feat(core): scope hosted review identity

Fixes OpenCoven#98.

Fixes OpenCoven#99.

Fixes OpenCoven#104.

Fixes OpenCoven#110.

- add hosted tenant/installation/repo/domain scope types

- key hosted memory, transcripts, settings sync, and team memory by scoped identity

- add canonical repo parsing and Windows test isolation for home-derived paths

Signed-off-by: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>

Author: CompleteDotTech

docs/advanced.md

@@ -531,8 +531,10 @@ Hosted review mode is enabled with `--hosted-review`,
 Coven Code does not load user-scope memory by default. The prompt records that
 hosted review mode is active and lists the AGENTS.md scopes that were loaded.
 Durable hosted memory and transcript namespaces are separated under a hosted
-review path and require tenant scope plus a canonical repository identity before
-they can be resolved for persistence.
+review path and require tenant scope, GitHub App installation id, stable repo
+id, and canonical repository identity before they can be resolved for
+persistence. Hosted namespaces include a domain component so default branch,
+branch, pull-request, release, and security-private memory stay separated.
 
 Hosted review mode also disables write/execute-capable tools, configured MCP
 servers, plugins, user memory, and managed rules by default. Trusted hosted

docs/configuration.md

@@ -129,8 +129,11 @@ Or in `settings.json`:
 When hosted review mode is active, Coven Code skips user-scope memory
 (`~/.coven-code/AGENTS.md` and `~/.coven-code/CLAUDE.md`) by default, marks
 new session artifacts as hosted review artifacts, and requires a tenant plus
-canonical repository identity before resolving hosted durable memory paths.
-Local-personal mode remains the default and continues to load user memory.
+GitHub App installation id, stable repository id, and canonical repository
+identity before resolving hosted durable memory paths. Hosted memory and
+transcripts are also split by memory domain, such as default branch, named
+branch, pull request, release, or security-private review. Local-personal mode
+remains the default and continues to load user memory.
 
 Hosted review also disables write/execute-capable tools, configured MCP
 servers, and plugins by default. A trusted hosted policy can opt individual

docs/shared/hosted-review-phase-2-pr.md

@@ -0,0 +1,43 @@
+# Hosted Review Phase 2 PR Notes
+
+## Linked issues
+
+Fixes #98.
+Fixes #99.
+Fixes #104.
+Fixes #110.
+
+## Summary
+
+- Expands hosted review scope to include tenant id, GitHub App installation id, stable repo id, repo full name, canonical repo identity, and memory domain.
+- Moves hosted memory and transcript paths from local-path identity to tenant/installation/repo/domain namespaces.
+- Adds canonical GitHub repo identity parsing for HTTPS and SSH remotes plus deterministic local project ids.
+- Adds hosted-derived settings sync project keys and hosted team-memory repo keys so hosted callers do not pass arbitrary project ids.
+- Splits hosted memory domains for default branch, branch, release, pull request, and security-private review contexts.
+- Hardens Windows test isolation for home-derived paths and gates Unix-socket daemon tests to Unix.
+
+## Test evidence
+
+- `cargo fmt --all`
+- `cargo check --workspace`
+- `cargo clippy --workspace --all-targets -- -D warnings`
+- `cargo test -p claurst-core --lib hosted -- --nocapture`
+- `cargo test -p claurst-core --lib local_project_id -- --nocapture`
+- `cargo test -p claurst-core --lib sync_keys -- --nocapture`
+- `cargo test -p claurst-core --lib team_memory_key -- --nocapture`
+- `cargo test -p claurst-commands --lib named_commands::tests::test_agents_reset_removes_saved_roster_state -- --nocapture`
+- `cargo test -p claurst-core --lib roster_reset -- --nocapture`
+- `cargo test -p claurst-core --lib build_import_preview_maps_settings_and_doc -- --nocapture`
+- `cargo test -p claurst-core --lib test_imported_anthropic_cli_token_resolves_without_coven_oauth_client -- --nocapture`
+
+## Full-suite status
+
+- `cargo test --workspace` progressed through CLI, ACP, API, bridge, buddy, commands, and core tests, then Smart App Control blocked an unsigned freshly built test binary.
+- Latest block: `C:\dev-cargo-target\coven-code\debug\deps\claurst_tools-f5b8d284b5de1d1b.exe`, OS error 4551.
+- Code Integrity event: Smart App Control reported the binary did not meet Enterprise signing level requirements under policy `{0283ac0f-fff1-49ae-ada1-8a933130cad6}`.
+
+## Risk notes
+
+- Local mode pathing remains available through existing local APIs.
+- Hosted durable state now requires explicit scope to avoid path-derived cross-tenant collisions.
+- Security-private domains are represented and are excluded from public review loading unless explicitly allowed by policy.

