Memory sanitize

Sanitize a memory directory so it is safe to share externally.

Contract

Field	Bound contract
Trigger	The user asks to sanitize memory for sharing, redact PII, or scan memory for credentials.
Authority	Reversible local: writes only a fresh /tmp/memory-sanitized-<timestamp> directory; rollback is undo. No remote mutation. Never modifies originals.
Side effect	Create redacted copies of top-level Markdown memory files under a new temporary directory. Rollback is deletion of that directory.
Done	A temporary directory containing redacted copies, a JSON report of redactions, and a user-facing diff review. If any Tier-1 credential is found in a source file, stop before generating copies and report the affected files.

Inputs

• Memory directory (required): the directory to sanitize, supplied explicitly or resolved from the current project by ../memory-update/scripts/resolve-paths.sh memory_dir. If MEMORY_UPDATE_SKILL_SCRIPTS is set, use $MEMORY_UPDATE_SKILL_SCRIPTS/resolve-paths.sh instead.
• Requires the sibling skill memory-update in the same plugin.
• Optional: MEMORY_DIR may override resolution after path validation.
• Process only top-level *.md files. Do not read session histories or nested Markdown files.
• Use a fresh destination named /tmp/memory-sanitized-<timestamp>; it must not already exist.

Procedure

1. Resolve source and validate destination freshness. Run ../memory-update/scripts/resolve-paths.sh memory_dir to resolve the source directory; the resolver rejects a missing directory, control bytes, or shell metacharacters, and refuses a memory directory git would track. Confirm the destination is a fresh path under /tmp before any write. Done when: the source resolves and the destination is confirmed fresh.
2. Scan sources for Tier-1 credentials. Run scripts/sanitize-memory.py --scan-only <memory-dir> to check every top-level Markdown file for Tier-1 credential patterns (OpenAI, GitHub, AWS, Slack, bearer-token, ECR). If any Tier-1 credential is found, stop before generating any copies and report the affected files. The user must remediate the originals before a new run. Done when: the scan completes with zero Tier-1 hits, or the run stops with affected files reported.
3. Generate redacted copies. Run scripts/sanitize-memory.py <memory-dir> <destination> to produce redacted copies of all top-level Markdown files. Tier-2 redactions (home paths, email addresses, session IDs, dates older than 30 days) are applied in the copies. Done when: the JSON report and redacted copies are generated.
4. Compute and display per-file diffs. Compare each reported source with its reported destination and show the complete diff. Verify that the report accounts for every processed top-level Markdown file and states redaction counts. Done when: every processed file has a complete diff and the report accounts for all files.
5. Classify output as safe for human review. Report the generated directory and ask the user to review the displayed diff before sharing. Leave originals unchanged; the generated directory is a disposable review artifact, not a replacement memory store. Done when: the generated directory is reported and the user is asked to review the diff.

Failure and recovery

• Invalid source or destination: stop before sanitization. Report the rejected path and reason; choose a new timestamp only for a destination collision.
• Memory directory git would track: stop before snapshot or mutation and return blocked: MEMORY_DIR is inside version control.
• Tier-1 credential detected in source: stop before generating copies. Report the affected source files and credential classes. Require manual remediation of the originals before a new run. Never approve or publish copies when a credential is present in the source.
• Sanitizer execution failure: return blocked: sanitization or proof incomplete, including the command failure and any generated paths. Do not infer missing results or claim done.
• Nested Markdown: report that nested files were skipped and classify the result as partial rather than claiming the directory was fully sanitized.
• Originals require no rollback because they are never written. To roll back local output, delete only the named generated /tmp/memory-sanitized-<timestamp> directory after preserving any report the user needs.

Output

Return the destination path, the sanitizer JSON report, the original-to-copy diff for every processed file, warnings for skipped nested files, and one terminal classification: sanitized for human review, blocked: credential detected, or blocked: sanitization or proof incomplete.