claude-utils fork v0.3.0-ev.1

claude-utils fork v0.3.0-ev.1

This is the first release of this fork of claude-utils. It is a pre-release, and the -ev.1 suffix keeps it clear of upstream's own version numbers.

What's in it

• Post-quantum encryption by default. New memory repos use hybrid ML-KEM-768 + X25519 age keys (age1pq1…); classic X25519 is available only when you ask for it. recipients rekey-pq converts an existing single-member classic repo, optionally onto one fresh root commit. It shows a dry run first, resumes when rerun, can --rollback a migration that was not pushed, and retire-classic retires the old key.
• One config directory. routes.json, apps.json and the age identity all live in ${XDG_CONFIG_HOME:-~/.config}/claude-memsync on every OS. An identity from an earlier install (macOS ~/Library/Application Support/claude-memsync/, Windows %AppData%) stays where it is and keeps working.
• Host bootstrap. scripts/bootstrap.sh sets up a host in one pass, with a dry run first.
  • It checks prerequisites before changing anything.
  • Keep-out owners and terms are optional.
  • Exit codes are 0 (ok), 1 (error), 2 (usage) and 3 (paused, needs you).
  • Homelab hosts without a password manager can use --org-token-file … --delete-org-token-file.
  • --prebuilt-dir installs the binaries from a release archive instead of building from source.
• macOS. Stock /bin/bash 3.2 and BSD tools are enough. A standalone binary in ~/.local/bin is moved aside automatically. Key and token commands wait 120 s for a password-manager prompt.
• Day-to-day UX.
  • Commands that need the sync lock stop and restart a running service themselves.
  • --repo also accepts the GitHub repo name.
  • join status shows key labels.
  • Per-prompt hooks give up after 1.5 s and never run token commands or use the network.
• Safety. The daemon and every interactive change refuse a half-migrated repo. Filters follow the binary across upgrades. The push guard and pinned recipient review are unchanged.
• CI. There is a fork-only workflow covering vet, gofmt, race tests with per-package coverage floors that only go up, shellcheck and a portability lint, the bootstrap harness, gitleaks, a workflow lint (GitHub-hosted runners, SHA pins) and release-archive checks on Linux and macOS.

Install

Assets: claude-utils-v0.3.0-ev.1-<os>-<arch>.tar.gz (.zip on Windows) for linux, darwin and windows on amd64 and arm64, plus SHA256SUMS. Every archive holds claude-memsync, claude-memmerge and scripts/bootstrap.sh. To install, verify the archive against SHA256SUMS, extract it, and run bash <dir>/scripts/bootstrap.sh --prebuilt-dir <dir> …. See docs/releases.md and docs/setup.md.

Upgrading an existing host

• Stop the daemon, point the ~/.local/bin links at the new build, and start the daemon again. The filters repoint themselves.
• Re-run claude-memsync doctor --install-timer so the daily timer runs unattended.
• Leave an existing identity file where it is.

Known follow-ups

Fork issues #1 to #7: join accept --all, consistent repo keys across hosts, an identity backup command, faster and selectable setup for many repos, a precomputed changes index with performance budgets, and a harness wall-time budget with sharding. #6, timing-independent sync coverage, is fixed in this release.