From d05d78ae868ca0172bcb9bced70c6eb8dc8d6ee4 Mon Sep 17 00:00:00 2001 From: TerminallyLazy Date: Tue, 25 Aug 2026 17:36:50 -0400 Subject: [PATCH] Harden agent CLI bootstrap guidance --- Cargo.lock | 6 +++--- Cargo.toml | 2 +- README.md | 6 +++--- crates/tree-ring-memory-cli/Cargo.toml | 4 ++-- .../src/agent_awareness.rs | 17 +++++++++++---- crates/tree-ring-memory-sqlite/Cargo.toml | 2 +- docs/integrations/agent-skill.md | 14 ++++++++----- docs/press-kit.md | 4 ++-- marketing/README.md | 2 +- plugins/tree-ring-memory/README.md | 9 +++++++- .../skills/tree-ring-memory/SKILL.md | 14 ++++++++++--- skills/tree-ring-memory/SKILL.md | 14 ++++++++++--- templates/dox/AGENTS.md | 21 ++++++++++++------- 13 files changed, 78 insertions(+), 37 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a226cf1..193c03f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1690,7 +1690,7 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" [[package]] name = "tree-ring-memory-cli" -version = "0.15.0" +version = "0.15.1" dependencies = [ "chrono", "clap", @@ -1709,7 +1709,7 @@ dependencies = [ [[package]] name = "tree-ring-memory-core" -version = "0.15.0" +version = "0.15.1" dependencies = [ "chrono", "libc", @@ -1725,7 +1725,7 @@ dependencies = [ [[package]] name = "tree-ring-memory-sqlite" -version = "0.15.0" +version = "0.15.1" dependencies = [ "rusqlite", "serde", diff --git a/Cargo.toml b/Cargo.toml index adad624..b66eabe 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -7,7 +7,7 @@ members = [ resolver = "2" [workspace.package] -version = "0.15.0" +version = "0.15.1" edition = "2021" license = "MIT" authors = ["TerminallyLazy"] diff --git a/README.md b/README.md index fa71948..8b73908 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ framework-agnostic and does not replace either protocol. Tree Ring Memory is in protocol-preview status. Current launch links: - Launch page: -- Launch release: +- Launch release: - Launch discussion: - Rust-native CLI article: - Feedback issue: @@ -259,8 +259,8 @@ sh install.sh --project --init --release latest sh install.sh --global --install-dir "$HOME/.local" sh install.sh --no-animation # stable output; kept for explicit script usage sh install.sh --no-path-update -sh install.sh --release 0.15.0 -sh install.sh --archive-url https://example/tree-ring-memory-0.15.0-darwin-arm64.tar.gz --archive-sha256 +sh install.sh --release 0.15.1 +sh install.sh --archive-url https://example/tree-ring-memory-0.15.1-darwin-arm64.tar.gz --archive-sha256 ``` After install, rerun onboarding anytime: diff --git a/crates/tree-ring-memory-cli/Cargo.toml b/crates/tree-ring-memory-cli/Cargo.toml index dd7ff18..f053371 100644 --- a/crates/tree-ring-memory-cli/Cargo.toml +++ b/crates/tree-ring-memory-cli/Cargo.toml @@ -26,8 +26,8 @@ semver.workspace = true sha2.workspace = true tempfile.workspace = true uuid.workspace = true -tree-ring-memory-core = { path = "../tree-ring-memory-core", version = "0.15.0" } -tree-ring-memory-sqlite = { path = "../tree-ring-memory-sqlite", version = "0.15.0" } +tree-ring-memory-core = { path = "../tree-ring-memory-core", version = "0.15.1" } +tree-ring-memory-sqlite = { path = "../tree-ring-memory-sqlite", version = "0.15.1" } [dev-dependencies] rusqlite.workspace = true diff --git a/crates/tree-ring-memory-cli/src/agent_awareness.rs b/crates/tree-ring-memory-cli/src/agent_awareness.rs index 59b8200..6b895c2 100644 --- a/crates/tree-ring-memory-cli/src/agent_awareness.rs +++ b/crates/tree-ring-memory-cli/src/agent_awareness.rs @@ -59,7 +59,7 @@ Runtime bootstrap and updates: - Resolve the real project root before initialization. Never initialize a plugin cache, package directory, home directory, or incidental working directory. - Prefer `/.tree-ring/bin/tree-ring` when present; otherwise use the active `tree-ring` on `PATH`. -- With existing user authorization for setup, install the verified project-local release from the project root with `curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation`. Otherwise obtain permission before downloading or installing software. +- With existing user authorization for setup, download the official version-pinned `v0.15.0/install.sh` installer to a temporary file, verify its SHA-256 is `ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, inspect