@ngockhoale/ukit 3.4.8 → 3.4.10

package/CHANGELOG.md

@@ -2,7 +2,10 @@
 
 All notable changes to UKit are documented here.
 
-## 3.4.7 - 2026-10-01
+## 3.4.8 - 2026-10-01
+
+(3.4.7 and 3.4.9 were lost to npm staged-version E409 limbo; 3.4.8 landed and its `latest` tag was assigned via `npm dist-tag`.)
+
 
 **Completion gate no longer demands an edit for read-only questions.** The
 skill router now stamps `routingContext.mutationOrder` (was the prompt a real

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.8",
+  "version": "3.4.10",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/hooks/sensitive-data-guard.mjs

@@ -201,7 +201,14 @@ async function evaluate({ rawInput, projectRoot, env }) {
     const rawBase = normalized.split('/').pop();
     if (!rawBase) return null;
     const base = rawBase.toLowerCase();
-    if (base.endsWith('.env.example')) return null;
+    // .env* placeholders that carry no secrets by convention: any dotenv file
+    // whose basename marks it a non-secret distributable — .env.example,
+    // .env.example.local, .env.examples, .env.sample, .env.dist,
+    // .env.template, .env.dev.example. The marker must appear after the
+    // '.env' prefix so a real env file can never dodge by containing the word
+    // earlier (there is nothing before '.env' in the basename anyway — the
+    // check is anchored on the dotenv name itself).
+    if (/^\.env[._-]?.*\b(example|examples|sample|template|dist)\b/i.test(base)) return null;
     if (base === '.env' || base.startsWith('.env.')) return 'dotenv/secret env file';
     if (base.endsWith('.pub') || base.endsWith('.public')) return null;
     if (/^id_(rsa|dsa|ecdsa|ed25519)(\.|$)/.test(base)) return 'SSH private key';