Repository navigation
chore(deps): bump trufflesecurity/trufflehog from 3.94.3 to 3.99.7 - #18
Closed
dependabot[bot] wants to merge 90 commits into
Closed
dependabot[bot] wants to merge 90 commits into
dependabot[bot] wants to merge 90 commits into
Conversation
…cs, tests
- 10 SKILL.md: save, wiki, challenge, emerge, backfill, aliases, autoresearch, canvas, tether, connect
- install.sh + uninstall.sh + doctor.sh + backup-vault.sh (jq-merge Stop hook, symlinks, launchd)
- 4 launchd plists (morning/nightly/weekly/health, audit-only default)
- references/wiki-schema.md single source of truth
- Test harness: 8 test files + fixtures + orchestrator
- Docs: README, PHILOSOPHY, MIGRATION, CONTRIBUTING, CHANGELOG + 5 why-not-*.md + foundations
- Security: .gitleaks.toml + GitHub Actions secret-scan + config/{secrets.patterns,nathan.pii}
- Plugin manifest: .claude-plugin/plugin.json + marketplace.json
- vault-template/ scaffold
- hooks/stop-save.sh
Amalgamation of Karpathy LLM Wiki + Jens/NulightJens + eugeniu + AgriciDaniel + NicholasSpisak.
…rontmatter cleanup W4W audit remediation: - install.sh: add idempotency guard (skip merge if our hook already present, detect by 2ndBrain-mogging/hooks/stop- path fingerprint) - install.sh: inline Stop overlay referenced hooks/stop-hook.sh but repo ships hooks/stop-save.sh — corrected - skills/emerge/SKILL.md: add missing allowed-tools frontmatter field - skills/wiki/SKILL.md: strip legacy /cingest + /clint reference from description
- Replace all 68+ real names with <PERSON-X>/<PROJECT-X> placeholders - Add docs/placeholder-names.md (public convention reference) - Add docs/MIGRATION.md (phase-by-phase runbook) - Expand CHANGELOG v0.1.0 + add v0.1.1 entry - Update README: 7-folder vault diagram, credits, namespacing note - Fix launchd plists: $HOME placeholder replacing hardcoded paths - Fix .gitleaks.toml: remove self-leaking rules; add .example companion - Add .gitignore entries for private PII/gitleaks files - Add .filter-repo-replacements.example.txt for operator reference - Bootstrap Claude-Memory/aliases.yaml seed template - Fix install.sh idempotency guard (already in 20d5f5f, retained) - Fix skills/emerge frontmatter: add allowed-tools field - Fix skills/wiki description: strip legacy /cingest+/clint reference - Fix tests/test_onboarding.sh: correct install.sh flags - Vault-template sidecars updated with placeholder convention
…ls + schema
Human feedback (2026-04-17): "auto-delete" and "silently delete" phrasing — even
when used in guardrail context ("do NOT auto-delete") — reads sideways as if
deletion was on the table. Softened to "flag for human review" and "remove without
flagging" framing across:
- skills/wiki/SKILL.md §7: "do NOT auto-delete the link" -> "flag for human
review. Never remove the link without explicit human approval."
- skills/save/SKILL.md §1: "never silent overwrite" -> explicit diff-and-approval
overwrite language.
- skills/save/SKILL.md §2.1 (50/50 rule): "silent misfiling" -> "unflagged
misfiling" (preserves the prevention intent without invoking silence).
- references/wiki-schema.md §3: "Do NOT silently delete the link" -> "Never remove
the link itself without flagging it for human review — removal is a human-only
action."
Behavior unchanged — skills never deleted files. This is pure phrasing cleanup
to remove alarming language from instruction manuals.
…orruption
Critical fix to v0.1.1's PII-scrub regression. The .filter-repo-replacements.txt
rule `regex:\buri\b==><person-i>` did not honor its word-boundary anchors when
git-filter-repo applied it, so `uri` got replaced as a literal substring inside
dozens of ordinary English words across public files. Same bug for `\balan\b`.
Reverted corruption across 19 files:
- CHANGELOG.md (headings), docs/SECURITY.md (title + body), references/wiki-schema.md
- scripts/prepublish-check.sh (4 hits), .github/workflows/secret-scan.yml (1 — BROKEN ACTION)
- skills/wiki/SKILL.md, skills/save/SKILL.md, skills/backfill/SKILL.md, skills/challenge/SKILL.md
- commands/save.md, commands/autoresearch.md
- vault-template/CLAUDE.md, vault-template/AGENTS.md
- docs/CREDITS.md, docs/foundations/{03,05}-*-analysis.md, docs/CLAUDE-MD-PATCH.md
- config/nathan.pii.example, .gitleaks.private.toml.example
Most critical: secret-scan.yml's `uses: trufflesecurity/trufflehog@main` was
corrupted to `trufflesec<person-i>ty/trufflehog@main` — GitHub Actions failed
to resolve this on every push since v0.1.1 shipped.
Also in this release: auto-delete / silent-op phrasing scrub from skills +
schema (rolls up the earlier ca6c890 scrub commit into the v0.1.2 release).
Plugin manifest bumped 0.1.0 -> 0.1.2 (matches CHANGELOG).
The .filter-repo-replacements.txt config itself is preserved — the mapping
rule is correct in intent, the bug is how git-filter-repo interpreted it.
A future rewrite needs either a newer git-filter-repo, a different syntax,
or explicit Uri/Alan capitalization-only rules.
The trufflesecurity/trufflehog@main action wrapper appends --fail itself, so repeating it in extra_args caused "flag 'fail' cannot be repeated" errors and broke every secret-scan run since the action's last bump.
