt in via .claude/wayfind.json to participate.
+ * @returns {function(string): string|null} - Maps repo name (e.g. "acme-corp/api") to team ID, or null if unbound
  */
 function buildRepoToTeamResolver() {
   const config = readContextConfig();
@@ -1228,8 +1231,11 @@ function buildRepoToTeamResolver() {
       if (repoName.startsWith(key + '/') || repoName === key) return teamId;
     }
 
-    // Fall back to default team
-    return config.default || null;
+    // No binding found — return null so unbound repos don't leak into
+    // the default team's digest. Repos must have .claude/wayfind.json to
+    // be routed. The "default" team in context.json is for the `context bind`
+    // command's UX, not for implicit routing of unknown repos.
+    return null;
   };
 }
 
@@ -1850,7 +1856,7 @@ function journalSplitByTeam(args) {
  * Sync local journals to team-context repo(s) journals/ directory.
  * Routes per-team journal files (YYYY-MM-DD-{teamId}.md or YYYY-MM-DD-{author}-{teamId}.md)
  * to the correct team-context repo based on the team ID suffix.
- * Legacy files without a team suffix go to the default team.
+ * Files without a team suffix are skipped — repos must opt in via .claude/wayfind.json.
  * Usage: wayfind journal sync [--dir <path>] [--since YYYY-MM-DD]
  */
 function journalSync(args) {
@@ -1906,8 +1912,6 @@ function journalSync(args) {
 
   // Categorize files: { teamId → [{ file, srcPath }] }
   const teamFiles = {};
-  const defaultTeam = config.default || null;
-
   for (const file of allFiles) {
     // Extract date for --since filtering
     const dateMatch = file.match(/^(\d{4}-\d{2}-\d{2})/);
@@ -1932,8 +1936,7 @@ function journalSync(args) {
       }
     }
 
-    // No team suffix → route to default team
-    if (!teamId) teamId = defaultTeam;
+    // No team suffix → skip. Repos must opt in via .claude/wayfind.json.
     if (!teamId) continue;
 
     if (!teamFiles[teamId]) teamFiles[teamId] = [];
@@ -3977,7 +3980,7 @@ const COMMANDS = {
     desc: 'Sync code to the public usewayfind/wayfind repo',
     run: () => {
       const tmpDir = path.join(os.tmpdir(), 'wayfind-public-sync');
-      const publicRepo = 'https://github.com/usewayfind/wayfind.git';
+      const publicRepo = process.env.WAYFIND_PUBLIC_REPO || 'https://github.com/usewayfind/wayfind.git';
 
       // Clone or pull public repo
       if (fs.existsSync(tmpDir)) {
@@ -3999,10 +4002,14 @@ const COMMANDS = {
       // Files and directories to sync
       const syncItems = [
         'bin/', 'templates/', 'specializations/', 'tests/', 'simulation/',
-        'Dockerfile', 'package.json', 'setup.sh', 'install.sh', 'uninstall.sh',
-        'doctor.sh', 'journal-summary.sh', 'BOOTSTRAP_PROMPT.md',
+        'backup/', '.github/', 'Dockerfile', 'package.json', 'setup.sh',
+        'install.sh', 'uninstall.sh', 'doctor.sh', 'journal-summary.sh',
+        'BOOTSTRAP_PROMPT.md', '.gitattributes', '.gitignore', 'VERSIONS.md',
       ];
 
+      // Workflows that only belong on the private repo
+      const privateOnlyWorkflows = ['sync-public.yml', 'simulation.yml'];
+
       // Also sync public-staging docs if they exist
       const publicDocsDir = path.join(ROOT, 'public-staging', 'docs');
 
