@axiomatic-labs/claudeflow 2.49.1 → 2.49.3

package/lib/install.js

@@ -18,7 +18,14 @@ const ui = require('./ui.js');
 const CLAUDE_MARK = '<!-- claudeflow:begin -->';
 const CLAUDE_END = '<!-- claudeflow:end -->';
 const HOOK_TAG = 'scripts/claudeflow/hook_';            // identifies OUR hook entries in settings.json
-const PER_PROJECT_CONFIGS = ['brand.json', 'risk-signals.json'];  // create-if-absent, never clobber
+// create-if-absent, never clobber. `test-context.json` ships NO default (it's filled at runtime by the
+// orchestrator with the project's TEST auth) — listing it here just means an update never clobbers it.
+const PER_PROJECT_CONFIGS = ['brand.json', 'risk-signals.json', 'test-context.json'];
+
+// Paths appended to the project's .gitignore (add-if-absent). These hold TEST credentials / Playwright
+// storage state — they must NEVER be committed. test-context.json is per-project runtime state; .auth/
+// holds storageState files the orchestrator seeds for auth-gated functional verification.
+const GITIGNORE_LINES = ['.claudeflow/test-context.json', '.claudeflow/.auth/'];
 const SHARED_CONFIGS = ['playbook-map.json', 'agent-map.json'];   // always refreshed (shared system)
 
 function rmrf(p) { fs.rmSync(p, { recursive: true, force: true }); }
@@ -92,6 +99,26 @@ function mergeMcp(cwd, baseServers) {
   return added;
 }
 
+// Append the claudeflow runtime-state paths to the project's .gitignore, ADD-IF-ABSENT. These hold TEST
+// credentials / Playwright storage state and must never be committed. Create the file if missing; else
+// append only the lines NOT already present as an EXACT line (a `Set.has()` on the trimmed existing lines —
+// not a gitignore-semantics evaluation: a broader rule like `.claudeflow/` that would already cover these is
+// NOT detected, so the exact line is still appended. That is harmless — a redundant, more-specific ignore —
+// and keeps the check simple; we only avoid DUPLICATING the exact same line. Returns the count added.
+function mergeGitignore(cwd, lines) {
+  if (!lines || !lines.length) return 0;
+  const gp = path.join(cwd, '.gitignore');
+  let cur = '';
+  if (fs.existsSync(gp)) { try { cur = fs.readFileSync(gp, 'utf8'); } catch { return 0; } }
+  const present = new Set(cur.split('\n').map(l => l.trim()).filter(Boolean));
+  const toAdd = lines.filter(l => !present.has(l));
+  if (!toAdd.length) return 0;
+  const header = '\n# claudeflow test-context — TEST credentials / auth storage state, NEVER commit\n';
+  const body = (cur && !cur.endsWith('\n') ? '\n' : '') + (cur ? header : header.trimStart()) + toAdd.join('\n') + '\n';
+  fs.writeFileSync(gp, cur + body);
+  return toAdd.length;
+}
+
 // UPSERT the claudeflow guidance block. The snippet is a self-contained `<!-- claudeflow:begin -->…<!-- end -->`
 // region; everything OUTSIDE the markers is the user's own CLAUDE.md and is never touched. Behavior:
 //   • no CLAUDE.md            → create it with the block
@@ -124,7 +151,7 @@ function syncClaudeMd(cwd, snippetPath) {
 // Place + merge the framework from an extracted payload dir into a project. Pure filesystem, no network —
 // so it is testable on a throwaway dir.
 function installFromPayload(src, cwd) {
-  const out = { playbooks: 0, scripts: 0, skills: 0, agents: 0, mcp: 0, claudeMd: false, failed: [] };
+  const out = { playbooks: 0, scripts: 0, skills: 0, agents: 0, mcp: 0, gitignore: 0, claudeMd: false, failed: [] };
   // Each placement step is ISOLATED: a failure in one (a copy error, a permission hiccup, a weird file in the
   // user's tree) must NOT abort the rest — above all it must not skip the settings/env + CLAUDE.md config, the
   // two steps a user most needs (the env block wires agent-teams + the autocompact window, etc.). Before this,
@@ -219,6 +246,9 @@ function installFromPayload(src, cwd) {
     }
   });
 
+  // 8) .gitignore — ensure the TEST-credential paths are ignored (add-if-absent; never commit creds).
+  step('gitignore', () => { out.gitignore = mergeGitignore(cwd, GITIGNORE_LINES); });
+
   return out;
 }
 
@@ -294,3 +324,4 @@ module.exports.installFromPayload = installFromPayload;
 module.exports.mergeSettings = mergeSettings;
 module.exports.syncClaudeMd = syncClaudeMd;
 module.exports.mergeMcp = mergeMcp;
+module.exports.mergeGitignore = mergeGitignore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.49.1",
+  "version": "2.49.3",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"