src-rust/crates/commands/src/lib.rs

@@ -10363,6 +10363,8 @@ pub(crate) mod test_env {
 
     pub(crate) struct CommandEnvGuard {
         old_home: Option<String>,
+        old_test_home: Option<String>,
+        old_userprofile: Option<String>,
         old_coven_home: Option<String>,
         old_user: Option<String>,
         old_username: Option<String>,
@@ -10376,6 +10378,8 @@ pub(crate) mod test_env {
             let lock = ENV_LOCK.lock().unwrap_or_else(|err| err.into_inner());
             let guard = Self {
                 old_home: std::env::var("HOME").ok(),
+                old_test_home: std::env::var("COVEN_CODE_TEST_HOME").ok(),
+                old_userprofile: std::env::var("USERPROFILE").ok(),
                 old_coven_home: std::env::var("COVEN_HOME").ok(),
                 old_user: std::env::var("USER").ok(),
                 old_username: std::env::var("USERNAME").ok(),
@@ -10384,6 +10388,8 @@ pub(crate) mod test_env {
                 _lock: lock,
             };
             std::env::set_var("HOME", home);
+            std::env::set_var("COVEN_CODE_TEST_HOME", home);
+            std::env::set_var("USERPROFILE", home);
             std::env::set_var("COVEN_HOME", coven_home);
             match user {
                 Some(value) => std::env::set_var("USER", value),
@@ -10415,6 +10421,14 @@ pub(crate) mod test_env {
                 Some(value) => std::env::set_var("HOME", value),
                 None => std::env::remove_var("HOME"),
             }
+            match &self.old_test_home {
+                Some(value) => std::env::set_var("COVEN_CODE_TEST_HOME", value),
+                None => std::env::remove_var("COVEN_CODE_TEST_HOME"),
+            }
+            match &self.old_userprofile {
+                Some(value) => std::env::set_var("USERPROFILE", value),
+                None => std::env::remove_var("USERPROFILE"),
+            }
             match &self.old_coven_home {
                 Some(value) => std::env::set_var("COVEN_HOME", value),
                 None => std::env::remove_var("COVEN_HOME"),

src-rust/crates/commands/src/named_commands.rs

@@ -1012,12 +1012,12 @@ mod tests {
         let home = temp.path().join("home");
         let coven_home = temp.path().join("coven");
         let project = temp.path().join("project");
-        let global_agents = home.join(".coven-code").join("agents");
         let project_agents = project.join(".coven-code").join("agents");
-        std::fs::create_dir_all(&global_agents).expect("global agents dir");
         std::fs::create_dir_all(&project_agents).expect("project agents dir");
         std::fs::create_dir_all(&coven_home).expect("coven home");
         let _guard = CommandEnvGuard::set(&home, &coven_home, None);
+        let global_agents = claurst_core::Settings::config_dir().join("agents");
+        std::fs::create_dir_all(&global_agents).expect("global agents dir");
 
         let global_agent = global_agents.join("global.md");
         let project_agent = project_agents.join("project.md");

src-rust/crates/core/src/anthropic_cli_import.rs

@@ -47,7 +47,18 @@ pub struct DiscoveredCredential {
 // ---------------------------------------------------------------------------
 
