4.0.7 — branch names, Azure, and CLI honesty

4.0.7

Wave-2 findings from nine independent critics, one dimension each.

Credentials

• A branch name is user input. git checkout -b "release2/<ghp_…>" copied the token raw into manifest.git.branch, the README and the audit report — a channel that never passed through redaction. Masked now.
• Azure had no rules. DevOps PATs, AD client secrets (…8Q~…) and SAS sig= reached parts and both monoliths verbatim. Added.
• Missing prefixes in otherwise exhaustive alternations: ABIA (AWS bearer), glrt- (GitLab runner), hvb. (Vault batch), 1//0… (GCP refresh), sk_test_ (Stripe test).
• exclude in a config was ignored silently, so a directory the user excluded was still emitted. Accepted as an alias of excludePatterns.

The documented programmatic flow scanned the wrong project

resolveConfig(await loadConfigFile(dir)) ignored dir and generated into process.cwd(), exit 0. The loaded config carries its directory now, so the documented flow scans the project the config describes.

Small lies in the CLI

• --mode was discarded when a command word was present: generate --mode validate wrote a snapshot. A contradiction is exit 2 now.
• --only-artifacts monolith wrote nothing but the marker; naming the monolith now enables it.
• init wrote "snapshot": "codebase-snapshot generate" without installing the package, so npm run snapshot failed with "not recognized". Scripts are npx @ankurhalder/codebase-snapshot … now.