… + docs + schema 15-agent /fswarmmax fix swarm closes all known pre-mogging folder drift across skill runtime paths, README tables, migration docs, and the CLAUDE-MD-PATCH template appended to user vaults at install. Skill-runtime fixes (agents 11 + supporting): - 31 of 49 pre-mogging folder references updated across 9 skill files + references/wiki-schema.md to resolve against the post-mogging 7-folder layout (01-Conversations / 02-Sources / 03-Concepts / 04-Index / 05-Projects / 06-Tasks / Claude-Memory). Historical prose describing the rename itself left verbatim (18 cases). docs/CLAUDE-MD-PATCH.md (agent 13): - Full rewrite, 147 -> 192 lines. Marker renamed <!-- mogging:* --> to <!-- 2ndbrain-mogging:* --> for namespace clarity. - Now carries the canonical 7-folder table, killed-folders callout, grandfathered-type mapping, 10 skills list, 4 scheduled agents with correct times, 3 non-negotiables, bot-prefix commits table, 9 hard rules. README.md (agent 12): - Regime-ownership table updated to post-mogging folder names. - Scheduled-agents table rewritten to match shipped plists + agent-spec write paths (all writing to 01-Conversations/VAULT/reports/*). - Backward-compat line inverted (aliases.yaml is for entity names, not folder-structure compat). MIGRATION.md + CONTRIBUTING.md (agent 14): - MIGRATION.md folder-numbering callout updated to 7-folder scheme. - CONTRIBUTING.md test harness path tests/run-all.sh -> tests/run_all.sh. .filter-repo-replacements.example.txt (agent 8): - Added explicit WARNING about v0.1.1 substring-bleed regression. Future forks see the corruption signature and the literal-only defense. plugin.json version 0.1.2 -> 0.1.3. Known gap: install.sh does not currently consume docs/CLAUDE-MD-PATCH.md. Follow-up task — flagged in CHANGELOG.
Closes the v0.1.3 known gap. Before this commit, docs/CLAUDE-MD-PATCH.md was the canonical post-mogging contract that was supposed to be appended to every user's vault CLAUDE.md at install time — but install.sh never read the file, so it was documentation-only. New users got skills + agents + launchd plists wired up but no contract installed into their CLAUDE.md. Added apply_claude_md_patch() as step 9.5, running between link_claude_memory and install_launchd: - Extracts the canonical block (markers inclusive) from docs/CLAUDE-MD-PATCH.md using awk line-range matching on the `<!-- 2ndbrain-mogging:start -->` / `<!-- 2ndbrain-mogging:end -->` markers (149 lines as of 0.1.4). - Idempotent: detects existing namespaced markers in $VAULT/CLAUDE.md and replaces the block between them. Never duplicates on re-run. - Legacy migration: vaults carrying the pre-namespaced `<!-- mogging:start -->` / `<!-- mogging:end -->` markers from older installs get the legacy block stripped and replaced with the new namespaced block in a single pass. No manual migration step. - Backup-before-mutation (non-negotiable #1): copies existing CLAUDE.md to $VAULT/Claude-Memory/backups/YYYY-MM-DD-HHMMSS/CLAUDE.md.bak before any write. Aborts cleanly on extraction failure (new exit code 41). - Fresh vaults: creates a minimal CLAUDE.md header and anchors the patch block below it. - Preserves all content above the markers byte-for-byte; drops trailing blank lines before appending so repeat runs don't accrete whitespace. - Honors --dry-run (logs intended patch, no write) and --apply (writes). Verified: `bash -n install.sh` passes; the awk extractor returns the expected 149-line block on the current CLAUDE-MD-PATCH.md. plugin.json bumped 0.1.3 -> 0.1.4.
Vendor the 11-file ADR-050 intelligence loop from ruvnet/ruflo (MIT, re-shipped via <ORG-A>/fidgetflo) into helpers/ with a provenance header on each file. Add hooks/intelligence-hooks.json overlay for 5 hook types (PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd). Extend install.sh with --with-intelligence (default off) and --symlink flags; hardlink is default with EXDEV symlink fallback. jq-merge preserves the mogging Stop hook untouched via array-concat on each of the 5 hook keys, same discipline as the existing Stop-hook merge. Update docs/CREDITS.md with the 6th upstream entry. Update README.md with a "What we retired" section naming the killed legacy folders (00-Inbox / 01-Fleeting / 05-Templates / 06-Assets), add the new install flags to the Flags table, add a "Self-learning tier (opt-in)" subsection, and add the ruflo bullet to Credits.
README: - Full rewrite in the operator voice with the maxxing→mogging origin story (Jens-flavored 2ndBrain-maxxing → tested 5 alternatives → merged best-of-five → self-learning was the missing piece → built for a layman). - Banner at top (2ndbrainmogging.png). - Quick Navigation table with hotlinks to every section. - Dedicated "Install Obsidian first" section pointing at obsidian.md with 4-step manual install + ~/Desktop/BRAIN folder suggestion. - Vault structure section now shows 05-Projects/ with example-project-1..3 placeholders (no real project names leaked). - 12 skills (10 existing + /import-claude + /import-notes) each described in plain English — one sentence per skill, no marketing fluff. - Optional "Bring your existing stuff in" section at the end covering both importers + /tether + /connect + /wiki audit follow-up loop. - Killed "The Obsidian + Claude Code second brain that respects your existing infrastructure" opener (it was wrong and boring). - Credits section honestly names the 5 upstream systems (AgriciDaniel, eugeniu, Jens, Karpathy, NicholasSpisak) + ruvnet for the opt-in intelligence tier. New skills (both plugin-namespaced): - skills/import-claude/SKILL.md — one-shot Claude.ai / ChatGPT export ingest, alias-classified, dry-run-previewed, writes conversation captures to 01-Conversations/, LIT-* mirrors to 02-Sources/, concept stubs to 03-Concepts/, respects owner: human, commits [bot:import-claude]. - skills/import-notes/SKILL.md — broad import covering Apple Notes (Exporter.app), OneNote (.docx), Notion (md+csv), Evernote (.enex), and raw .md/.txt/.docx/.pptx/.xlsx/.html/.rtf piles. Same routing rulebook as /import-claude. New helper scripts (no step-N language): - scripts/import-claude.sh — finds the mogged vault, locates the export zip (Claude.ai data-*-batch-*.zip or ChatGPT chatgpt-*.zip), extracts to <vault>/.import-staging/<ts>-claude/, then hands off to /import-claude. - scripts/import-notes.sh — checks for Exporter.app (macOS), validates pandoc + xlsx2csv, scans Desktop/Downloads/Documents for candidate files, then hands off to /import-notes. New docs (literal content, not redirects): - docs/PARSING-GUIDE.md — categorization rulebook rewritten for the 7-folder mogged layout (01-Conversations / 02-Sources / 03-Concepts / 04-Index / 05-Projects / 06-Tasks / Claude-Memory). Owner contract, file conversion rules, decision table. - docs/github-vault-guide.md — how to link 05-Projects/<project>/ to GitHub repos, gh CLI lookup pattern, path-substituted from the old 07-Projects/ version. - docs/claude-project-sync-guide.md — per-project subfolder layout (conversations/ + knowledge/ + assets/), file routing rules, validation (fake-PDF detection, magic-byte checks for zip formats), wikilink rules. Verified: shellcheck clean at warn + error severity; no hardcoded secrets in tracked files.
README: - Replace 'Jens (the AI-influencer guy on IG, you know who I mean)' with '[Jens Heitmann](https://www.instagram.com/jens.heitmann/)' in both the origin story and the Credits section. Credit where credit is due. Remaining Nathan→the operator hits caught by a deeper grep (agents/, tests/, references/) — all swept. The only remaining 'Nathan' occurrence in the repo is inside .filter-repo-replacements.txt which is gitignored (local name-mapping dictionary, never pushed).
- helpers/pattern-consolidator.sh 85-87: drop 'local' — the assignments
live inside a top-level case statement, not a function. Shellcheck
SC2168 error. Dropping 'local' is the safe fix (the vars are only
read in the same case branch).
- README Credits + origin story: proper attribution for the sources
that deserve it.
- eugeniu → https://github.com/eugeniughelbur/obsidian-second-brain
- Jens Heitmann → https://github.com/NulightJens/ai-second-brain-skills
(repo), plus his Instagram profile
- Credits list cleaned up; eugeniu and Jens now link to their actual
repos (and Jens gets both repo + IG, since you asked for the IG link
earlier too).
Audit state:
- shellcheck error-level: clean across all shell files
- secrets: zero
- tracked 'Nathan': zero
- ruvnet/claude-flow trailers: zero
- skills: 12 README rows = 12 on disk, all slash commands resolve
- cross-refs: all skill MD ../../docs/ paths resolve
- README links: all local paths resolve
- Remaining: shellcheck WARNING-level style issues in vendored
helpers/learning-optimizer.sh (SC2155) + install.sh (SC2034) —
vendored/upstream code, left untouched.
…ls' self-learning - 'Took the best 200 ideas from the five and threw out the other 800' was rhetorical precision that wasn't real; replaced with the honest merge-and-cut phrasing. - Self-learning paragraph: acknowledged a couple of the originals already had a self-learning layer (bootstrapping theirs was the heavy part) — this pack's is opt-in and ships clean.
…list PATH
README:
- The self-learning tier claim that it was vendored from 'ruvnet's
claude-flow / ruflo pattern-graph (ADR-050)' is not supported. The
specific files (learning-service.mjs, pattern-consolidator.sh, etc.)
do not exist at common paths in ruvnet/claude-flow or ruvnet/ruflo
(ruvnet/ruflo is a Docker chat-UI / MCP-bridge / ruvocal project,
not a pattern-graph intelligence loop). Three spots edited:
- 'What you get' bullet — generic 'pattern-graph' framing only
- Self-learning tier section — drop 'sixth upstream' + ADR-050
- Credits list — drop ruvnet entry entirely
- (Provenance headers inside helpers/*.sh + helpers/*.mjs still claim
'Vendored from claude-flow / ruflo (c) ruvnet'. Those files are
out-of-scope for this README edit; flagged separately.)
Plist templates — scheduled/launchd/io.<ORG-A>.mogging.*.plist:
- PATH env var now includes $HOME/.local/bin + $HOME/bin ahead of
/opt/homebrew/bin. Previously the installed plists could not find
`claude` because it lives at ~/.local/bin/claude — exit code 127
on every tick on real user systems. Fixed for future installs.
…ands Claude Code CLI doesn't have --headless or --audit. 'claude -p PROMPT' is already the non-interactive form. The 'audit' intent is semantic — carried by the prompt text 'execute agents/NAME.md in audit mode' — not a CLI flag. Including the bogus flags caused every scheduled tick to exit 1 with 'error: unknown option --headless'. Caught when re-running the installer against BRAIN2 and kicking a manual run of the morning agent — cd worked, claude resolved via the patched PATH (commit 9577383), but then the CLI rejected the flags.
… projects Closes the gap where install.sh assumed a pre-populated vault. New users running ./install.sh --vault ~/Desktop/BRAIN --apply against a fresh Obsidian vault now get the full 7-folder layout + index + example projects, instead of an empty folder where every skill write would fail. install.sh: - New --no-seed-vault flag (default: seed). Documented in --help, defaults block, README install table, and main() pipeline. - New seed_vault_from_template() at step 3.5 (between vault validation and settings backup). For each entry under vault-template/, copies it into $VAULT only if the destination does not exist. Strictly additive — no overwrites. Idempotent: re-running prints '0 entries seeded, N already present'. vault-template/: - 05-Projects/example-project-1/example-project-1.md - 05-Projects/example-project-2/example-project-2.md - 05-Projects/example-project-3/example-project-3.md Each demonstrates the filename=foldername rule with frontmatter, knowledge-base section, conversations section, related-projects cross-links, and a GitHub-Repos section (project 1 only). - 04-Index/Projects-Index.md Seed index that lists the three example projects + INCUBATOR + a 'how to add a new project' walkthrough. Makes [[example-project-1]] resolve in the graph immediately on install. - Removed empty .gitkeep stubs in 04-Index/ and 05-Projects/ now that real content exists. README: - Install flags table: documented --no-seed-vault. - 'On --apply' summary now mentions the seed step explicitly. Verified end-to-end against a throwaway empty vault: - First install: 9 top-level entries seeded (CLAUDE.md, AGENTS.md, all 6 numbered folders, Claude-Memory/, .DS_Store filtered). - Re-run: 0 seeded, 9 already present. Idempotent. - All 6 expected files present in the resulting vault. - shellcheck error-clean, bash -n clean.
… of ruvnet/ruflo@v3.5.80) Per the audit verification: the self-learning tier code (helpers/) is ruvnet's ruflo@v3.5.80, squash-imported into FidgetFlo, then vendored here. The MIT license requires preserving the copyright notice if the code stays — and the code stays. Restoring the attribution in the README only (per direction): - 'What you get' bullet now credits FidgetFlo with a parenthetical pointing at the ruflo v3.5.80 tag (since ruvnet/ruflo's main branch was rewritten to a different project after v3.5.80 — the tag is where the actual code still lives). - Self-learning tier section now names FidgetFlo as the upstream and notes the upstream-of-upstream chain. - docs/CREDITS.md, helpers/ provenance headers, and other places intentionally left untouched per direction.
Comprehensive fix of every finding surfaced by the preceding 5-agent audit.
14 parallel worker agents with non-overlapping file zones; 1 QA validator
confirmed 19/19 checks green before this atomic commit.
CRITICAL bugs fixed:
- vault-template/CLAUDE.md + AGENTS.md rewritten to match actual shipped
skills (12: save/wiki/challenge/emerge/connect/tether/backfill/aliases/
autoresearch/canvas/import-claude/import-notes) and agents (4: morning/
nightly/weekly/health). Previously listed fictional /capture/promote/link/
moc/project/task skills + "Graph Repair Agent / Inbox Processor /
Task Syncer / Weekly Curator" agents. This is what gets seeded into
every new user's vault — fix is critical.
- All 4 agents (morning/nightly/weekly/health) now commit with their own
[bot:<name>] prefix instead of [bot:wiki-heal]; this unbreaks the n8n
W1 echo-loop they were built to prevent.
- skills/save/SKILL.md: type: literature → type: source (prior value
halted the canonical parser on /save's own output).
- skills/autoresearch/SKILL.md: LIT-{slug} → SRC-YYYY-MM-DD-{slug} +
type: source; removed writes to nonexistent 03-Concepts/synthesis/ and
03-Concepts/entities/ subdirs; concept + synthesis stubs land flat in
03-Concepts/.
- commands/*.md reconciled against every SKILL.md: dropped fabricated
cosine-similarity auto-writes in connect (skill is read-only),
fabricated promote subcommand in wiki, TODO-resolve mode in autoresearch,
[bot:wiki-add] prefixes on skills with no commit flow, and the banned
MOC-*.md filename pattern in tether.
- helpers/ provenance headers rewritten — the prior "no local modifications"
claim was materially false (intelligence.cjs is 31674 bytes vs upstream
ruflo@v3.5.80's 8565; memory.js, router.js, session.js don't exist in
the upstream tag). New headers honestly frame the files as a FidgetFlo-
internal build descended from ruvnet/ruflo@v3.5.80 with extended
pattern-graph logic, dual-copyright MIT (ruvnet + <ORG-A>).
- LICENSE now preserves ruvnet's upstream copyright (MIT §1 compliance);
new NOTICE file at repo root documents the dual-copyright chain.
- test_onboarding.sh: 16/50 FAIL → 50/50 PASS. Removed 6 phantom-skill
assertions (onboard/recall/distill/index/route/scrub — never shipped);
repointed .claude-plugin/plugin.json assertions from vault to repo root
(it's the plugin manifest, not a vault asset).
- tests/run_all.sh: SKIP was silently counted as PASS; now reports
separate pass/skip/fail buckets + --strict flag to promote skips to
fails for CI.
- bin/doctor.sh: printed [doctor:FAIL] but exited 0; now tracks a FAIL
counter and exits 3 on any fail. Plugin-registration probe downgraded
to info (install.sh never calls `claude plugin add` — symlinks are
the source of truth).
- scripts/prepublish-check.sh: exited 0 when gitleaks missing (silent
bypass of secret gate); now exits 10 on missing tools. Added
--skip-missing-tools dev flag.
