Lore 0.5.1

Everything since v0.4.0 — the v0.5.0 feature set, which was never released, plus four fixes.

If you tried to install Lore before today, it did not work. marketplace.json was missing its required owner field from the very first commit, so /plugin marketplace add aoc81/lore failed for everyone with Invalid schema: owner: Invalid input. It went unnoticed through five versions because developing the plugin in its own repo loads it as lore@inline, which skips that validation entirely. Fixed, and guarded by tests/test_manifests.py.

Bootstrap from git history — /lore:mine

Cold start is the failure mode this whole idea dies of: empty store → recall surfaces nothing → nobody captures → still empty. /lore:mine reads the material already sitting in git — reverts, fix commits, bodies that explain a why, churn hot spots — scores it (English and Spanish signals; noise, sweep and store-only commits filtered), and marks any candidate an existing entry already covers using the recall scorer, so a second pass never duplicates the first. The threshold sits deliberately above "fix keyword + focused change": a bare Fix X with no body is the most common commit in any repo, and showing all of them buries the rest.

Personal store

The capture gate catches user preferences, which until now landed in the committed, team-shared — effectively published — store. personalStoreDir is the private half: recall reads it alongside the team store and flags it [personal], but it is never indexed, linted, or secret-scanned, and the skill routes preference-shaped learnings there rather than quietly writing them to the shared store. A path inside the team store is refused, since it would be committed anyway, and the deleted-ref freshness flag is skipped for entries stored outside the project, whose files: may name another repo.

Team-wide secret guard

The blocking pre-push scan only ever protected the machine that ran /lore:init, so a teammate without the hook could still push a key into a published store. A workflow template runs the same scan_secrets.py and verify_refs.py --strict on every PR, from the committed .lore/ copies, so CI and the local hook cannot drift apart and nobody else has to install anything. /lore:init offers it; Codex gets --ci.

Read telemetry

The recall log recorded what was shown, never what was used. A PostToolUse(Read) hook logs store reads, and /lore:stats separates the two — "surfaced 12x, read 0x" is a misleading title, not a lesson. With no read events logged at all, the line reports "none logged yet" rather than accusing every entry of it.

Codex parity

Codex has since gained PreToolUse and SessionStart(compact) with the same additionalContext contract, so edit-time recall and the post-compaction reminder now run there too — 4 hooks registered, up from 2.

Fixes

• The secret scanner missed every prefixed secret name. The hardcoded-assignment rule wrapped its keyword in \b, and _ is a word character, so \b never fires between an underscore and a letter: db_password, my_api_key, STRIPE_SECRET and aws_secret_access_key all walked past a blocking guard. Those are the dominant real-world spellings — snake_case and SCREAMING_SNAKE in Python, YAML and .env content, which is exactly what gets pasted into a learning. client_secret hit only because it is spelled out as its own alternative, which disguised the gap. The placeholder filter still neutralises db_password = changeme, and backtracking stays linear.
• The linter was dead in a personal-store-only project. verify_refs bailed whenever the team store directory was missing, even with personalStoreDir set and populated, so /lore:lint, /lore:stats and /lore:sweep were all silently gone while recall and capture kept working. It now gives up only when both stores are absent. Related: the check mode no longer reports "all entries have valid file refs" after examining zero entries.
• marketplace.json gained its required owner (see above), plus a manifest test suite that checks the declared versions agree and every hooks.json command points at a script that actually ships.

Upgrading

If you installed from the default branch during the window when the manifests said 0.5.0, you may be running a build with the old secret scanner under that same version string. claude plugin update lore@lore picks up 0.5.1.