callstack / callstack/agent-device
chore(worktrees): stop copying .env into agent worktrees
- Dominant language
- TypeScript
- Stars
- 4.6k
- Forks
- 299
- Avg merge
- 10h 14m
- Merged PRs (30d)
- 537
Description
## Hygiene
`.worktreeinclude:2-3` copies `.env` and `.env.*` into every agent worktree; 32 copies exist on the maintainer host. No repo code reads `.env` (no dotenv, no `--env-file`); the operator recipe sources it manually (`set -a && . ./.env && set +a`). The copies are on one laptop under one user, so this is hygiene, not an exposure: the risk is an agent tarring or `cat`-ing a worktree into a transcript.
## Fix
Delete the two lines. Update the operator recipe (memory/docs) to source the main checkout's `.env` by absolute path. No guard script, no rotation unless a copy is known to have left the machine.
Land last: it touches `.worktreeinclude` after the config-drift issue does.
Contributor guide
Research direction
Start with .worktreeinclude and the operator recipe in the memory/docs mentioned by the issue. Confirm that the recipe sources .env from the main checkout by absolute path, then remove the two include lines. Done means new agent worktrees no longer contain .env or .env.* and the recipe still sources the main checkout's environment.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, tooling
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100