@@ -4022,10 +4029,85 @@ const COMMANDS = {
         }
       }
 
-      // Sync public-staging docs to docs/
-      if (fs.existsSync(publicDocsDir)) {
-        spawnSync('rsync', ['-a', '--delete', publicDocsDir + '/', path.join(tmpDir, 'docs') + '/'], { stdio: 'inherit' });
+      // Remove private-only workflows from the public copy
+      for (const wf of privateOnlyWorkflows) {
+        const wfPath = path.join(tmpDir, '.github', 'workflows', wf);
+        if (fs.existsSync(wfPath)) fs.unlinkSync(wfPath);
+      }
+
+      // Sync public-staging/ → public repo root (recursive)
+      // This overlays LICENSE, README, CHANGELOG, SECURITY, CONTRIBUTING, docs/, etc.
+      const publicStagingDir = path.join(ROOT, 'public-staging');
+      if (fs.existsSync(publicStagingDir)) {
+        spawnSync('rsync', ['-a', publicStagingDir + '/', tmpDir + '/'], { stdio: 'inherit' });
+      }
+
+      // ── Sanitization gate ───────────────────────────────────────────────
+      // Scan all tracked text files for proprietary patterns before pushing.
+      // Patterns loaded from .sync-blocklist (not synced to public repo).
+      const blocklistPath = path.join(ROOT, '.sync-blocklist');
+      const BLOCKED_PATTERNS = [];
+      if (fs.existsSync(blocklistPath)) {
+        for (const line of fs.readFileSync(blocklistPath, 'utf8').split('\n')) {
+          const trimmed = line.trim();
+          if (!trimmed || trimmed.startsWith('#')) continue;
+          // Each line is a regex pattern, optionally with /flags
+          const m = trimmed.match(/^\/(.+)\/([gimsuy]*)$/);
+          if (m) {
+            BLOCKED_PATTERNS.push(new RegExp(m[1], m[2]));
+          } else {
+            // Plain string → case-insensitive word boundary match
+            BLOCKED_PATTERNS.push(new RegExp('\\b' + trimmed.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\b', 'i'));
+          }
+        }
+      }
+      if (BLOCKED_PATTERNS.length === 0) {
+        console.warn('⚠️  No .sync-blocklist found — skipping sanitization scan.');
+        console.warn('   Create .sync-blocklist with one pattern per line to enable leak detection.');
       }
+      // Files/dirs exempt from scanning
+      const SCAN_EXEMPT = [
+        /\/\.git\//,
+        /node_modules\//,
+        /clean-machine-onboard\.sh$/, // contains negative assertions checking for org-name leaks
+      ];
+
+      console.log('Running sanitization scan...');
+      const violations = [];
+      const scanDir = (dir) => {
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+          const full = path.join(dir, entry.name);
+          const rel = path.relative(tmpDir, full);
+          if (SCAN_EXEMPT.some(r => r.test(full))) continue;
+          if (entry.isDirectory()) { scanDir(full); continue; }
+          // Skip binary files
+          const ext = path.extname(entry.name).toLowerCase();
+          if (['.png', '.jpg', '.jpeg', '.gif', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.tgz', '.gz', '.zip'].includes(ext)) continue;
+          try {
+            const content = fs.readFileSync(full, 'utf8');
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+              for (const pat of BLOCKED_PATTERNS) {
+                if (pat.test(lines[i])) {
+                  violations.push({ file: rel, line: i + 1, pattern: pat.source, text: lines[i].trim().slice(0, 120) });
+                }
+              }
+            }
+          } catch { /* binary file, skip */ }
+        }
+      };
+      scanDir(tmpDir);
+
+      if (violations.length > 0) {
+        console.error('\n❌ Sanitization FAILED — proprietary content detected:\n');
+        for (const v of violations) {
+          console.error(`  ${v.file}:${v.line}  [${v.pattern}]`);
+          console.error(`    ${v.text}\n`);
+        }
+        console.error(`${violations.length} violation(s) found. Fix these before syncing to the public repo.`);
+        process.exit(1);
+      }
+      console.log('Sanitization passed — no proprietary content detected.');
 
       // Show what changed
       const diffResult = spawnSync('git', ['status', '--short'], { cwd: tmpDir, stdio: 'pipe' });
@@ -4052,11 +4134,11 @@ const COMMANDS = {
       }
 
       console.log('Pushing to usewayfind/wayfind...');
-      // Use GH_TOKEN to ensure correct account (gh multi-account may route wrong)
-      const tokenResult = spawnSync('gh', ['auth', 'token'], { stdio: 'pipe' });
-      const pushEnv = { ...process.env };
-      if (tokenResult.stdout) pushEnv.GH_TOKEN = tokenResult.stdout.toString().trim();
-      const pushResult = spawnSync('git', ['push'], { cwd: tmpDir, stdio: 'inherit', env: pushEnv });
+      // Allow override for SSH-based multi-account routing
+      if (process.env.WAYFIND_PUBLIC_REPO) {
+        spawnSync('git', ['remote', 'set-url', 'origin', process.env.WAYFIND_PUBLIC_REPO], { cwd: tmpDir });
+      }
+      const pushResult = spawnSync('git', ['push'], { cwd: tmpDir, stdio: 'inherit' });
       if (pushResult.status !== 0) {
         console.error('Push failed — check your access to usewayfind/wayfind');
         process.exit(1);

package/doctor.sh

@@ -235,8 +235,8 @@ check_team_versions() {
 
     # Check min_version from check-version command output
     local CHECK_OUTPUT=""
-    if [ -f "$HOME/repos/greg/meridian/bin/team-context.js" ]; then
-        CHECK_OUTPUT=$(node "$HOME/repos/greg/meridian/bin/team-context.js" check-version 2>&1 || true)
+    if [ -f "$HOME/repos/greg/wayfind/bin/team-context.js" ]; then
+        CHECK_OUTPUT=$(node "$HOME/repos/greg/wayfind/bin/team-context.js" check-version 2>&1 || true)
     elif command -v wayfind >/dev/null 2>&1; then
         CHECK_OUTPUT=$(wayfind check-version 2>&1 || true)
     fi

