replit-tools 1.0.8 → 1.0.10

package/README.md

@@ -278,10 +278,16 @@ Running the installer again is safe - it preserves existing data.
 ## Security
 
 The installer adds these to `.gitignore`:
-- `.claude-persistent/` (contains credentials)
-- `.codex-persistent/` (contains credentials)
 
-Your API keys and conversation history won't be committed to git.
+| Path | Contains | Why Protected |
+|------|----------|---------------|
+| `.claude-persistent/` | OAuth tokens, refresh tokens, conversations | **Critical** - full account access |
+| `.codex-persistent/` | API keys in `auth.json`, conversations | **Critical** - full account access |
+| `.claude-sessions/` | Session UUIDs, terminal mappings | Session metadata |
+| `.persistent-home/` | Bash history | May contain typed secrets |
+| `logs/auth-refresh.log` | Token refresh timestamps | Auth timing info |
+
+Your API keys, OAuth tokens, and conversation history won't be committed to git.
 
 ## Why "DATA Tools"?
 

package/index.js

@@ -515,7 +515,14 @@ alias claude-pick='claude -r --dangerously-skip-permissions'
 
   console.log('📝 Updating .gitignore...');
   const gitignorePath = path.join(WORKSPACE, '.gitignore');
-  const gitignoreEntries = '\n# Claude/Codex credentials (added by DATA Tools)\n.claude-persistent/\n.codex-persistent/\n';
+  const gitignoreEntries = `
+# Claude/Codex data (added by DATA Tools)
+.claude-persistent/
+.codex-persistent/
+.claude-sessions/
+.persistent-home/
+logs/auth-refresh.log
+`;
 
   try {
     if (fs.existsSync(gitignorePath)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replit-tools",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "DATA Tools - One command to set up Claude Code and Codex CLI on Replit with full persistence",
   "main": "index.js",
   "bin": {