feat(egress): memorable-recall row in gstack-egress grants

`gstack-egress grants` promises every standing consent in force with the
command that revokes it. The Memorable bridge's memorable_recall key is
one, so it gets a row: off by default, granted only when
`gstack-memorable enable` set it, revoked by `gstack-memorable disable`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-09-08 17:53:57 +00:00
co-authored by Claude Fable 5.1
parent ae706a6168
commit 0eaff4b376
2 changed files with 23 additions and 2 deletions
+10
View File
@@ -151,6 +151,7 @@ function egressGrants(args: string[], home: string): number {
const syncMode = configGet('artifacts_sync_mode') || 'off';
const repoVisibility = configGet('redact_repo_visibility') || 'unknown';
const prepushHook = configGet('redact_prepush_hook') || 'false';
const memorableRecall = configGet('memorable_recall') || 'off';
const grants: Grant[] = [
{
@@ -189,6 +190,15 @@ function egressGrants(args: string[], home: string): number {
key: 'redact_prepush_hook',
revoke: 'gstack-config set redact_prepush_hook false (disables the guard)',
},
{
grant: 'memorable-recall',
value: memorableRecall,
granted: memorableRecall === 'on',
detail: 'Claude Code UserPromptSubmit hook hands each prompt to the third-party memorable CLI (receipted per prompt as sink memorable-recall; the vendor\'s own capture consent is separate)',
file: configFile,
key: 'memorable_recall',
revoke: 'gstack-memorable disable (or gstack-config set memorable_recall off)',
},
];
if (args.includes('--json')) {