@gonkagate/claude-code 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -2,10 +2,35 @@
 
 ## Unreleased
 
+- Improved npm package metadata and README copy for better package-page clarity, discovery, and onboarding.
 - Added a curated model registry and model picker to the public installer flow.
 - Added `--model <model-key>` and `--model=<model-key>` support for curated non-secret model selection.
 - Kept the public Claude Code contract tight by limiting model selection to the curated GonkaGate registry only.
 - Updated docs and tests for model selection while preserving local git ignore protection and owner-only settings file permissions.
+- Hardened local scope against symlinked `.claude` paths that could redirect secret writes outside the ignored settings path.
+- Extended local git protection to ignore timestamped backup files for `.claude/settings.local.json`.
+- Normalized backup permissions to owner-only mode so secret-bearing backups are not left world-readable.
+- Made local scope fail closed if `.claude/settings.local.json` is already tracked by git before secrets are written.
+- Hardened local scope against symlinked path components anywhere between the repo root and the target settings file.
+- Pinned GitHub Actions workflows to immutable commit SHAs for release pipeline hardening.
+- Restored automated npm publish dispatch after Release Please creates a new release tag.
+- Made publish reruns skip versions that are already present on npm instead of failing with a duplicate-version error.
+
+## [0.1.2](https://github.com/GonkaGate/gonkagate-claude-code/compare/v0.1.1...v0.1.2) (2026-03-31)
+
+
+### Bug Fixes
+
+* restore automated npm publishes ([42bde87](https://github.com/GonkaGate/gonkagate-claude-code/commit/42bde8795e264c8950017aa5acff0475b4fb0c8e))
+* restore automated npm publishes ([52fcd8e](https://github.com/GonkaGate/gonkagate-claude-code/commit/52fcd8e428ccae967871aba800344dd786a048ce))
+
+## [0.1.1](https://github.com/GonkaGate/gonkagate-claude-code/compare/v0.1.0...v0.1.1) (2026-03-31)
+
+
+### Bug Fixes
+
+* stop duplicate npm publishes ([1ac876a](https://github.com/GonkaGate/gonkagate-claude-code/commit/1ac876a4fb1c99bd1a1cc892e38ee2c7df3be799))
+* stop duplicate npm publishes ([58d022f](https://github.com/GonkaGate/gonkagate-claude-code/commit/58d022ff2486fa6156badc791cb236f580b68a9c))
 
 ## 0.1.0
 

package/README.md

@@ -1,10 +1,12 @@
-# gonkagate-claude-code
+# @gonkagate/claude-code
 
-Set up Claude Code to use GonkaGate in one step.
+Set up Claude Code to use GonkaGate in one `npx` command.
 
-This tool configures local `Claude Code` to use GonkaGate's Anthropic-compatible gateway at `https://api.gonkagate.com`.
+This CLI installer is for developers who already have local `Claude Code` and want to use it with GonkaGate, the gateway to Gonka Network, without editing shell profiles, exporting long env var blocks, or writing `.env` files by hand.
 
-It does not install `Claude Code` itself. It sets up an existing local Claude Code install.
+Under the hood it configures Claude Code to use GonkaGate's Anthropic-compatible endpoint at `https://api.gonkagate.com`.
+
+It does not install `Claude Code` itself. It configures an existing local Claude Code install.
 
