callstack / callstack/agent-device

chore(worktrees): stop copying .env into agent worktrees

Open Beginner friendly
#2,530 1 comment 0 reactions 0 assignees View on GitHub
refactor
Dominant language
TypeScript
Stars
4.6k
Forks
299
Avg merge
10h 14m
Merged PRs (30d)
537

Description

## Hygiene

`.worktreeinclude:2-3` copies `.env` and `.env.*` into every agent worktree; 32 copies exist on the maintainer host. No repo code reads `.env` (no dotenv, no `--env-file`); the operator recipe sources it manually (`set -a && . ./.env && set +a`). The copies are on one laptop under one user, so this is hygiene, not an exposure: the risk is an agent tarring or `cat`-ing a worktree into a transcript.

## Fix

Delete the two lines. Update the operator recipe (memory/docs) to source the main checkout's `.env` by absolute path. No guard script, no rotation unless a copy is known to have left the machine.

Land last: it touches `.worktreeinclude` after the config-drift issue does.

Contributor guide

Open the contributing guide

Research direction

Start with .worktreeinclude and the operator recipe in the memory/docs mentioned by the issue. Confirm that the recipe sources .env from the main checkout by absolute path, then remove the two include lines. Done means new agent worktrees no longer contain .env or .env.* and the recipe still sources the main checkout's environment.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, tooling
Issue type
Refactor
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.