security: sanitized VHS demos and purge leaked history tooling

Author: greynewell

demos/vhs/demo-30s.tape

@@ -6,10 +6,17 @@ Set Height 720
 Set Theme "Catppuccin Mocha"
 Set TypingSpeed 50ms
 
-Type "# ChainForge · smart contracts and audits" Enter
+Hide
+Type "source demos/vhs/sanitize-recording-env.sh" Enter
+Sleep 400ms
+Show
+
+Type "# ChainForge - smart contracts and audits" Enter
 Sleep 600ms
 
 Hide
+Type "source demos/vhs/sanitize-recording-env.sh" Enter
+Sleep 300ms
 Type "python3 scripts/validate_profile.py ." Enter
 Sleep 5s
 Type "head -16 SOUL.md" Enter
@@ -20,5 +27,5 @@ Show
 
 Type "hermes profile install github.com/codegraphtheory/chainforge --name chainforge --yes" Enter
 Sleep 4s
-Type "# Security-first profile · validate before you ship" Enter
+Type "# Security-first profile - validate before you ship" Enter
 Sleep 3s

demos/vhs/sanitize-recording-env.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Public-safe shell identity for VHS terminal recordings.
+set -euo pipefail
+_VHS_SANITIZE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_REPO_ROOT="$(cd "$_VHS_SANITIZE_DIR/../.." && pwd)"
+
+export VHS_RECORDING=1
+export HOME="$_REPO_ROOT/demos/vhs/staging/home/graphtheory"
+export USER=graphtheory
+export LOGNAME=graphtheory
+export HOSTNAME=cyber
+
+mkdir -p "$HOME/users/graphtheory/projects"
+_WORKSPACE="$HOME/users/graphtheory/projects/$(basename "$_REPO_ROOT")"
+ln -sfn "$_REPO_ROOT" "$_WORKSPACE"
+
+export PS1='graphtheory@cyber:~/users/graphtheory/projects/'"$(basename "$_REPO_ROOT")"'$ '
+export PROMPT_COMMAND=
+cd "$_WORKSPACE"
+
+if [[ -f "$_VHS_SANITIZE_DIR/env.sh" ]]; then
+  # shellcheck source=env.sh
+  source "$_VHS_SANITIZE_DIR/env.sh"
+else
+  export REPO_ROOT="$_REPO_ROOT"
+fi

filter-repo-replacements.txt

@@ -0,0 +1 @@
+literal:/Users/graphtheory==>/Users/graphtheory

scripts/purge_leaked_demo_history.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Remove demo media (and optional path replacements) from entire git history.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+if ! command -v git-filter-repo >/dev/null 2>&1; then
+  echo "Install: python3 -m pip install git-filter-repo" >&2
+  exit 1
+fi
+
+ORIGIN=""
+git remote get-url origin >/dev/null 2>&1 && ORIGIN="$(git remote get-url origin)"
+
+INVERT=()
+[[ -e demos/demo.gif ]] && INVERT+=(--path demos/demo.gif)
+[[ -d demos/vhs/out ]] && INVERT+=(--path demos/vhs/out)
+[[ -d assets/demos ]] && INVERT+=(--path assets/demos)
+
+if ((${#INVERT[@]} > 0)); then
+  echo "filter-repo: removing demo blobs from all commits"
+  git filter-repo --invert-paths "${INVERT[@]}" --force
+  [[ -n "$ORIGIN" ]] && git remote add origin "$ORIGIN"
+fi
+
+if [[ -f filter-repo-replacements.txt ]]; then
+  echo "filter-repo: replace-text from filter-repo-replacements.txt"
+  git filter-repo --replace-text filter-repo-replacements.txt --force
+  [[ -n "$ORIGIN" ]] && git remote add origin "$ORIGIN"
+fi
+
+echo "History rewrite complete. Add clean demos, commit, then:"
+echo "  git push --force-with-lease origin main"