 ## Quick Start
 
@@ -12,9 +14,11 @@ It does not install `Claude Code` itself. It sets up an existing local Claude Co
 npx @gonkagate/claude-code
 ```
 
+Need an API key first? [Create one on GonkaGate](https://gonkagate.com/en).
+
 You will be asked for:
 
-- your GonkaGate API key (`gp-...`)
+- your GonkaGate API key (`gp-...`) in a hidden interactive prompt
 - a model from the supported GonkaGate list
 - setup scope: `user` or `local`
 
@@ -24,6 +28,12 @@ You need:
 - Node.js 18+
 - a GonkaGate API key
 
+## Supported Model
+
+Current public Claude Code model in the curated registry:
+
+- `qwen3-235b` -> `qwen/qwen3-235b-a22b-instruct-2507-fp8`
+
 ## What It Does
 
 The tool writes Claude Code settings so you can keep running `claude` normally afterward.
@@ -41,7 +51,10 @@ It also:
 - preserves unrelated Claude Code settings
 - creates a backup before overwriting an existing settings file
 - writes settings files with owner-only permissions
-- adds `.claude/settings.local.json` to `.git/info/exclude` for local setup inside a git repo
+- writes backup files with owner-only permissions
+- adds `.claude/settings.local.json` and local backup files to `.git/info/exclude` for local setup inside a git repo
+- refuses local setup if `.claude/settings.local.json` is already tracked by git
+- refuses local setup if the target path traverses a symlinked path component, or if `.claude` / the local settings file is a symlink
 
 ## Fixed GonkaGate Setup
 
@@ -53,12 +66,6 @@ These parts are intentionally fixed:
 
 This tool does not ask for a custom base URL and does not accept arbitrary custom model IDs.
 
-## Supported Model
-
-Current public Claude Code model:
-
-- `qwen3-235b` -> `qwen/qwen3-235b-a22b-instruct-2507-fp8`
-
 The selected model is written into all Claude Code model env vars used by this setup flow.
 
 ## Verify
@@ -73,6 +80,7 @@ After setup:
 ## What This Tool Does Not Do
 
 - It does not configure `claude.ai`
+- It does not install `Claude Code` itself
 - It does not edit `.zshrc`, `.bashrc`, PowerShell profiles, or other shell startup files
 - It does not write `.env` files
 - It does not support arbitrary custom model IDs
@@ -80,9 +88,9 @@ After setup:
 
 ## Need Help?
 
-- Troubleshooting: [docs/troubleshooting.md](docs/troubleshooting.md)
-- Security notes: [docs/security.md](docs/security.md)
-- Internal behavior: [docs/how-it-works.md](docs/how-it-works.md)
+- Troubleshooting: [docs/troubleshooting.md](https://github.com/GonkaGate/gonkagate-claude-code/blob/main/docs/troubleshooting.md)
+- Security notes: [docs/security.md](https://github.com/GonkaGate/gonkagate-claude-code/blob/main/docs/security.md)
+- Internal behavior: [docs/how-it-works.md](https://github.com/GonkaGate/gonkagate-claude-code/blob/main/docs/how-it-works.md)
 
 ## Development
 

package/dist/install/backup.js

@@ -1,10 +1,11 @@
-import { copyFile } from "node:fs/promises";
+import { chmod, copyFile } from "node:fs/promises";
 function toBackupSuffix(timestamp = new Date()) {
     return timestamp.toISOString().replace(/[:.]/g, "-");
 }
 export async function createBackup(filePath) {
     const backupPath = `${filePath}.backup-${toBackupSuffix()}`;
     await copyFile(filePath, backupPath);
+    await chmod(backupPath, 0o600);
     return backupPath;
 }
 //# sourceMappingURL=backup.js.map

package/dist/install/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/install/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,SAAS,cAAc,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;IAC5C,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,UAAU,GAAG,GAAG,QAAQ,WAAW,cAAc,EAAE,EAAE,CAAC;IAC5D,MAAM,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/install/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEnD,SAAS,cAAc,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;IAC5C,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,UAAU,GAAG,GAAG,QAAQ,WAAW,cAAc,EAAE,EAAE,CAAC;IAC5D,MAAM,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/install/local-git-ignore.js

@@ -1,31 +1,104 @@
-import { access, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { access, lstat, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
 export async function ensureLocalSettingsIgnored(targetPath) {
     const gitContext = await findGitContext(path.dirname(targetPath));
+    await assertSafeLocalSettingsTarget(targetPath, gitContext?.repoRoot);
     if (!gitContext) {
         return;
     }
-    const relativeTargetPath = path.relative(gitContext.repoRoot, targetPath);
-    if (relativeTargetPath.startsWith("..")) {
-        throw new Error("Expected local Claude Code settings to stay inside the current git repository.");
-    }
+    const relativeTargetPath = requireRepoRelativePath(targetPath, gitContext.repoRoot);
+    await assertTargetIsNotTracked(relativeTargetPath, gitContext.repoRoot);
     const normalizedRelativePath = relativeTargetPath.split(path.sep).join("/");
-    const ignoreEntry = `/${normalizedRelativePath}`;
+    const ignoreEntries = [
+        `/${normalizedRelativePath}`,
+        `/${normalizedRelativePath}.backup-*`
