Please do not open a public issue for security problems. Instead, use GitHub private vulnerability reporting or email the maintainer. You'll get an acknowledgement within a few days.

boost deletes files and terminates processes, so it is built defensively.

• Only processes that are direct children of claude-mem worker-service daemons are ever considered for termination (find_leaked).
• A protected-process regex (WindowServer, launchd, kernel_task, Finder, etc.) is a second line of defense - matches are skipped.
• Only processes older than MAX_AGE_HOURS (default 24h) are eligible, so an active session's freshly-spawned helpers are never touched.
• Before signaling, each candidate is revalidated for parent PID, age, and protected-process status. boost sends TERM first and only escalates to KILL if the process is still running.

• The read-only default: running boost with no arguments deletes nothing.
• Destructive commands acquire an atomic run lock under ~/.cache/boost so launchd and manual cleanup runs do not overlap.
• clean_dir resolves canonical paths and refuses to operate on a hard-coded denylist of paths ($HOME, /, /Users, $HOME/Library, $HOME/Documents, $HOME/Desktop).
• It only acts on directories ([ -d ]) and uses ${path:?} so an empty variable can never expand into a destructive rm -rf /.
• Only re-downloadable caches are cleaned; user data is never targeted.
• Every destructive path honors --dry-run.

• The only privileged operation is sudo purge (frees inactive memory). In non-interactive/--auto mode it uses sudo -n so it can never block on or capture a password prompt - it simply skips if credentials aren't cached.

• ~/.config/boost/config is sourced as shell. It lives at a fixed path under the user's own home, exactly like ~/.zshrc. boost never sources config from a world-writable or working-directory location.
• Numeric and boolean config values are validated after loading. Invalid values fall back to safe defaults with a warning.

• Pure bash + standard macOS tools. Optional gum/mole are detected with command -v and invoked by name only; their absence is handled gracefully.