[PiquelChips]

preview deploy --local sends every unignored file in the worktree, including files not in HEAD: untracked ones, and ones only staged by an accidental git add -A. A .env.local or deploy.pem was uploaded to the daemon with only an easily missed Info line, which --quiet and --json callers never see.

• Refuse likely secret files (CLI-01, D1): a file not in HEAD, untracked or only staged, stops the command with invalid_input if it's named, ignoring case, .env* (except .example, .sample and .template ones), id_*, *.pem, *.key, *.p12, *.pfx, credentials, *credentials.json, .npmrc, .pypirc, .netrc or .git-credentials. The error names up to 20 of the files, lists all of them in details.files, and suggests .gitignore or --allow-secret-files.
• --allow-secret-files sends them anyway. Tracked files are unaffected: a committed .env template is still sent as committed.

Worktree::secret_files combines git ls-files --others --exclude-standard (through the shared ls_files helper) with git diff --cached --diff-filter=A HEAD, separately from the snapshot, so snapshot() is unchanged. The --local options move into a flattened SnapshotArgs, because clippy limits a struct to three bools. The previews guide, cli.md and the CLI reference are updated.

Proof: a new snapshot test checks that the fixture's committed .env and ignored files aren't flagged. A staged .env.local, deploy/server.PEM, id_ecdsa, .git-credentials and application_default_credentials.json are flagged; keys.txt, credentials.go and .env.example are not. cargo nextest run -p piquelctl (123), clippy -D warnings and fmt pass.

Note

Written by Claude Opus 5.5 in Claude Code and reviewed by Claude Opus 5.5 (via T3 Code)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 17b19f98-147d-4ce4-be7c-2c9360fce634

Commits

Reviewing files that changed from the base of the PR and between 3ae88fe and 0c2a47d.

Files selected for processing: 6

• apps/piquelctl/src/previews.rs
• apps/piquelctl/src/snapshot.rs
• apps/piquelctl/src/support.rs
• docs/user/applications/previews.md
• docs/user/reference/cli-commands.md
• docs/user/reference/cli.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn