chore(deps): bump trufflesecurity/trufflehog from 3.94.3 to 3.99.7

.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
       "name": "2ndbrain-mogging",
       "source": {
         "source": "github",
-        "repo": "<ORG-A>/2ndBrain-mogging",
+        "repo": "fidgetcoding/2ndBrain-mogging",
         "ref": "main"
       },
       "path": "."

.claude-plugin/plugin.json

@@ -1,18 +1,18 @@
 {
   "$schema": "https://claude.ai/schemas/plugin.json",
   "name": "2ndbrain-mogging",
-  "version": "0.1.0",
+  "version": "0.1.4",
   "description": "Obsidian vault automation for Claude Code. Save conversations, compile sources into a living wiki, audit the graph, challenge your own thinking. Amalgamation of Karpathy's LLM Wiki + Jens + eugeniu + AgriciDaniel + NicholasSpisak, hardened for operator vaults with live sync.",
   "author": {
-    "name": "<ORG-A>",
+    "name": "fidgetcoding",
     "email": "operator@example.com",
-    "url": "https://github.com/<ORG-A>"
+    "url": "https://github.com/fidgetcoding"
   },
   "license": "MIT",
-  "homepage": "https://github.com/<ORG-A>/2ndBrain-mogging",
+  "homepage": "https://github.com/fidgetcoding/2ndBrain-mogging",
   "repository": {
     "type": "git",
-    "url": "https://github.com/<ORG-A>/2ndBrain-mogging.git"
+    "url": "https://github.com/fidgetcoding/2ndBrain-mogging.git"
   },
   "engines": {
     "claude-code": ">=1.4.0"

.filter-repo-replacements.example.txt

@@ -0,0 +1,83 @@
+# .filter-repo-replacements.example.txt
+#
+# Example / template for the real `.filter-repo-replacements.txt` file used by
+# `git-filter-repo --replace-text` to scrub personal names and private
+# project names from the repo's git history before going public.
+#
+# The real file is git-ignored (see .gitignore) and lives only on the
+# operator's local machine. This example shows the format with fake names
+# so you can build your own replacements file if you fork this pack.
+#
+# ---------------------------------------------------------------------------
+# Format rules
+# ---------------------------------------------------------------------------
+#
+# - Each line is OLD==>NEW (exact LITERAL string match — see warning below).
+# - Comments start with `#`. Blank lines are ignored.
+# - More specific patterns must come BEFORE shorter, more general ones
+#   or they'll be shadowed by the shorter pattern.
+# - If a real name is a substring of a brand name you want to preserve
+#   (e.g. a first name that also appears inside a trademarked compound),
+#   add a self-preserving "Brand==>Brand" no-op line BEFORE the short
+#   pattern so the brand survives unchanged.
+# - Placeholders on the right-hand side should be stable across all files
+#   and documented in docs/placeholder-names.md.
+#
+# ---------------------------------------------------------------------------
+# WARNING — do NOT use `regex:\bNAME\b==><replacement>` rules
+# ---------------------------------------------------------------------------
+#
+# v0.1.1 of this pack attempted word-boundary regex rules to scrub lowercase
+# short names (e.g. `regex:\buri\b==><person-i>`). The `regex:` prefix was
+# silently ignored by the installed git-filter-repo version, and the scrub
+# degenerated into a literal substring replacement of `\buri\b`, which in
+# turn mangled every English word containing `uri` (`security`, `during`,
+# `heuristics`, `buried`, `configuring`, `gesturing`, etc.).
+#
+# Defensive rule: use ONLY literal matches in this file. For short names
+# that coincide with English word fragments, rely on the capitalized form
+# (`<PERSON-I>==><PERSON-I>`) and accept that lowercase standalone prose mentions
+# will not be scrubbed. That is far safer than corrupting the codebase.
+#
+# ---------------------------------------------------------------------------
+# Example entries (FAKE names — replace with your own)
+# ---------------------------------------------------------------------------
+
+# Full names first, so they match before the short forms below
+ExampleFirstname ExampleLastname==><PERSON-X>
+AnotherFirstname AnotherLastname==><PERSON-Y>
+
+# Self-preserving brand rule (protects a brand that starts with a first name
+# you're about to rewrite — e.g. if you're rewriting "Taylor" but want
+# "Taylor-Made" to stay intact, put the brand rule BEFORE the short rule).
+ExampleBrand-Compound==>ExampleBrand-Compound
+
+# Short forms (first name only, last name only). These match anything the
+# full-name line above didn't already catch.
+ExampleFirstname==><PERSON-X>
+ExampleLastname==><PERSON-X>
+AnotherFirstname==><PERSON-Y>
+AnotherLastname==><PERSON-Y>
+
+# Private project / codename
+ExampleProject==><PROJECT-X>
+ExampleProject Codename==><PROJECT-X>
+
+# ---------------------------------------------------------------------------
+# Usage
+# ---------------------------------------------------------------------------
+#
+# 1. Copy this file to `.filter-repo-replacements.txt` (git-ignored).
+# 2. Replace the example entries with your real mappings.
+# 3. Run:
+#
+#      git filter-repo --replace-text .filter-repo-replacements.txt --force
+#
+# 4. Force-push:
+#
+#      git push origin --force --all
+#      git push origin --force --tags
+#
+# 5. After the push succeeds, the real `.filter-repo-replacements.txt` can
+#    be deleted — the mapping should live only in your private
+#    `Claude-Memory/aliases.yaml`.