it, and run `sh --project --init --release latest --no-animation` from the project root. Never pipe a network response directly to a shell. Otherwise obtain permission before downloading or installing software. - Use `tree-ring --root .tree-ring init` for a global CLI or `.tree-ring/bin/tree-ring --root .tree-ring init` for a project-local CLI. Verify that `memory.sqlite`, `AGENTS.md`, `SKILL.md`, and `CLI.md` are under the intended project. - `tree-ring update --check` is read-only. Run `tree-ring update` only with update authorization; it preserves the active installation scope and verifies official release assets. Re-run project initialization afterward to backfill managed guidance. - A pre-0.15 CLI must be upgraded with its existing package manager or install prefix. Check `command -v tree-ring` and `which -a tree-ring` so an old binary does not shadow the update. @@ -400,13 +400,18 @@ working directory. Prefer `{root}/bin/tree-ring` when it exists; otherwise use the active `tree-ring` on `PATH`. If the CLI is absent and the user's request already authorizes Tree Ring setup, -install the official verified project-local release from the real project root: +download the official version-pinned `v0.15.0/install.sh` installer to a +temporary file, verify its SHA-256 is +`ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, inspect +it, and run it from the real project root: ```bash -curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation +sh --project --init --release latest --no-animation ``` -Otherwise obtain permission before downloading or installing software. Run +Never pipe a network response directly to a shell. The installer verifies the +selected release archive against its published SHA-256. Otherwise obtain +permission before downloading or installing software. Run `tree-ring --root {root} init` for a global CLI or `{root}/bin/tree-ring --root {root} init` for a project-local CLI. Verify all generated files remain under the intended root, then inspect `integrations status` with the same executable. @@ -711,6 +716,10 @@ mod tests { || content.contains("Runtime bootstrap and updates:") ); assert!(content.contains("--project --init --release latest --no-animation")); + assert!(content + .contains("ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade")); + assert!(content.contains("pipe a network response directly to a shell")); + assert!(!content.contains("main/install.sh | sh")); assert!(content.contains("tree-ring update --check")); assert!(content.contains("project root")); assert!(content.contains("shadow")); diff --git a/crates/tree-ring-memory-sqlite/Cargo.toml b/crates/tree-ring-memory-sqlite/Cargo.toml index 995b535..1e93d5f 100644 --- a/crates/tree-ring-memory-sqlite/Cargo.toml +++ b/crates/tree-ring-memory-sqlite/Cargo.toml @@ -16,7 +16,7 @@ rusqlite.workspace = true serde.workspace = true serde_json.workspace = true sha2.workspace = true -tree-ring-memory-core = { path = "../tree-ring-memory-core", version = "0.15.0" } +tree-ring-memory-core = { path = "../tree-ring-memory-core", version = "0.15.1" } uuid.workspace = true [dev-dependencies] diff --git a/docs/integrations/agent-skill.md b/docs/integrations/agent-skill.md index f0cdf96..2553eec 100644 --- a/docs/integrations/agent-skill.md +++ b/docs/integrations/agent-skill.md @@ -54,15 +54,19 @@ agents to encounter Tree Ring Memory instructions before entering `.tree-ring/`. ## Runtime Bootstrap And Updates Agents must resolve the real project root before setup. If the user has already -authorized Tree Ring installation, the safe default is the verified -project-local release installer, run from that root: +authorized Tree Ring installation, download the official version-pinned +`v0.15.0/install.sh` installer to a temporary file, verify its SHA-256 is +`ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, inspect +it, and only then run it from that root: ```bash -curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation +sh --project --init --release latest --no-animation ``` -Without existing setup authorization, the agent should explain that exact -operation and ask before downloading or installing software. It must not +Agents must not pipe a network response directly to a shell; the installer +verifies the selected release archive against