* Directories that almost never belong in a config file's `{file:}` inline. * Returns a short human label when `resolvedPath` sits inside one, else null. * Used to WARN (not block) on user-level config — see the call site.
(resolvedPath: string)
| 42 | * Used to WARN (not block) on user-level config — see the call site. |
| 43 | */ |
| 44 | function sensitiveFilePathReason(resolvedPath: string): string | null { |
| 45 | const home = homedir(); |
| 46 | const sensitiveDirs: Array<{ dir: string; label: string }> = [ |
| 47 | { dir: resolve(home, ".ssh"), label: "SSH keys" }, |
| 48 | { dir: resolve(home, ".aws"), label: "AWS credentials" }, |
| 49 | { dir: resolve(home, ".gnupg"), label: "GnuPG keyring" }, |
| 50 | { dir: resolve(home, ".config", "gh"), label: "GitHub CLI auth" }, |
| 51 | ]; |
| 52 | for (const { dir, label } of sensitiveDirs) { |
| 53 | if (resolvedPath === dir || resolvedPath.startsWith(`${dir}/`)) { |
| 54 | return label; |
| 55 | } |
| 56 | } |
| 57 | return null; |
| 58 | } |
| 59 | |
| 60 | /** |
| 61 | * Expand `{env:VAR}` and `{file:path}` tokens in raw config text. |
no test coverage detected