- scripts/import-claude.sh: no --dry-run/--yes gate before extracting;
now requires TTY confirmation, --yes, or --dry-run. Added full arg
parser + --help + proper exit codes (0/1/2).
- scripts/import-notes.sh: silently ignored --vault flag (no arg
parser); now has real flags (--vault/--source/--kind/--dry-run/
--yes/--help) with usage/exit-code discipline.
HIGH/MEDIUM fixes:
- README: "ten skills" → "twelve skills" in origin story; install `--apply`
summary rewritten to include all 14 main() steps (prior summary hid
the CLAUDE.md patch, Claude-Memory symlink, intelligence tier, and
doctor run); `{example-project-1,2,3, INCUBATOR}` extra space fixed;
Credits bullet paragraph spacing fixed.
- docs/CLAUDE-MD-PATCH.md: 10 skills → 12; added bot-prefix rows for
import-claude / import-notes / reconcile.
- docs/MIGRATION.md: retired `<!-- mogging:start/end -->` markers →
`<!-- 2ndbrain-mogging:* -->`; hardcoded WORK/OBSIDIAN path replaced
with generic vault-encoded-path resolver.
- docs/CREDITS.md: Karpathy + other folder-mapping prose rewritten for
the 7-folder contract; claude-flow/agentic-flow section updated to
match new helper provenance headers; NulightJens license verified
via GitHub API.
- docs/SECURITY.md: placeholder disclosure email → GitHub Security
Advisories URL + real backup address; example.com URLs → real
release URLs.
- docs/github-vault-guide.md: /tether claim softened to match actual
behavior.
- install.sh: unused DRY_RUN var removed (SC2034); apply_claude_md_patch
now content-diff idempotent (no more mtime churn on re-run); nested
.DS_Store scrub in seed_vault_from_template; top-level step index
comment above main() for README-audit parity.
- vault-template: added SOUL.md, CRITICAL_FACTS.md, index.md, log.md,
06-Tasks/TASKS.md stubs; .gitkeep files in all 4 VAULT/ subdirs so
they survive git-clone; example-project-1 gained content/ + misc-
building/ + GITHUB/ subdirs matching the README layout diagram.
- skills/tether: dropped 04-MOC back-compat; generalized 05-Projects/
GITHUB hub pattern for template use.
- skills/canvas: replaced [[MOC-*]] pattern with [[*-Index]].
- skills/emerge: Sunday 9pm → Friday 6pm (weekly agent — prior time was
the health agent's).
- skills/wiki: audit report destination moved to 01-Conversations/VAULT/
reports/ matching scheduled-agent contract.
- skills/backfill: hardcoded `-2ndBrain` path softened to generic
<encoded-vault-path>.
- agents/health.md: retired 07-Projects example → 05-Projects +
06-Tasks current paths.
- CI workflow: `actions/checkout@v4`, `gitleaks/gitleaks-action@v2`,
`trufflesecurity/trufflehog@main` all pinned to full 40-char SHAs
(SHA-pinning + human-readable version comment).
- helpers/learning-optimizer.sh: `npx agentic-flow@alpha` pinned to
`@3.0.0-alpha.2`; helpers/learning-hooks.sh: better-sqlite3 pinned
to `^11`.
- CHANGELOG.md [Unreleased] populated with everything between v0.1.4
and this commit.
QA VALIDATION (19/19 PASS before commit):
shellcheck --severity=error clean on all 17 .sh files; bash -n clean;
node --check clean on all 8 helpers; zero secrets in tracked files;
12 skills ↔ 12 dirs ↔ 12 commands ↔ 12 rows in README/patch; 4 agents
↔ 4 plists with aligned names; all retired folder names confined to
historical callouts; zero "Nathan" prose hits; LICENSE dual-copyright
+ NOTICE present; all 11 helper provenance headers honest; CI
SHA-pinned; tests/run_all.sh green; install.sh on empty vault seeds
13 entries + idempotent re-run; all README external URLs HEAD 200;
all 4 launchd plists loaded with exit 0.
Two blockers on the self-learning install path: 1. Launchd plists had PATH set but no nvm bin, so scheduled agents hit `sh: exec: node: not found` in SessionEnd hook. Sourcing $HOME/.nvm/nvm.sh inside ProgramArguments makes it version-agnostic — no hardcoded vN.N.N path to maintain. 2. merge_intelligence_hooks() used `(.[0] * .[1]) as $m | $m | .[0]...` — after the `$m |`, the pipeline context is the merged object, so `.[0]` threw "Cannot index object with number". Binding $old/$new before the merge fixes it and leaves the hook-array concat logic untouched. Verified: Stop hook preserved, 5 intelligence hooks appended, settings.json valid JSON. Verified end-to-end: install.sh --with-intelligence completes, doctor passes, 4 launchd jobs reload with working node PATH.
Closes the broken cross-reference in cli-maxxing's README that promised "2ndBrain-mogging... registers the Obsidian MCP with Claude Code" — until now, mogging did no such thing. Adds step 10.7: claude mcp add --scope user obsidian -- npx -y obsidian-mcp "$VAULT" Runs by default on every --apply; idempotent (skips if already registered); opt out with --no-obsidian-mcp. Gracefully noops if the claude CLI or $VAULT isn't set. README gains a row in the flag table, an "Obsidian MCP" subsection explaining upstream + rewire command, and an inline mention in the --apply step order.