its published SHA-256. Without +existing setup authorization, the agent should explain that exact operation +and ask before downloading or installing software. It must not initialize a plugin cache, package directory, home directory, or unrelated working directory. Existing project-local installs should use `.tree-ring/bin/tree-ring --root .tree-ring init`; global installs should use diff --git a/docs/press-kit.md b/docs/press-kit.md index b0f9e8a..a4dcc26 100644 --- a/docs/press-kit.md +++ b/docs/press-kit.md @@ -23,10 +23,10 @@ DOX/Revolve adapters, framework discovery, and a terminal TUI. - Category: AI agents, developer tools, local-first software, Rust CLI - License: MIT - Status: protocol-preview -- Current version: 0.15.0 +- Current version: 0.15.1 - Website: - Repository: -- Launch release: +- Launch release: - Launch discussion: - Homebrew tap: - Feedback: diff --git a/marketing/README.md b/marketing/README.md index 8fe5bdc..7943726 100644 --- a/marketing/README.md +++ b/marketing/README.md @@ -309,7 +309,7 @@ python3 marketing/scripts/build-campaign-cards.py - Repository: `https://github.com/TerminallyLazy/Tree-Ring-Memory` - Launch page: `https://terminallylazy.github.io/Tree-Ring-Memory/` -- Launch release: `https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.15.0` +- Launch release: `https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.15.1` - Launch discussion: `https://github.com/TerminallyLazy/Tree-Ring-Memory/discussions/27` - Homebrew tap: `https://github.com/TerminallyLazy/homebrew-tree-ring` - Agent-Skills.md main repo listing: diff --git a/plugins/tree-ring-memory/README.md b/plugins/tree-ring-memory/README.md index b07930f..c77177f 100644 --- a/plugins/tree-ring-memory/README.md +++ b/plugins/tree-ring-memory/README.md @@ -17,11 +17,18 @@ privacy-safe memory action is warranted. The safe default is a verified project-local install. From the actual project root, after the user has authorized Tree Ring setup: +Download the official version-pinned `v0.15.0/install.sh` to a temporary file, +verify its SHA-256 is +`ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, inspect +it, then run these commands from the project root: + ```bash -curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation +sh --project --init --release latest --no-animation .tree-ring/bin/tree-ring --root .tree-ring integrations status --verbose ``` +Do not pipe a network response directly to a shell. + The installer downloads the official platform release and verifies its SHA-256 asset. A global Homebrew install remains available on macOS ARM64 through `brew install tree-ring`. Agents may proceed when the user's request already diff --git a/plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md b/plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md index f59704d..9a82aa4 100644 --- a/plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md +++ b/plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md @@ -3,7 +3,7 @@ name: tree-ring-memory description: Guides AI agents in using Tree Ring Memory for durable recall, project decisions, user preferences, warnings, future seeds, privacy-safe memory capture, and lifecycle-aware forgetting. license: MIT metadata: - version: "0.15.0" + version: "0.15.1" tags: "memory, agents, recall, privacy, projects, dox, revolve, skills, cli" triggers: "remember this; recall what we decided; what did we learn; tree ring memory; consolidate memory; forget this; project memory; sync DOX; sync Revolve; evidence loop; multi-agent memory" --- @@ -35,13 +35,21 @@ working directory by accident. CLI is available and the user's request already authorizes Tree Ring setup, install the verified current release project-locally from the project root. Otherwise explain the exact operation and obtain permission before the - network download or software installation: + network download or software installation. Download the official, + version-pinned `v0.15.0/install.sh` installer to a temporary file, verify its + SHA-256 is + `ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, + inspect it, and only then run: ```bash cd - curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation + sh --project --init --release latest --no-animation ``` + Do not pipe a network response directly to a shell. The