+    ];
     const excludePath = path.join(gitContext.gitDir, "info", "exclude");
     const existingContent = await readOptionalFile(excludePath);
     const existingEntries = new Set(existingContent
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter((line) => line.length > 0 && !line.startsWith("#")));
-    if (existingEntries.has(ignoreEntry)) {
+    const missingEntries = ignoreEntries.filter((ignoreEntry) => !existingEntries.has(ignoreEntry));
+    if (missingEntries.length === 0) {
         return;
     }
     await mkdir(path.dirname(excludePath), { recursive: true });
     const nextContent = existingContent.length === 0
-        ? `${ignoreEntry}\n`
-        : `${existingContent}${existingContent.endsWith("\n") ? "" : "\n"}${ignoreEntry}\n`;
+        ? `${missingEntries.join("\n")}\n`
+        : `${existingContent}${existingContent.endsWith("\n") ? "" : "\n"}${missingEntries.join("\n")}\n`;
     await writeFile(excludePath, nextContent, "utf8");
 }
+async function assertSafeLocalSettingsTarget(targetPath, repoRoot) {
+    const pathsToInspect = repoRoot
+        ? getPathsFromRepoRoot(repoRoot, targetPath)
+        : [path.dirname(targetPath), targetPath];
+    for (const currentPath of pathsToInspect) {
+        await assertPathIsNotSymlink(currentPath, getSymlinkErrorMessage(currentPath, targetPath, repoRoot));
+    }
+}
+async function assertPathIsNotSymlink(filePath, errorMessage) {
+    try {
+        const fileStats = await lstat(filePath);
+        if (fileStats.isSymbolicLink()) {
+            throw new Error(errorMessage);
+        }
+    }
+    catch (error) {
+        if (isMissingFileError(error)) {
+            return;
+        }
+        throw error;
+    }
+}
+function getPathsFromRepoRoot(repoRoot, targetPath) {
+    const relativeTargetPath = requireRepoRelativePath(targetPath, repoRoot);
+    const targetSegments = relativeTargetPath.split(path.sep).filter((segment) => segment.length > 0);
+    const paths = [repoRoot];
+    let currentPath = repoRoot;
+    for (const segment of targetSegments) {
+        currentPath = path.join(currentPath, segment);
+        paths.push(currentPath);
+    }
+    return paths;
+}
+function requireRepoRelativePath(targetPath, repoRoot) {
+    const relativeTargetPath = path.relative(repoRoot, targetPath);
+    if (relativeTargetPath.length === 0 || relativeTargetPath.startsWith("..") || path.isAbsolute(relativeTargetPath)) {
+        throw new Error("Expected local Claude Code settings to stay inside the current git repository.");
+    }
+    return relativeTargetPath;
+}
+function getSymlinkErrorMessage(currentPath, targetPath, repoRoot) {
+    if (currentPath === path.dirname(targetPath)) {
+        return 'Refusing to write local Claude Code settings into a symlinked ".claude" directory.';
+    }
+    if (currentPath === targetPath) {
+        return "Refusing to overwrite local Claude Code settings through a symlinked settings file.";
+    }
+    const label = repoRoot ? path.relative(repoRoot, currentPath) || path.basename(currentPath) : currentPath;
+    return `Refusing local Claude Code setup through a symlinked path component: ${label}.`;
+}
+async function assertTargetIsNotTracked(relativeTargetPath, repoRoot) {
+    try {
+        await execFileAsync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", relativeTargetPath], {
+            encoding: "utf8"
+        });
+        throw new Error(`Refusing local install because ${relativeTargetPath} is already tracked by git. Remove it from the index before writing secrets.`);
+    }
+    catch (error) {
+        if (isMissingGitBinaryError(error)) {
+            throw new Error("Git is required to verify that local Claude Code settings are not already tracked before writing secrets.");
+        }
+        if (isGitPathUnmatchedError(error)) {
+            return;
+        }
+        throw error;
+    }
+}
 async function findGitContext(startDirectory) {
     let currentDirectory = path.resolve(startDirectory);
     for (;;) {
@@ -73,4 +146,13 @@ async function readOptionalFile(filePath) {
         return "";
     }
 }
+function isMissingFileError(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isMissingGitBinaryError(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isGitPathUnmatchedError(error) {
+    return error instanceof Error && "code" in error && error.code === 1;
+}
 //# sourceMappingURL=local-git-ignore.js.map