…statusline Closes the second half of cli-maxxing's broken cross-reference (the first half — obsidian-mcp — was closed in 5f89b7d). Cli-maxxing's README promises "2ndBrain-mogging adds a 🧠 brain indicator" to its statusline but mogging never contributed anything. Also fixes a live bug: cli-maxxing's hardcoded path regex was OBSIDIAN/(2ndBrain|MASTER), which doesn't match Nate's renamed BRAIN2 vault, so the 🧠 indicator was silently broken. Architecture: marker-file handshake. - mogging writes $HOME/.claude/.mogging-vault containing the absolute vault path (step 10.8, opt out via --no-statusline-brain). - cli-maxxing's statusline reads that file and case-matches $CWD against the contents. Exact-match or trailing-/ prefix wins; siblings like BRAIN2-OLD correctly don't. Legacy path regex kept as fallback for pre-marker installs. - No mogging installed → marker absent → indicator never shows. No cli-maxxing installed → marker is a harmless ~100-byte no-op. Also fixes an idempotency-check regex in install_obsidian_mcp — it anchored on [[:space:]] but `claude mcp list` uses `<name>:` separators, so the already-registered detection was silently missing and re-adding raised a warn. Now anchors on `^obsidian:`. README gains a "Statusline (redirect to cli-maxxing)" section, a flag-table row, and an inline mention in the --apply step order.
Adds entries for the three install.sh changes that shipped today but hadn't landed in CHANGELOG yet: - 646d073: launchd plists now source nvm; jq merge bug in merge_intelligence_hooks fixed so --with-intelligence completes - 5f89b7d: step 10.7 registers obsidian-mcp with Claude Code - 6aa0802: step 10.8 writes ~/.claude/.mogging-vault marker for cli-maxxing statusline No version bump — this repo doesn't semver; the [Unreleased] section just picks up three new bullets.
README: add Prerequisites section before the install steps — claude and jq must be installed first; includes exact fix commands for both. install.sh: replace terse exit messages with full remediation instructions pointing to cli-maxxing step-1 (claude) and brew/apt/dnf (jq/git). Dry-run banner is now a hard-to-miss box that shows the exact --apply command to use. --vault-missing and --vault-not-a-directory errors now include Obsidian guidance.
Previously only secret-scan.yml ran in CI. This closes three gaps: - test.yml: runs tests/run_all.sh on ubuntu-latest + macos-latest with jq preinstalled. 5 test_*.sh scripts are now CI-verified instead of relying on local runs only. - lint.yml: shellcheck (pinned ludeeus/action-shellcheck@00cae500 = v2.0.0) at warning severity + bash -n syntax check across all 18 tracked shell files. - dependabot.yml: weekly github-actions updates with 'dependencies' label, matching the cli-maxxing / creativity-maxxing convention. All new workflows: - pin actions/checkout to 34e114876b0b11c390a56381ad16ebd13914f8d5 (v4.3.1) with persist-credentials: false - set permissions: contents: read (minimal) - set timeout-minutes on every job - use a concurrency group with cancel-in-progress.
Defense-in-depth. Claude Code owns the CLAUDE_SESSION_ID env var, so the current `touch "$MARKER"` path can't actually be attacker-controlled today. But if that value ever carried '/' or '..' (future schema change, upstream bug, malformed CI input) the hook would write the marker file outside ~/.claude/mogging-stop-markers/ — potentially clobbering arbitrary files under $HOME. Strip everything outside [A-Za-z0-9_-] before building the marker path, and fall back to the epoch timestamp if the sanitized value empties out. Found in security audit.
… exit-code checks Two changes, both defensive: 1. Add `set -uo pipefail` at the top. Matches the sibling helpers (learning-optimizer.sh, pattern-consolidator.sh). Was missing, which meant unset-var typos and silent pipe failures would drift past unnoticed during session-end flush. We deliberately skip -e because a few branches inspect $? after a command that may legitimately fail. 2. Fold each `local var=$(cmd); if [ $? -eq 0 ]` into `if local var=$(cmd); then`. The original pattern is broken: `local`'s exit code masks the inner command's, so the if-check always succeeded whether `node` exited 0 or 1. Post-fix, the shell actually branches on the real node exit status. Found in security audit (hardening). Self-learning tier is opt-in via --with-intelligence, so no existing user's install changes behavior.
…l guards, Desktop-tarball purge, dead links, stale fixture Scripts: - install.sh: fix merge_stop_hook primary jq append (bound $old/$new before piping — '.[0]' on the merged object threw 'Cannot index object with number' and silently punted every run to the fallback; missed sibling of the merge_intelligence_hooks fix in 04c796e) - bin/doctor.sh: guard nvm-claude probe (failed glob + pipefail killed the whole doctor run silently on hosts without nvm) - bin/backup-vault.sh: write to ~/WORK/<vault>-BACKUPS/, never ~/Desktop (TCC-protected; Desktop tarballs forbidden by non-negotiable #1); vault resolution arg > ~/.claude/.mogging-vault marker > ~/BRAIN2 - helpers/*: #!/usr/bin/env bash shebangs (portability); learning-hooks.sh dispatch ${N:-} defaults so documented optional-arg calls no longer crash under set -u; learning-optimizer.sh avg_quality empty-guard (empty patterns table wrote invalid JSON to learning.json) - scripts/import-{claude,notes}.sh: add home-dir vault candidates (~/BRAIN2 etc.) that the help text already promised but discovery missed Skills (live via symlink — surgical): - save/wiki SKILL.md: ../references/wiki-schema.md resolved nowhere through the installed symlink; schema now hardlinked into each skill's references/ and prose points at ./references/wiki-schema.md Docs: - dead Karpathy gist URL -> live llm-wiki gist (442a6bf...) in CREDITS, foundations/01, why-not-karpathy-pure; README credit pointed at zero-to-hero course page by mistake - huytieu/COG -> COG-second-brain (old URL dead); LLM-Wiki-v2 marked deleted (repo gone, attribution preserved) - CLAUDE-MD-PATCH non-negotiable #1 + MIGRATION.md: backup tarballs to ~/WORK/<vault>-BACKUPS/, never ~/Desktop (known-stale line) - README flag table: add --no-obsidian-app, --no-shell-shortcuts - CONTRIBUTING: describe the real harness (no tests/expected/ dir exists) Tests: - fixtures/sample-vault migrated to the 6-folder contract (05-Projects -> 01-Projects, 06-Tasks -> 05-Tasks, 01-Conversations removed); kills the file-not-found noise before test_uuid_preservation's SKIP
…ne links, search nested projects
Three confirmed doctor defects:
1. install.sh never passed its resolved --vault to bin/doctor.sh, which read
~/.claude/.mogging-vault instead — so './install.sh --vault /tmp/test-vault'
doctor-checked the wrong vault. doctor.sh now takes --vault PATH (highest
precedence, then marker, then $VAULT env) and run_doctor threads it.
