[syaifulizhan]

What does this PR do?

Closes #2793.

Motivation

Tracked .env files, private keys and credential files are currently indexed like any
source file. Their contents then reach the graph and are served to AI agents through
search_code and get_code_snippet. Indexing a repository should not turn it into a
channel for its own secrets.

What changes

Discovery skips secret-bearing files in every index mode (reported with reason
secret-file in the ignored-files list):

• .env, .env.*, *.env
• *.pem, *.key, *.p12, *.pfx, *.jks, *.keystore
• id_rsa*, id_dsa*, id_ecdsa*, id_ed25519*
• .npmrc, .pypirc, .netrc, .git-credentials, .htpasswd
• credentials.json, service-account.json, secrets.json, secrets.y(a)ml

Templates (.env.example, .env.sample, .env.template, .env.dist) stay indexed:
they document configuration without carrying it.

Opt-in

New config key index_secret_files (default false):

codebase-memory-mcp config set index_secret_files true

It is part of the existing index policy, so it is validated like index_max_files, shown in
config list, and carried to the index worker and daemon with the other policy values.
Users who want .env files in the graph (for example for compose ${VAR} resolution, or the
DotEnv grammar) can enable it explicitly.

Behaviour note

.env was previously indexed by default; three existing tests assumed that (compose .env
interpolation, two DotEnv probes). They now opt in via the policy or assert the new default.

Tests

• secret_filename_classification, discover_skips_secret_files_by_default,
  discover_indexes_secret_files_when_opted_in (tests/test_discover.c)
• index_policy_secret_files_defaults_off_and_round_trips,
  index_policy_secret_files_config_key_is_loaded (tests/test_index_policy.c)
• Adjusted: incremental_compose_dotenv_change_rebuilds, probe_dotenv_module_only,
  probe_dotenv_local_suffix

Docs

docs/CONFIGURATION.md (key table) and the README config examples.

Known limit: the non-git watcher's file-tree scan (inventory_filter) does not poll secret
files in either setting.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (full ASan/UBSan suite; affected suites discover, index_policy, pipeline, grammar_probe_g: 606 passed)
• clang-format: no changes needed on all touched files (clang-format 23.1.4, repo .clang-format); clang-tidy left to CI
• New behavior is covered by a test

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you so much for this, @syaifulizhan, and for filing #2793 with a clear repro. Keeping credentials out of agent context is exactly the right instinct, and the policy plumbing (validation, config list, worker propagation) follows our existing index_max_files design nicely. Because this changes what gets indexed by default (DotEnv nodes, compose .env change detection, Helm secrets.yaml templates) and relates to #1079, the maintainer is deciding the default and the scope first. We will follow up here shortly with a concrete direction.