installer verifies + the selected release archive against its published SHA-256 before placing + the binary at `/.tree-ring/bin/tree-ring`. + 4. For an existing global CLI, initialize from the project root with `tree-ring --root .tree-ring init`. For a project-local CLI, use `.tree-ring/bin/tree-ring --root .tree-ring init`. This must place diff --git a/skills/tree-ring-memory/SKILL.md b/skills/tree-ring-memory/SKILL.md index 98c8ed6..19c8728 100644 --- a/skills/tree-ring-memory/SKILL.md +++ b/skills/tree-ring-memory/SKILL.md @@ -3,7 +3,7 @@ name: tree-ring-memory description: Guides AI agents in using Tree Ring Memory for durable recall, project decisions, user preferences, warnings, future seeds, privacy-safe memory capture, and lifecycle-aware forgetting. license: MIT metadata: - version: "0.15.0" + version: "0.15.1" tags: "memory, agents, recall, privacy, projects, dox, revolve, skills, cli" triggers: "remember this; recall what we decided; what did we learn; tree ring memory; consolidate memory; forget this; project memory; sync DOX; sync Revolve; evidence loop; multi-agent memory" --- @@ -34,13 +34,21 @@ working directory by accident. 3. If no CLI is available and the user's request already authorizes Tree Ring setup, install the verified current release project-locally from the project root. Otherwise explain the exact operation and obtain permission before the - network download or software installation: + network download or software installation. Download the official, + version-pinned `v0.15.0/install.sh` installer to a temporary file, verify its + SHA-256 is + `ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, + inspect it, and only then run: ```bash cd - curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation + sh --project --init --release latest --no-animation ``` + Do not pipe a network response directly to a shell. The installer verifies + the selected release archive against its published SHA-256 before placing + the binary at `/.tree-ring/bin/tree-ring`. + 4. For an existing global CLI, initialize from the project root with `tree-ring --root .tree-ring init`. For a project-local CLI, use `.tree-ring/bin/tree-ring --root .tree-ring init`. This must place diff --git a/templates/dox/AGENTS.md b/templates/dox/AGENTS.md index d98910a..c91929f 100644 --- a/templates/dox/AGENTS.md +++ b/templates/dox/AGENTS.md @@ -30,18 +30,23 @@ plugin cache, package directory, home directory, or incidental working directory. Prefer `/.tree-ring/bin/tree-ring` when it exists; otherwise use the active `tree-ring` on `PATH`. -When no CLI exists and the user's request already authorizes setup, run the -official verified-release installer from the project root: +When no CLI exists and the user's request already authorizes setup, download +the official version-pinned `v0.15.0/install.sh` installer to a temporary file, +verify its SHA-256 is +`ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade`, +inspect it, and only then run it from the project root: ```bash -curl -fsSL https://raw.githubusercontent.com/TerminallyLazy/Tree-Ring-Memory/main/install.sh | sh -s -- --project --init --release latest --no-animation +sh --project --init --release latest --no-animation ``` -Otherwise obtain permission before downloading or installing software. A -global CLI initializes with `tree-ring --root .tree-ring init`; a project-local -CLI initializes with `.tree-ring/bin/tree-ring --root .tree-ring init`. Verify -that the generated files and `memory.sqlite` are under the intended project's -`.tree-ring/`, then run `integrations status` with the same binary and root. +Do not pipe a network response directly to a shell. The installer verifies the +selected release archive against its published SHA-256. Otherwise obtain +permission before downloading or installing software. A global CLI initializes +with `tree-ring --root .tree-ring init`; a project-local CLI initializes with +`.tree-ring/bin/tree-ring --root .tree-ring init`. Verify that the generated +files and `memory.sqlite` are under the intended project's `.tree-ring/`, then +run `integrations status` with the same binary and root. Use `tree-ring update --check` for a read-only release check and, only after update authorization, `tree-ring update`. Preserve the current manager and