2. Symlink checks demanded ~/.claude/{skills,commands,agents} links point at
THE clone doctor runs from; a fresh clone on an installed machine produced
~29 false FAILs. A link that resolves to a valid alternate copy (same kind;
skill dirs must ship SKILL.md) now degrades to [doctor:warn]. Dangling or
wrong-shape targets still FAIL.
3. Projects-Index check assumed depth-1 01-Projects/<NAME>/<NAME>.md; projects
nested under INCUBATOR/ARCHIVE/CREATIVE/MINDFULNESS (the layout the vault
CLAUDE.md mandates) false-FAILed. Now searches folder depth 1-3 with glob
metachars escaped.
Verified by literal runs (flag override vs marker, alt-clone WARN + dangling
FAIL, nested depth-2/3 resolution, install.sh --dry-run threading). Test
suite at baseline: 3 pass / 4 skip / 0 fail.
Two rounds of git-filter-repo rewrote all 76 commits to replace operator identity (name, email), org/brand names (LORECRAFT, PARZVL, FIDGETCODING, WAGMI, LAVA-NET) with stable placeholders (the operator, <ORG-A>..<ORG-E>). MMA hand-edited in 5 files (3-char collision with COMMAND substring). Also fixed 26 ***REMOVED*** artifacts left by the v0.1.1 regex bleed, restored comment separator lines, added gitleaks allowlist for descriptive filename slugs, and scoped the PII sweep to tracked files only so private operator skills (gitignored) don't false-positive. All 7 prepublish gates pass.
…log.md — bare log.md caused a stray 02-Sources/log.md in the vault (found+relocated in 2026-07-03 heal)
The PII scrub left a bare <ORG-A> token inside the well-known-hub case pattern at bin/doctor.sh:335, where the angle brackets parse as a redirection and break bash -n / shellcheck (Lint Shell Scripts failed on e4d1b63, the first .sh push since the scrub — prior .md-only commits were skipped by paths-ignore, so the latent break sat undetected). Quoting it makes the branch a valid inert literal without re-introducing the real org name.
Every scheduled agent's frontmatter contradicted itself. morning.md declared `reads: Morgen MCP (list_events, list_tasks)` while `allowed-tools` listed only Read/Write/Edit/Glob/Bash — so the Morgen tools were not merely denied, they were absent from the agent's tool namespace, which is why runs reported "Morgen MCP isn't registered at all this session". health.md had the same gap against its Gate D task-count parity check, which has been blocked for eight weeks. - morning: + Grep, + mcp__morgen__list_events / list_tasks / list_calendars - health: + Edit, Grep, + mcp__morgen__list_tasks / list_events - nightly, weekly: + Edit (both perform surgical counter edits) Also documents the Claude-Memory symlink caveat in the three specs that write through it: Write/Edit hard-refuse symlink traversal and the resolved target sits outside the vault sandbox root, so the `Claude-Memory/<file>` form fails 100% of the time and must be replaced by the resolved absolute path plus an --add-dir grant. <ORG-A>/<ORG-C> template placeholders left intact.
Installs 5 skills from kepano/obsidian-skills (MIT) into ~/.claude/skills: obsidian-markdown, obsidian-bases, obsidian-cli, json-canvas, defuddle. These were already load-bearing in practice but had no install path. The vault's note formats ARE Obsidian Flavored Markdown -- wikilinks, callouts, properties, .base, .canvas -- so without the format skills an agent writes plain CommonMark and the graph quietly loses edges. defuddle covers the capture side: WebFetch summarizes through a small model and returns ~20 lines for a 12.5k-word source, which defeats the purpose of a 02-Sources note being the record of what a page actually said. Fetched at install time at a pinned SKILLPACK_COMMIT rather than vendored, matching the rug-pull defense creativity-maxxing uses for blader/humanizer. Bump the pin to take upstream changes. Because the packs are copied rather than symlinked, unlink_kind() skips them on uninstall, so uninstall.sh grows a dedicated remover. The shared defuddle CLI is left in place and reported, not silently yanked. Opt out with --no-skill-packs. 14 new assertions, network-free. Full suite: 8 total, 4 passed, 4 pre-existing skips, 0 failed.
