fix: publish history-safe Claude plugin v0.3.1

.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
     "url": "https://github.com/TerminallyLazy"
   },
   "description": "Claude Code marketplace for Tree Ring Memory v0.14 local-first recall and receipt-backed harness readiness.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "plugins": [
     {
       "name": "tree-ring-memory",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tree-ring-memory",
   "displayName": "Tree Ring Memory",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Local-first memory lifecycle and receipt-backed harness guidance for Claude Code using Tree Ring Memory v0.14+.",
   "author": {
     "name": "TerminallyLazy",

PRIVACY.md

@@ -20,5 +20,6 @@ Claude Code, the operating system, source-control provider, or another tool the
 user chooses to invoke.
 
 Support and privacy questions may be filed at
-<https://github.com/TerminallyLazy/tree-ring-memory-claude-plugin/issues>.
-Do not include secrets or private memory content in a public issue.
+<https://github.com/TerminallyLazy/Tree-Ring-Memory/issues>.
+Do not include secrets, vulnerability details, or private memory content in a
+public issue.

SECURITY.md

@@ -48,5 +48,9 @@ Open a private vulnerability report on the canonical framework repository:
 
 <https://github.com/TerminallyLazy/Tree-Ring-Memory/security/advisories/new>
 
-If GitHub advisories are unavailable, open a minimal public issue without
-including exploit details or sensitive data.
+Use the canonical issue tracker only for non-sensitive support:
+
+<https://github.com/TerminallyLazy/Tree-Ring-Memory/issues>
+
+Never include vulnerability details, secrets, tokens, private memory contents,
+or personal data in a public issue.

SUBMISSION.md

@@ -5,11 +5,11 @@
 - Name: Tree Ring Memory
 - Plugin identifier: `tree-ring-memory`
 - Source: <https://github.com/TerminallyLazy/tree-ring-memory-claude-plugin>
-- Release: `v0.3.0`
+- Release: `v0.3.1`
 - Category: Developer Tools / Workflow Orchestration
 - License: MIT
 - Homepage: <https://terminallylazy.github.io/Tree-Ring-Memory/>
-- Support: <https://github.com/TerminallyLazy/tree-ring-memory-claude-plugin/issues>
+- Support: <https://github.com/TerminallyLazy/Tree-Ring-Memory/issues>
 
 Description:
 

TERMS.md

@@ -18,4 +18,4 @@ availability, accuracy, non-infringement, or data durability, to the maximum
 extent permitted by law. The limitations in the included MIT License apply.
 
 Questions may be filed at
-<https://github.com/TerminallyLazy/tree-ring-memory-claude-plugin/issues>.
+<https://github.com/TerminallyLazy/Tree-Ring-Memory/issues>.

scripts/validate.py

@@ -9,7 +9,10 @@
 
 
 ROOT = Path(__file__).resolve().parents[1]
-EXPECTED_WRAPPER_VERSION = "0.3.0"
+EXPECTED_WRAPPER_VERSION = "0.3.1"
+UNSAFE_TOKEN_EXPORT = "export TREE_RING_COORDINATOR_TOKEN='<"
+CANONICAL_ISSUES = "https://github.com/TerminallyLazy/Tree-Ring-Memory/issues"
+CANONICAL_ADVISORY = "https://github.com/TerminallyLazy/Tree-Ring-Memory/security/advisories/new"
 
 
 def read(relative: str) -> str:
@@ -75,6 +78,7 @@ def validate_skill() -> None:
             "--operation-id",
             "--source-ref",
             "TREE_RING_COORDINATOR_TOKEN",
+            "history-safe, no-echo",
             "same-host local-filesystem processes",
             "not a read ACL",
             "schema v3",
@@ -203,6 +207,8 @@ def validate_security_boundary() -> None:
             "network-filesystem safety",
             "Harness Readiness",
             "Configuration alone is not",
+            CANONICAL_ADVISORY,
+            CANONICAL_ISSUES,
         ],
     )
 
@@ -212,23 +218,39 @@ def validate_security_boundary() -> None:
             "does not operate a hosted service",
             "local SQLite database",
             "does not receive that database",
+            CANONICAL_ISSUES,
         ],
     )
     require_markers(
         "TERMS.md",
         [
             "MIT License",
             "provided without warranty",
+            CANONICAL_ISSUES,
         ],
     )
     require_markers(
         "SUBMISSION.md",
         [
-            "v0.3.0",
+            "v0.3.1",
             "claude plugin validate . --strict",
             "smoke_v014.sh",
         ],
     )
+    skill = read("skills/tree-ring-memory/SKILL.md")
+    if UNSAFE_TOKEN_EXPORT in skill:
+        raise SystemExit("token-bearing export example must not appear in the skill")
+    public_text = "\n".join(
+        path.read_text(encoding="utf-8")
+        for path in ROOT.rglob("*")
+        if path.is_file()
+        and ".git" not in path.parts
+        and path.resolve() != Path(__file__).resolve()
+        and path.suffix.lower()
+        in {".json", ".md", ".py", ".sh", ".toml", ".txt", ".yaml", ".yml"}
+    )
+    if "tree-ring-memory-claude-plugin/issues" in public_text:
+        raise SystemExit("support and security links must use the canonical repository")
 
 
 def validate_workflow() -> None:

skills/tree-ring-memory/SKILL.md

@@ -392,7 +392,8 @@ optional Coordinated policy:
 
 ```bash
 tree-ring --root .tree-ring policy enable --coordinator release-coordinator
-export TREE_RING_COORDINATOR_TOKEN='<one-time capability printed by enable>'
+# Set and export TREE_RING_COORDINATOR_TOKEN with a history-safe, no-echo prompt
+# supported by your shell, or inject it through an approved secret manager.
 tree-ring --root .tree-ring policy status
 tree-ring --root .tree-ring policy audit --limit 100
 ```
@@ -401,7 +402,9 @@ Enable prints the capability once. Put it only in
 `TREE_RING_COORDINATOR_TOKEN`; never pass it as a CLI flag or place it in a
 memory, log, source ref, transcript, or committed file. Tree Ring stores only a
 hash. `policy status` and `policy audit` are read-only and do not reveal the
-capability. Inject it only into coordinator processes, and launch every ordinary
+capability. Do not paste it into an `export` command; use a history-safe,
+no-echo prompt supported by the current shell or approved secret-manager
+injection. Inject it only into coordinator processes, and launch every ordinary
 worker with `TREE_RING_COORDINATOR_TOKEN` unset so fan-out does not inherit
 coordinator authority.
 
@@ -428,7 +431,8 @@ replace the environment value with the newly printed capability:
 
 ```bash
 tree-ring --root .tree-ring policy rotate --coordinator release-coordinator-next
-export TREE_RING_COORDINATOR_TOKEN='<new one-time capability>'
+# Replace TREE_RING_COORDINATOR_TOKEN through the same history-safe, no-echo
+# input path before using the new capability.
 tree-ring --root .tree-ring policy disable
 unset TREE_RING_COORDINATOR_TOKEN
 ```