security: sanitized VHS demos and purge leaked history tooling

Author: greynewell

demos/vhs/demo-30s.tape

@@ -10,6 +10,8 @@ Type "# ContextForge RAG · production retrieval" Enter
 Sleep 600ms
 
 Hide
+Type "source demos/vhs/sanitize-recording-env.sh" Enter
+Sleep 300ms
 Type "python3 scripts/validate_profile.py ." Enter
 Sleep 5s
 Type "head -16 SOUL.md" Enter
@@ -21,4 +23,4 @@ Show
 Type "hermes profile install github.com/codegraphtheory/context-forge-rag --name context-forge-rag --yes" Enter
 Sleep 4s
 Type "# RAG architecture · eval gates · observability" Enter
-Sleep 3s
+Sleep 3s

demos/vhs/sanitize-recording-env.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Public-safe shell identity for VHS terminal recordings.
+# Sources demos/vhs/env.sh after setting HOME/USER (real repo paths stay on disk).
+set -euo pipefail
+_VHS_SANITIZE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_REPO_ROOT="$(cd "$_VHS_SANITIZE_DIR/../.." && pwd)"
+
+export VHS_RECORDING=1
+export HOME="$_REPO_ROOT/demos/vhs/staging/home/graphtheory"
+export USER=graphtheory
+export LOGNAME=graphtheory
+export HOSTNAME=cyber
+
+mkdir -p "$HOME/users/graphtheory/projects"
+_WORKSPACE="$HOME/users/graphtheory/projects/$(basename "$_REPO_ROOT")"
+ln -sfn "$_REPO_ROOT" "$_WORKSPACE"
+
+export PS1='graphtheory@cyber:~/users/graphtheory/projects/'"$(basename "$_REPO_ROOT")"'$ '
+export PROMPT_COMMAND=
+
+cd "$_WORKSPACE"
+
+# shellcheck source=env.sh
+source "$_VHS_SANITIZE_DIR/env.sh"

filter-repo-replacements.txt

@@ -0,0 +1 @@
+literal:/Users/graphtheory==>/Users/graphtheory

scripts/purge_leaked_demo_history.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Remove demo media (and optional path replacements) from entire git history.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+if ! command -v git-filter-repo >/dev/null 2>&1; then
+  echo "Install: python3 -m pip install git-filter-repo" >&2
+  exit 1
+fi
+
+ORIGIN=""
+git remote get-url origin >/dev/null 2>&1 && ORIGIN="$(git remote get-url origin)"
+
+INVERT=()
+[[ -e demos/demo.gif ]] && INVERT+=(--path demos/demo.gif)
+[[ -d demos/vhs/out ]] && INVERT+=(--path demos/vhs/out)
+[[ -d assets/demos ]] && INVERT+=(--path assets/demos)
+
+if ((${#INVERT[@]} > 0)); then
+  echo "filter-repo: removing demo blobs from all commits"
+  git filter-repo --invert-paths "${INVERT[@]}" --force
+  [[ -n "$ORIGIN" ]] && git remote add origin "$ORIGIN"
+fi
+
+if [[ -f filter-repo-replacements.txt ]]; then
+  echo "filter-repo: replace-text from filter-repo-replacements.txt"
+  git filter-repo --replace-text filter-repo-replacements.txt --force
+  [[ -n "$ORIGIN" ]] && git remote add origin "$ORIGIN"
+fi
+
+echo "History rewrite complete. Add clean demos, commit, then:"
+echo "  git push --force-with-lease origin main"