@controlvector/cv-agent 1.9.1 → 1.9.2

package/dist/bundle.cjs

@@ -3929,6 +3929,41 @@ async function runSetup() {
   } else {
     console.log(source_default.green("  \u2713") + " CLAUDE.md present");
   }
+  const gitignorePath = (0, import_node_path.join)(cwd, ".gitignore");
+  const CREDENTIAL_PATTERNS = [
+    "# Credentials and secrets (auto-added by cv-agent)",
+    ".env",
+    ".env.*",
+    ".claude/",
+    ".claude.json",
+    ".credentials*",
+    "*.pem",
+    "*.key",
+    ".ssh/",
+    ".gnupg/",
+    ".npm/",
+    ".config/",
+    ".zsh_history",
+    ".bash_history",
+    ".zsh_sessions/",
+    "node_modules/",
+    ".DS_Store"
+  ];
+  try {
+    let gitignoreContent = "";
+    if ((0, import_node_fs.existsSync)(gitignorePath)) {
+      gitignoreContent = (0, import_node_fs.readFileSync)(gitignorePath, "utf-8");
+    }
+    const missing = CREDENTIAL_PATTERNS.filter((p) => !gitignoreContent.includes(p));
+    if (missing.length > 0) {
+      const addition = (gitignoreContent && !gitignoreContent.endsWith("\n") ? "\n" : "") + missing.join("\n") + "\n";
+      (0, import_node_fs.writeFileSync)(gitignorePath, gitignoreContent + addition);
+      console.log(source_default.green("  \u2713") + " .gitignore updated with credential protection");
+    } else {
+      console.log(source_default.green("  \u2713") + " .gitignore has credential protection");
+    }
+  } catch {
+  }
   if (!hasCVDir) {
     (0, import_node_fs.mkdirSync)((0, import_node_path.join)(cwd, ".cv"), { recursive: true });
   }
@@ -5057,6 +5092,22 @@ Target repository: ${task.owner}/${task.repo}
 `;
   prompt += `
 
+## Security \u2014 NEVER Commit Secrets
+`;
+  prompt += `Do NOT add, commit, or push any of the following:
+`;
+  prompt += `- API keys, tokens, passwords, or credentials
+`;
+  prompt += `- .env files, .credentials files, .claude/ directory
+`;
+  prompt += `- SSH keys (.ssh/), GPG keys (.gnupg/)
+`;
+  prompt += `- Shell history (.zsh_history, .bash_history)
+`;
+  prompt += `If you need to reference an API key, use an environment variable placeholder.
+`;
+  prompt += `
+
 ---
 `;
   prompt += `When complete, provide a brief summary of what you accomplished.
@@ -5674,6 +5725,22 @@ async function runAgent(options) {
       } catch {
       }
     }
+    const gitignorePath = require("path").join(workingDir, ".gitignore");
+    try {
+      const fs3 = require("fs");
+      const credPatterns = ".env\n.env.*\n.claude/\n.claude.json\n.credentials*\n*.pem\n*.key\n.ssh/\n.gnupg/\n.npm/\n.config/\n.zsh_history\n.bash_history\nnode_modules/\n.DS_Store\n";
+      let existing = "";
+      try {
+        existing = fs3.readFileSync(gitignorePath, "utf-8");
+      } catch {
+      }
+      if (!existing.includes(".claude/")) {
+        const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+        fs3.writeFileSync(gitignorePath, existing + prefix + "# Credentials (auto-added by cv-agent)\n" + credPatterns);
+        console.log(source_default.gray("   Bootstrap: .gitignore credential protection added"));
+      }
+    } catch {
+    }
     const cvDir = require("path").join(workingDir, ".cv");
     if (!require("fs").existsSync(cvDir)) {
       try {
@@ -6448,7 +6515,7 @@ function statusCommand() {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("cva").description('CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch.\n\nRun "cva setup" to get started.').version(true ? "1.9.1" : "1.6.0");
+program2.name("cva").description('CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch.\n\nRun "cva setup" to get started.').version(true ? "1.9.2" : "1.6.0");
 program2.addCommand(setupCommand());
 program2.addCommand(agentCommand());
 program2.addCommand(authCommand());