package/dist/install/local-git-ignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-git-ignore.js","sourceRoot":"","sources":["../../src/install/local-git-ignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IACjE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAElE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE1E,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,eAAe;SACZ,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC9D,CAAC;IAEF,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,WAAW,GACf,eAAe,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,GAAG,WAAW,IAAI;QACpB,CAAC,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,WAAW,IAAI,CAAC;IAExF,MAAM,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,cAAsB;IAClD,IAAI,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAEpD,SAAS,CAAC;QACR,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAEpE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,gBAAgB;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAEvD,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gBAAgB,GAAG,eAAe,CAAC;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,aAAqB,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"local-git-ignore.js","sourceRoot":"","sources":["../../src/install/local-git-ignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,UAAkB;IACjE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,6BAA6B,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpF,MAAM,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAExE,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG;QACpB,IAAI,sBAAsB,EAAE;QAC5B,IAAI,sBAAsB,WAAW;KACtC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,eAAe;SACZ,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC9D,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAEhG,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,WAAW,GACf,eAAe,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAClC,CAAC,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAEtG,MAAM,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,UAAkB,EAAE,QAAiB;IAChF,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAE3C,KAAK,MAAM,WAAW,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,sBAAsB,CAAC,WAAW,EAAE,sBAAsB,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,YAAoB;IAC1E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,UAAkB;IAChE,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,WAAW,GAAG,QAAQ,CAAC;IAE3B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB,EAAE,QAAgB;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE/D,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB,EAAE,UAAkB,EAAE,QAAiB;IACxF,IAAI,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IAED,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1G,OAAO,wEAAwE,KAAK,GAAG,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,kBAA0B,EAAE,QAAgB;IAClF,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE;YACpG,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CACb,kCAAkC,kBAAkB,8EAA8E,CACnI,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;QAC/H,CAAC;QAED,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,cAAsB;IAClD,IAAI,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAEpD,SAAS,CAAC;QACR,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAEpE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,MAAM;gBACN,QAAQ,EAAE,gBAAgB;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAEvD,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gBAAgB,GAAG,eAAe,CAAC;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,aAAqB,EAAE,QAAgB;IAClE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC;QAEjD,IAAI,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,GAAG,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/docs/how-it-works.md

@@ -29,7 +29,9 @@ The installer writes one Claude Code settings file:
 
 It does not touch any shell profile or other configuration file.
 
-For `local` scope inside a git repository, it also adds `.claude/settings.local.json` to `.git/info/exclude` before writing the file.
+For `local` scope inside a git repository, it also adds `.claude/settings.local.json` and `.claude/settings.local.json.backup-*` to `.git/info/exclude` before writing the file.
+
+For safety, local scope refuses to proceed if `.claude/settings.local.json` is already tracked by git, or if any existing path component on the way to the target is a symlink. That includes a symlinked `.claude` directory and a symlinked local settings file.
 
 ## Write behavior
 
@@ -37,7 +39,7 @@ When the target file already exists, the installer:
 
 1. Parses the existing JSON
 2. Refuses to continue if the JSON is invalid
-3. Creates a timestamped backup
+3. Creates a timestamped backup with owner-only permissions
 4. Preserves unrelated settings
 5. Updates only the relevant `env` keys, including all Claude model env vars with the selected curated model id
 6. Adds Claude Code's JSON schema if `$schema` is missing

package/docs/security.md

@@ -17,14 +17,18 @@ Claude Code reads environment variables from its settings files. That means the
 - `~/.claude/settings.json`
 - `.claude/settings.local.json`
 
-This repo does not write `.env` files and does not modify shell startup files. It also writes the target settings file with owner-only permissions.
+This repo does not write `.env` files and does not modify shell startup files. It also writes the target settings file with owner-only permissions and locks backup files down to owner-only permissions too.
 
 ## Local scope hygiene
 
-If you choose `local` scope inside a git repository, the installer adds `.claude/settings.local.json` to the repo's `.git/info/exclude` before writing the file so the secret-bearing settings file is not immediately visible to git.