package/install.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 # Wayfind — Installer
 # Usage:
-#   curl -fsSL https://raw.githubusercontent.com/leizerowicz/meridian/main/install.sh | bash
+#   curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh | bash
 #   WAYFIND_VERSION=v1.1.0 bash install.sh   # Install specific version
 #   bash install.sh --force                    # Force reinstall even if same version
 
 set -euo pipefail
 
-REPO="leizerowicz/meridian"
+REPO="usewayfind/wayfind"
 VERSION="${WAYFIND_VERSION:-main}"
 TMP_DIR="$(mktemp -d)"
 FORCE=false
@@ -41,10 +41,10 @@ echo ""
 # Download
 if [ "$VERSION" = "main" ]; then
     DOWNLOAD_URL="https://github.com/$REPO/archive/refs/heads/main.tar.gz"
-    ARCHIVE_NAME="meridian-main"
+    ARCHIVE_NAME="wayfind-main"
 else
     DOWNLOAD_URL="https://github.com/$REPO/archive/refs/tags/${VERSION}.tar.gz"
-    ARCHIVE_NAME="meridian-${VERSION#v}"
+    ARCHIVE_NAME="wayfind-${VERSION#v}"
 fi
 
 ARCHIVE="$TMP_DIR/kit.tar.gz"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wayfind",
-  "version": "2.0.0",
+  "version": "2.0.9",
   "description": "Team decision trail for AI-assisted development. The connective tissue between product, engineering, and strategy.",
   "bin": {
     "wayfind": "./bin/team-context.js"

package/specializations/claude-code/README.md

@@ -1,5 +1,9 @@
 # Claude Code Specialization
 
+> **Note:** The canonical plugin source is now in `plugin/` at the repo root.
+> This `specializations/claude-code/` directory is kept for backward compatibility
+> with `setup.sh` but `plugin/` is the source of truth for Claude Code integration.
+
 This directory contains everything needed to wire Wayfind into Claude Code specifically.
 