 fn claude_code_credentials_path() -> Option<PathBuf> {
-    Some(dirs::home_dir()?.join(".claude").join(".credentials.json"))
+    Some(cli_home_dir()?.join(".claude").join(".credentials.json"))
+}
+
+fn cli_home_dir() -> Option<PathBuf> {
+    #[cfg(test)]
+    if let Ok(home) = std::env::var("COVEN_CODE_TEST_HOME") {
+        if !home.is_empty() {
+            return Some(PathBuf::from(home));
+        }
+    }
+
+    dirs::home_dir()
 }
 
 fn ant_credentials_dir() -> Option<PathBuf> {

src-rust/crates/core/src/coven_daemon.rs

@@ -771,6 +771,7 @@ fn url_quote(input: &str) -> String {
 mod tests {
     use super::*;
     use crate::coven_shared::COVEN_HOME_ENV_LOCK;
+    #[cfg(unix)]
     use std::fs;
 
     /// Guard that temporarily sets `COVEN_HOME` and restores it on drop.
@@ -805,6 +806,7 @@ mod tests {
         assert!(DaemonClient::new().is_none());
     }
 
+    #[cfg(unix)]
     #[test]
     fn new_returns_some_when_sock_present() {
         let _lock = COVEN_HOME_ENV_LOCK
@@ -873,6 +875,7 @@ mod tests {
         assert_eq!(s1.active_sessions, 0);
     }
 
+    #[cfg(unix)]
     #[test]
     fn familiar_statuses_returns_offline_when_connect_fails() {
         let _lock = COVEN_HOME_ENV_LOCK

src-rust/crates/core/src/git_utils.rs

@@ -1,6 +1,8 @@
 //! Git utilities for Coven Code.
 //! Mirrors src/utils/git.ts (926 lines) and src/utils/git/ subdirectory.
 
+use crate::hosted_review::CanonicalRepoIdentity;
+use sha2::{Digest, Sha256};
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
@@ -49,6 +51,28 @@ pub fn get_current_branch(repo_root: &Path) -> String {
     }
 }
 
+pub fn get_origin_remote_url(repo_root: &Path) -> Option<String> {
+    let remote = git_output(repo_root, &["remote", "get-url", "origin"]);
+    (!remote.is_empty()).then_some(remote)
+}
+
+pub fn canonical_repo_identity_from_origin(repo_root: &Path) -> Option<CanonicalRepoIdentity> {
+    let remote = get_origin_remote_url(repo_root)?;
+    CanonicalRepoIdentity::from_git_remote_url(&remote)
+}
+
+pub fn local_project_id_from_identity(identity: &CanonicalRepoIdentity) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(identity.canonical_string().as_bytes());
+    let digest = hex::encode(hasher.finalize());
+    format!("local-git-{}", &digest[..16])
+}
+
+pub fn local_project_id_from_origin(repo_root: &Path) -> Option<String> {
+    canonical_repo_identity_from_origin(repo_root)
+        .map(|identity| local_project_id_from_identity(&identity))
+}
+
 /// Return list of files modified (staged or unstaged).
 pub fn list_modified_files(repo_root: &Path) -> Vec<PathBuf> {
     let output = git_output(repo_root, &["diff", "--name-only", "HEAD"]);
@@ -216,4 +240,20 @@ mod tests {
         let commits = get_commit_history(Path::new("."), 0);
         assert!(commits.is_empty());
     }
+
+    #[test]
+    fn local_project_id_normalizes_equivalent_https_and_ssh_remotes() {
+        let https = CanonicalRepoIdentity::from_git_remote_url(
+            "https://github.com/OpenCoven/coven-code.git",
+        )
+        .unwrap();
+        let ssh =
+            CanonicalRepoIdentity::from_git_remote_url("git@github.com:OpenCoven/coven-code.git")
+                .unwrap();
+
+        assert_eq!(
+            local_project_id_from_identity(&https),
+            local_project_id_from_identity(&ssh)
+        );
+    }
 }