Both tools read and write inside the vault -- hyperresearch owns $VAULT/research/ and injects its own CLAUDE.md block -- so they belong to the vault pack rather than cli-maxxing's generic tool steps. OFF by default, same posture as --with-intelligence. A full-tier research run reads 55-130 sources and bills real tokens; that should never arrive as a surprise. The python pin is the load-bearing detail. hyperresearch declares requires-python >=3.11,<3.14, but pipx picks its own default (3.14 on current Homebrew), installs ANYWAY with only a warning, and then fails at fetch time where crawl4ai is broken. That reads as a broken tool, not a bad install. We now resolve python3.13/3.12/3.11 and pin to the first hit, or skip with a brew pointer rather than install something broken. Also prints the hard graphify guardrail: never crawl a vault root, which on a real vault means embedded clones and node_modules. Suite: 8 total, 4 passed, 4 pre-existing skips, 0 failed.
source_of_truth appeared zero times in references/ despite being required by every vault's CLAUDE.md frontmatter block, so /wiki audit was flagging pages against a rule the pack never defined. Required on type: concept and type: synthesis -- the only types that assert things about a live external world and can therefore rot. Not required on source (already carries source_url, which answers 'where did this come from', not 'where is the live authority'), conversation, moc, or adr: those are records, and a record cannot become false. Bans placeholder values (pending, vault structure, this file). Omit the key instead -- a missing field is an honest gap, a placeholder is a gap that reads as done. Documents absolute local paths as first-class values, which is the common case for operator-owned conventions. Adds a verify-before-writing rule: an address that 404s is worse than none.
An earlier pass genericized most examples to <ORG-B>/<ORG-D> placeholders but missed three: a client project paired with a person's first name in a doctor.sh comment, a client folder in the graph-clean filter list, and a private repo name in the GitHub guide. All three now match the surrounding placeholder style.
A changelog entry credited an install-transcript source by naming three real people. They did not consent to appear in a public repo; the sourcing note works without them.
The installer, backup script, import scripts and docs all used the author's own vault name as the worked example and as backup-vault.sh's fallback default. It is a private name and the wrong default for anyone else; the marker-file lookup still runs first, so a configured vault is unaffected. Also squared up the dry-run banner: three lines were a character short of the box width before this change, which the longer placeholder made visible.
Lint Shell Scripts has been red since 2026-08-07. Both warnings were in this test file and unrelated to any recent change: - SC2043: the closed-PATH setup looped over a single literal. Moved to an array so the extension point survives without a suppression. - SC2034: OUT3 was assigned and never read — the capture only existed to swallow stdout while still running the installer. Now says that directly. Repo is clean at the CI's -S warning severity. test_vault_skill_packs 14/14 pass.
…hestrator (healthy ≤45m, WARN 45–90m; watchdog 2h/90m)
…can't fail the scan The 2026-10-23 failure was not a finding. The action's anonymous owner lookup hit the runner IP's rate limit, it assumed a license was required, and it stopped before scanning. The 2026-09-23 PR failure was the same missing token.
run_all.sh printed ALL GREEN with 4 of 8 test files skipped. Any skip now ends on "PARTIAL: N passed, N skipped, 0 failed. Skipped tests did not run." Exit codes are unchanged. tests/test_run_all_summary.sh runs the real harness over throwaway tests to keep it that way. The 4 skipped files stay skipped: they drive a CLI that doesn't exist, because those skills ship as SKILL.md only. That isn't a credentials gap, and a fake CLI would only test itself. Also make LICENSE detectable: a copyright statement wrapped across three lines stopped it matching the MIT text. ruvnet's copyright now fits on one line, and NOTICE carries the detail that was cut.
aliases, discuss-before-write, scope-guards and uuid-preservation skipped because the skills are instructions with nothing to run. The rules now also exist as code in bin/save, bin/wiki, bin/aliases and bin/lib/vault-gate.sh, and the tests run that code against fixtures in a temp vault. CI runs --strict, so a skip fails the build. Adds an opt-in PreToolUse hook (install.sh --with-guard) that blocks a Write or Edit that breaks a task ID, and holds /wiki and /autoresearch to their scope. Also fixes /save and wiki-schema.md telling the model to mint a UUIDv4 for new tasks. W1 mints m-XXXXXXXX and its parser ignores anything else, so those tasks stranded in Obsidian.
install.sh --with-memory turns on bin/memory: decay, promotion, and what was true when, with frontmatter as the only data model. It rewrites owner: wiki and owner: llm notes only, with --apply, after a backup, and only the frontmatter. Other notes get a proposal. This is the smallest honest version. Decay is a date rule and promotion is a link count. No reasoner, no contradiction detection, no inference, no graph store, and nothing runs it on a schedule. PHILOSOPHY.md says so.
The earlier scrub left a placeholder as the holder. Only these copyright lines change; the year, the MIT text and the ruvnet notice stay as they were.
ESSENCE is the one-pager and EVOLUTION is the dated history, tied to commits and CI runs. AGENTS points readers at both early. README links to them.
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.94.3 to 3.99.7. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@47e7b7c...31ce31e) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.7 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
fidgetcoding
deleted the
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7
branch
November 5, 2026 15:52
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps trufflesecurity/trufflehog from 3.94.3 to 3.99.7.
Release notes
Sourced from trufflesecurity/trufflehog's releases.
... (truncated)
Commits
31ce31eFix 7z and rar panics in the archive handler and log recovered panic stacks (...50bc667feat(detectors): add Infisical service token detector (#5445)4723140feat(detectors): add Fireworks AI API key detector (#5447)8276bc4ci(lint): pin the semgrep container image by digest (#5245)f6984beAdd xAI analyzer (#5456)282085cfix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)b1bb823Fix --include-wikis help typo and huggingface README description (#5471)fd43a88Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)3bd461fsecurity: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)d6ea4a5Clean up Filesystem source logging for per-source debug (#5465)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)