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# CODEOWNERS — every file requires review from @fidgetcoding.
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-sec<person-i>ty/customizing-your-repository/about-code-owners
+*       @fidgetcoding

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"

.github/workflows/lint.yml

@@ -0,0 +1,82 @@
+name: Lint Shell Scripts
+
+# ----------------------------------------------------------------------------
+# ShellCheck + bash -n gate for every shell script in the repo.
+# Matches the pinned SHA convention used by cli-maxxing and creativity-maxxing.
+#
+# ShellCheck action is pinned to 00cae500 = ludeeus/action-shellcheck@v2.0.0
+# because trilogy-group v2.0.0 and prior were moving tags. See
+# `reference_action_shellcheck_pin` in the operator's memory for history.
+# ----------------------------------------------------------------------------
+
+on:
+  push:
+    branches: [main, 'ci/**']
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'README*'
+      - 'NOTICE'
+      - 'LICENSE'
+      - 'why-not-*.md'
+      - '.github/CODEOWNERS'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'README*'
+      - 'NOTICE'
+      - 'LICENSE'
+      - 'why-not-*.md'
+      - '.github/CODEOWNERS'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: ShellCheck (warning severity)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
+        with:
+          scandir: '.'
+          severity: warning
+          ignore_paths: node_modules tests/fixtures
+
+  syntax-check:
+    name: bash -n syntax check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Parse every shell script with bash -n
+        run: |
+          failed=0
+          while IFS= read -r -d '' f; do
+            if ! bash -n "$f" 2>&1; then
+              echo "::error file=$f::bash -n parse failed"
+              failed=1
+            fi
+          done < <(find . \
+            -type f -name "*.sh" \
+            -not -path "./.git/*" \
+            -not -path "./node_modules/*" \
+            -not -path "./tests/fixtures/*" \
+            -print0)
+          if [ "$failed" -ne 0 ]; then
+            exit 1
+          fi
+          echo "All shell scripts parsed cleanly"

.github/workflows/secret-scan.yml

@@ -0,0 +1,91 @@
+name: secret-scan
+
+# ----------------------------------------------------------------------------
+# Secret scanning gate for the public 2ndBrain-mogging repo.
+#
+# Runs on:
+#   - every push to main
+#   - every pull request targeting main
+#   - a daily cron (03:17 UTC) to catch newly-published detection patterns
+#
+# Two independent jobs run in parallel so a false-negative in one engine
+# doesn't hide a real leak caught by the other:
+#   1. gitleaks  — custom ruleset in .gitleaks.toml (Morgen, n8n, PII)
+#   2. trufflehog — verified-only, fail-closed (no unverified noise)
+#
+# Permissions are locked to contents:read. No write, no id-token.
+# Each job has a 10-minute timeout.
+# ----------------------------------------------------------------------------
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # 03:17 UTC daily — off-peak, off-the-hour so we don't pile on GH runners
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: gitleaks (custom ruleset)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository (full history)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          # Full history required so gitleaks can scan every commit, not
+          # just the tip. Shallow clones miss historical leaks.
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Run gitleaks with custom config
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7  # v2.3.9
+        env:
+          # The action looks up the repo owner to decide whether a license is
+          # needed. Without a token that lookup is anonymous, and when the
+          # runner's IP is rate limited it fails closed with "missing gitleaks
+          # license" before scanning anything. Pull requests refuse to scan
+          # without a token at all.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Point the action at our pinned config. No GITLEAKS_LICENSE is set,
+          # which is intentional for an OSS repo under the free tier.
+          GITLEAKS_CONFIG: .gitleaks.toml
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true"
+          GITLEAKS_ENABLE_SUMMARY: "true"
+
+  trufflehog:
+    name: trufflehog (verified-only)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository (full history)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Run trufflehog (filesystem mode)
+        # HIGH RISK historically ran as @main (moving HEAD of third-party action).
+        # Now pinned to v3.94.3 commit SHA. Re-pin manually before bumping — never
+        # go back to @main, @master, or any moving tag on a third-party action.
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2  # v3.99.7
+        with:
+          # Scan the whole working tree. `--only-verified` suppresses noisy
+          # unverified hits; the action wrapper appends `--fail` itself, so
+          # adding it here causes "flag 'fail' cannot be repeated" errors.
+          path: ./
+          extra_args: --only-verified