[daum110715]

Summary

Supersedes closed #18 with a clean redo.

main currently tracks files that are already listed in .gitignore (or should be). This PR untracks them so contributors stop pulling secrets / build artifacts / local package-store junk.

Changes

Item	Action
.env.development, .env.production	untrack (keep .env.example)
coverage/** Vitest HTML report	untrack
.pnpm-store/**	untrack + add to .gitignore
fix-light-theme.cjs, scan-remaining.cjs	delete one-off root scripts

Why redo #18

Previous #18 was abandoned because it sat on bare main without the shared CI-green base, and missed untracking .pnpm-store. This branch:

1. Includes the same shared base as fix(desktop): localize PC app names via i18n #13–ci(worker): skip deploy when Cloudflare secrets not configured #17 (scraper axios→fetch + prettier) so format/typecheck stay green
2. Also removes tracked .pnpm-store (present on current main)
3. Contains no app/worker runtime changes

Base commits (shared, will shrink after any of #13–#17 merges)

1. refactor(app): replace axios with native fetch in scraper
2. style(app): apply prettier to fix CI format check on 15 upstream files
3. this PR: repo hygiene only

Testing

• pnpm typecheck — pass
• pnpm lint:check — pass (warnings only, pre-existing)

Notes

• Untracking env files does not purge them from git history; rotate any real secrets that were ever committed if needed.
• Independent of feature PRs fix(desktop): localize PC app names via i18n #13–ci(worker): skip deploy when Cloudflare secrets not configured #17; safe to merge anytime.

[LemonStudio-hub]

🔍 Code Review — Request Changes

Summary

Untracks .env.development, .env.production, coverage/, .pnpm-store/, and two one-off scripts. Adds .pnpm-store to .gitignore. PR also bundles ~17 non-hygiene files from shared base commits.

Critical Issues

1. VITE_JWT_SECRET was committed in plaintext — secret rotation is MANDATORY

• Value scp-os-production-jwt-2026-secure-key remains in git history forever
• This is a VITE_ prefixed variable — it gets baked into the client-side JS bundle at build time
• PR body treats rotation as optional — it is NOT optional for a production JWT signing key
• Fix: Rotate the JWT secret immediately (generate new one via Cloudflare dashboard, invalidate old tokens)
• Also: VITE_ prefix variables should NEVER contain secrets — Vite inlines them into browser-visible source

2. .env files are STILL tracked by git

• git ls-files confirms both .env.development and .env.production are still in the index
• .gitignore entries exist but files were tracked before the rules were added
• Fix: Run git rm --cached .env.production .env.development

Warning Issues

3. PR scope creep — scraper.ts refactor (axios-to-fetch), composable changes, and 12 test file changes are bundled in. These should be merged via their respective PRs first.
4. No note that .env.example replaces deleted env files — add to PR body
5. Consider git filter-repo or BFG to purge secrets from all past commits

Recommendation: Request changes — block on secret rotation, actually untrack .env files, scope PR to hygiene-only changes.

[daum110715]

Addressed review feedback

Critical

1. Secret rotation is MANDATORY (not optional):
   • Historical value scp-os-production-jwt-2026-secure-key was committed as VITE_JWT_SECRET and baked into client bundles.
   • Operators must rotate Worker JWT_SECRET / ADMIN_JWT_SECRET via wrangler secret put and re-deploy; old tokens become invalid.
2. .env.production / .env.development untracked in this PR (git rm --cached / delete from tree). Diff vs upstream main removes both files. Only .env.example remains.

Also

• Strengthened .gitignore (**/.env* with !.env.example).
• .env.example documents: never use VITE_* for secrets; how to set Worker secrets; rotation requirement.
• History purge (git filter-repo / BFG) remains optional ops follow-up after rotation.

Ready for re-review after production secret rotation is confirmed.

[daum110715]

Ops update

Production Worker secrets have been rotated:

• JWT_SECRET — new value set via wrangler secret put --env production
• ADMIN_JWT_SECRET — new value set via wrangler secret put --env production

All previously issued JWTs (including any derived from leaked VITE_JWT_SECRET / hardcoded defaults) are invalid. Users must re-login.

[daum110715]

Status

• CI: Lint / Test / Build all green on latest tip (Security Scan skip is expected).
• Review feedback addressed on this tip; ready for re-review / merge when convenient.

No further code changes planned on this PR unless requested.