From 20dba15d63fb714374ef42f39557064296286594 Mon Sep 17 00:00:00 2001 From: FilipBl4gojevic <84703395+FilipBl4gojevic@users.noreply.github.com> Date: Tue, 28 Jul 2026 18:30:43 +0200 Subject: [PATCH] fix(signer): gitignore the signer's audit log, matching the builder's vector-signer-audit-log.json resolves inside the repo checkout by default, and the README self-disclosed that it was NOT in .gitignore (unlike the builder's vector-audit-log.json). A documented footgun is worse than no footgun when the fix is one line. Adds the entry and updates the README paragraph that described the gap to describe the fix instead. Final whole-branch review, Fix 1 of 4. Co-Authored-By: Claude Opus 5 --- .gitignore | 1 + packages/signer/README.md | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8b089dc..39c2b9e 100644 --- a/.gitignore +++ b/.gitignore @@ -38,6 +38,7 @@ mnemonic.txt # Runtime state (contains transaction history) vector-audit-log.json +vector-signer-audit-log.json # Incremental typecheck cache (npm run typecheck uses --incremental) *.tsbuildinfo diff --git a/packages/signer/README.md b/packages/signer/README.md index 2121fc7..47c7f52 100644 --- a/packages/signer/README.md +++ b/packages/signer/README.md @@ -76,10 +76,11 @@ Optional: directories up from `build/index.js` — the monorepo root, in this repo), **not** against whatever directory the process happened to be started from. That makes the location predictable regardless of your MCP client's working directory, but it also means the file is -easy to forget about. In particular: unlike the builder's `vector-audit-log.json`, this -filename is **not currently listed in this repo's `.gitignore`**. If you run the signer from a -checkout of this repo without setting `VECTOR_SIGNER_AUDIT_LOG_PATH` explicitly, check before -you `git add` — or just set the variable and point it somewhere outside the repo. +easy to forget about. Like the builder's `vector-audit-log.json`, this exact filename is listed +in this repo's `.gitignore`, so a default-configured signer run from a checkout will not get its +audit log accidentally staged. That entry only matches the default filename, though — if you +point `VECTOR_SIGNER_AUDIT_LOG_PATH` at some other path inside the repo, check before you +`git add`, or just set the variable to somewhere outside the repo entirely. ## Tools