+If you choose `local` scope inside a git repository, the installer first verifies that `.claude/settings.local.json` is not already tracked by git. If it is already tracked, the installer stops instead of writing a secret into a tracked file.
+
+For untracked local installs, the installer adds `.claude/settings.local.json` and its timestamped backup pattern to the repo's `.git/info/exclude` before writing the file so secret-bearing local settings do not immediately show up in git.
 
 If your team already manages ignores another way, that is still fine. The important rule is that `.claude/settings.local.json` must stay uncommitted.
 
+The installer also refuses local setup through a symlinked path component on the way to `.claude/settings.local.json`, including a symlinked `.claude` directory or a symlinked local settings file. That prevents a repository from redirecting the secret-bearing write to some other tracked or non-local location.
+
 ## Backup behavior
 
 Before overwriting an existing target settings file, the installer creates a timestamped backup next to it. If something looks wrong afterward, restore from that backup and rerun the installer.

package/docs/troubleshooting.md

@@ -51,6 +51,22 @@ Restore from the timestamped backup next to the settings file, or fix the JSON m
 
 Rerun the installer and choose `local` scope. That writes `.claude/settings.local.json` in the current repository instead of editing your global `~/.claude/settings.json`.
 
+## Local install refused because `.claude/settings.local.json` is already tracked by git
+
+For `local` scope, the installer now stops if `.claude/settings.local.json` is already a tracked file in the repository.
+
+That safety check prevents the installer from writing your API key into a file that `git status` would continue to treat as commit-ready.
+
+Remove the file from the git index first, or use `user` scope instead, then rerun the installer.
+
+## Local install refused because the target path uses a symlink
+
+For `local` scope, the installer now rejects a symlinked path component anywhere on the way to `.claude/settings.local.json`, including a symlinked `.claude` directory or a symlinked `.claude/settings.local.json`.
+
+That safety check prevents a repository from redirecting your API key into some other location that git might track.
+
+Replace the symlink with a real `.claude` directory, then rerun the installer.
+
 ## Manual settings edits
 
 Manual edits to the Claude Code settings file are possible, but they are outside the supported public install flow for this repo.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@gonkagate/claude-code",
-  "version": "0.1.0",
-  "description": "Connect Claude Code to GonkaGate in one step.",
-  "homepage": "https://github.com/GonkaGate/gonkagate-claude-code",
+  "version": "0.1.2",
+  "description": "CLI installer for using Claude Code with GonkaGate on Gonka Network.",
+  "homepage": "https://github.com/GonkaGate/gonkagate-claude-code#readme",
   "bugs": {
     "url": "https://github.com/GonkaGate/gonkagate-claude-code/issues"
   },
@@ -12,7 +12,7 @@
   },
   "type": "module",
   "bin": {
-    "gonkagate-claude-code": "./bin/gonkagate-claude-code.js"
+    "gonkagate-claude-code": "bin/gonkagate-claude-code.js"
   },
   "files": [
     "bin",
@@ -27,18 +27,22 @@
     "build": "tsc -p tsconfig.json",
     "dev": "tsx src/cli.ts",
     "prepack": "npm run build",
-    "test": "tsx --test test/**/*.test.ts",
+    "test": "node scripts/run-tests.mjs",
     "ci": "npm test && npm run build"
   },
   "engines": {
     "node": ">=18"
   },
   "keywords": [
-    "claude-code",
     "gonkagate",
-    "anthropic",
-    "installer",
-    "cli"
+    "gonka",
+    "gonka ai",
+    "gonka-network",
+    "gonka blockchain",
+    "gonka-api",
+    "gonka gateway",
+    "claude-code",
+    "claude code"
   ],
   "license": "Apache-2.0",
   "packageManager": "npm@11.11.1",

package/scripts/run-tests.mjs

@@ -0,0 +1,49 @@
+import { spawnSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(scriptDir, '..');
+const testRoot = join(repoRoot, 'test');
+
+function collectTestFiles(directory) {
+  const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) =>
+    a.name.localeCompare(b.name),
+  );
+  const files = [];
+
+  for (const entry of entries) {
+    const fullPath = join(directory, entry.name);
+
+    if (entry.isDirectory()) {
+      files.push(...collectTestFiles(fullPath));
+      continue;
+    }
+
+    if (entry.isFile() && entry.name.endsWith('.test.ts')) {
+      files.push(fullPath);
+    }
+  }
+
+  return files;
+}
+
+const testFiles = collectTestFiles(testRoot);
+
+if (testFiles.length === 0) {
+  console.error('No test files found under test/.');
+  process.exit(1);
+}
+
+const tsxCliPath = join(repoRoot, 'node_modules', 'tsx', 'dist', 'cli.mjs');
+const result = spawnSync(process.execPath, [tsxCliPath, '--test', ...testFiles], {
+  cwd: repoRoot,
+  stdio: 'inherit',
+});
+
+if (result.error) {
+  throw result.error;
+}
+
+process.exit(result.status ?? 1);