@hiveku-apps/sync 0.3.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/codex.mjs +8 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hiveku-apps/sync",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.2",
|
|
4
4
|
"description": "Sync a Hiveku account's memory/rules/skills + coder projects into a local folder, and ship projects (push/deploy/pull-env) from the terminal. Pairs with the Hiveku MCP at core.hiveku.com/mcp so Claude Code can drive Hiveku tools per-folder.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
package/src/codex.mjs
CHANGED
|
@@ -226,7 +226,14 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
|
|
|
226
226
|
await mkdir(dirname(tomlPath), { recursive: true });
|
|
227
227
|
await writeFile(tomlPath, upsertMarkedRegion(toml, TOML_BEGIN, TOML_END, codexTomlRegion({ baseUrl, profile, apiKey })), 'utf8');
|
|
228
228
|
|
|
229
|
-
|
|
229
|
+
// Gitignore EVERY credential-bearing file this lane depends on — not just the
|
|
230
|
+
// one we write. The retrofit reads .env for OLYMPUS_API_KEY to inline it, so a
|
|
231
|
+
// folder that had no .gitignore would otherwise end up with one that ignores
|
|
232
|
+
// .codex/config.toml while leaving the key-bearing .env tracked. (The breach
|
|
233
|
+
// entry point was a leaked credential; a scaffolder must never leave one
|
|
234
|
+
// git-trackable.) runInit already covers .env for fresh folders; this makes
|
|
235
|
+
// the retrofit path equally safe.
|
|
236
|
+
await appendGitignoreLines(folder, ['.codex/config.toml', '.env', '.env.local', '.hiveku/']);
|
|
230
237
|
|
|
231
238
|
const skills = await mirrorKnowledgeToSkills(folder);
|
|
232
239
|
return { inlinedKey: !!apiKey, skillsMirrored: skills };
|