 ## What's Different About Claude Code

package/specializations/claude-code/commands/doctor.md

@@ -13,19 +13,21 @@ Look for `~/.claude/team-context/doctor.sh`. If found, run it:
 bash ~/.claude/team-context/doctor.sh
 ```
 
-If not found, perform the checks manually:
+If `doctor.sh` is not found, perform the checks manually using Steps 2-3 below.
 
 ## Step 2: Manual checks
 
-1. **Hook registered?** — Does `~/.claude/settings.json` contain "check-global-state"?
-2. **Global state current?** — Read `~/.claude/global-state.md`. When was it last updated?
-3. **Backup status** — Check `~/.claude/.backup-last-push` and `~/.claude/.backup-last-error`
-4. **Repos** — Scan `~/repos`, `~/code`, `~/dev` for `.claude/state.md` files
-5. **Memory files** — List files in `~/.claude/memory/`, flag any over 8KB
+Use the Read tool (not Bash) for file checks. Use Glob for file discovery.
+
+1. **Hook registered?** — Read `~/.claude/settings.json`. Check if it contains "check-global-state".
+2. **Global state current?** — Read `~/.claude/global-state.md`. Check the "Last updated" line near the top.
+3. **Backup status** — Read `~/.claude/.backup-last-push`. If the file doesn't exist, report "Backup not configured."
+4. **Repos** — Use Glob to find `~/repos/**/.claude/state.md` and `~/repos/**/.claude/team-state.md` files. Report each with its parent repo name.
+5. **Memory files** — Use Glob to find `~/.claude/memory/*.md`. For each file, read it and check if it's unusually large (mention if content seems over ~200 lines). Also count journal files in `~/.claude/memory/journal/`.
 
 ## Step 3: Report findings
 
 Report in this format:
-- ✓ items that are working correctly
-- ⚠ items that need attention (not broken, but worth knowing)
-- ✗ items that are broken (with how to fix)
+- Items that are working correctly
+- Items that need attention (not broken, but worth knowing)
+- Items that are broken (with how to fix)

package/specializations/claude-code/commands/init-memory.md

@@ -23,6 +23,26 @@ If the old protocol is not detected, skip this step silently.
 - Check if it's a git repo (`ls .git` or `git rev-parse --show-toplevel`)
 - Read `~/.claude/global-state.md` to check if this repo is already registered
 
+## Step 1.5: Bind repo to team
+
+Check if `.claude/wayfind.json` already exists in the repo.
+
+**If it already exists:** Read it, report the current team binding ("Already bound to team: <team name>"), and ask: "Want to change the team binding?" If the user says no, skip to Step 2. If yes, proceed with team selection below (overwrite the file).
+
+**If it does not exist:** Read `~/.claude/team-context/context.json` to get the list of configured teams.
+
+- **No teams configured (file missing or empty `teams` array):** Tell the user: "No teams configured yet. Run `/init-team` first to set up a team, then re-run `/init-memory`." **Stop here — do not continue to later steps.**
+
+- **Exactly one team:** Auto-bind to that team. Create `.claude/wayfind.json`:
+  ```json
+  {"team_id": "<teamId>", "bound_at": "<ISO 8601 timestamp>"}
+  ```
+  Report: "Bound to team: <team name> (auto-selected, only team configured)"
+
+- **Multiple teams:** List the teams by name and ask the user which one this repo belongs to. Wait for their answer. Create `.claude/wayfind.json` with their chosen team's ID. Report: "Bound to team: <team name>"
+
+**Verify `.gitignore` coverage:** `.claude/wayfind.json` must be gitignored. Step 3 already includes it in the required entries — confirm this is still the case. If someone removed it, Step 3 will restore it.
+
 ## Step 2: Create state files (if missing)
 
 This repo uses TWO state files with different visibility:
@@ -140,6 +160,7 @@ Add the repo's state files to the State Files table if missing:
 ## Step 6: Report
 
 Tell the user:
+- `.claude/wayfind.json` — bound to team: <team name> (or already bound)
 - `.claude/team-state.md` — created or already existed (committed to git, shared with team)
 - `.claude/personal-state.md` — created or already existed (gitignored, personal only)
 - `.gitignore` — updated or already correct

package/specializations/claude-code/commands/journal.md

@@ -34,12 +34,12 @@ bash ~/.claude/team-context/journal-summary.sh --dir ~/.ai-memory/memory/journal
 
 Run setup.sh with `--update` to install it:
 ```bash
-bash ~/repos/greg/meridian/setup.sh --tool claude-code --update
+bash ~/repos/greg/wayfind/setup.sh --tool claude-code --update
 ```
 
 Or install manually:
 ```bash
-cp ~/repos/greg/meridian/journal-summary.sh ~/.claude/team-context/journal-summary.sh
+cp ~/repos/greg/wayfind/journal-summary.sh ~/.claude/team-context/journal-summary.sh
 chmod +x ~/.claude/team-context/journal-summary.sh
 ```
 

package/specializations/claude-code/hooks/check-global-state.sh

@@ -10,7 +10,7 @@
 set -euo pipefail
 
 # Use local wayfind checkout if available, otherwise try npx
-WAYFIND_BIN="$HOME/repos/greg/meridian/bin/team-context.js"
+WAYFIND_BIN="$HOME/repos/greg/wayfind/bin/team-context.js"
 if [ -f "$WAYFIND_BIN" ]; then
     node "$WAYFIND_BIN" status --write --quiet 2>/dev/null || true
     node "$WAYFIND_BIN" check-version 2>/dev/null || true

package/specializations/claude-code/hooks/session-end.sh

@@ -9,7 +9,7 @@ set -euo pipefail
 # Skip export for worker agents in multi-agent swarms.
 # Set TEAM_CONTEXT_SKIP_EXPORT=1 when spawning worker agents so only the
 # orchestrator's decisions flow into the journal.
-if [ "${TEAM_CONTEXT_SKIP_EXPORT:-}" = "1" ]; then
+if [ "${TEAM_CONTEXT_SKIP_EXPORT:-${MERIDIAN_SKIP_EXPORT:-}}" = "1" ]; then
   exit 0
 fi
 

package/templates/github-actions/{meridian-digest.yml → wayfind-digest.yml}

@@ -3,7 +3,7 @@
 # No Docker container needed — runs directly via npx.
 #
 # Setup:
-#   1. Copy this file to .github/workflows/meridian-digest.yml in your team-context repo
+#   1. Copy this file to .github/workflows/wayfind-digest.yml in your team-context repo
 #   2. Add these secrets to the repo (Settings → Secrets → Actions):
 #      - ANTHROPIC_API_KEY: Your Anthropic API key
 #      - SLACK_WEBHOOK_URL: Slack incoming webhook URL (optional — digests are also committed to the repo)

package/uninstall.sh

@@ -102,4 +102,4 @@ info "Your memory files are preserved:"
 info "  ~/.claude/global-state.md"
 info "  ~/.claude/memory/"
 info ""
-info "To reinstall: curl -fsSL https://raw.githubusercontent.com/leizerowicz/meridian/main/install.sh | bash"
+info "To reinstall: curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh | bash"